@homie-rocks/studio 0.10.0 → 0.11.0

package/worker/codex-script.mjs

@@ -0,0 +1,6 @@
+/**
+ * The Game Codex page's one script (lib/codex.mjs draws the page): its tabs, "Updated 5 s ago", and a reload every
+ * few seconds while a build runs in the local copy. Constant text with no data in it, so the site's private codex
+ * page (worker/stats-page.mjs) allows exactly this script by its hash and nothing else.
+ */
+export const CODEX_SCRIPT = `(function(){var d=document,t=[].slice.call(d.querySelectorAll('.tab')),n=[].slice.call(d.querySelectorAll('nav.tabs a'));if(!t.length)return;d.documentElement.classList.add('js');function show(id){var f=t.filter(function(s){return s.id===id})[0]||t.filter(function(s){return s.id===d.body.getAttribute('data-start')})[0]||t[0];t.forEach(function(s){s.classList.toggle('on',s===f)});n.forEach(function(a){a.classList.toggle('on',a.getAttribute('href')==='#'+f.id)});return f}var cur=show(location.hash.slice(1));var nav=d.querySelector('nav.tabs');window.addEventListener('hashchange',function(){cur=show(location.hash.slice(1));if(nav&&window.scrollY>nav.offsetTop)window.scrollTo(0,nav.offsetTop)});function ago(){[].forEach.call(d.querySelectorAll('[data-ago]'),function(e){var w=Date.parse(e.getAttribute('data-ago'));if(!w)return;var s=Math.max(0,Math.round((Date.now()-w)/1000));e.textContent='Updated '+(s<60?s+' s':s<3600?Math.round(s/60)+' min':Math.round(s/3600)+' h')+' ago'})}ago();setInterval(ago,1000);var st=d.getElementById('build-status');if(d.body.getAttribute('data-mode')==='file'&&st&&st.getAttribute('data-running')==='1')setTimeout(function(){if(cur===st)location.reload()},5000)})();`;

package/worker/stats-page.mjs

@@ -8,6 +8,19 @@
  * never cached, never indexed.
  */
 import { OWNER_COOKIE, endSession, ownerAllowed, rangeOf, readStats, spendSignin, onlyOf } from './stats.mjs';
+import { CODEX_SCRIPT } from './codex-script.mjs';
+
+/** Where a sign-in may send the owner next: the stats, or one game's codex. */
+const NEXT = /^\/_studio\/(?:stats|codex\/[a-z0-9][a-z0-9-]{0,39}\/)$/;
+const nextOf = (url) => { const to = url.searchParams.get('to') ?? ''; return NEXT.test(to) ? to : '/_studio/stats'; };
+let scriptHash = null;
+async function codexScriptHash() {
+  if (!scriptHash) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(CODEX_SCRIPT));
+    scriptHash = `sha256-${btoa(String.fromCharCode(...new Uint8Array(digest)))}`;
+  }
+  return scriptHash;
+}
 
 const esc = (value) => String(value ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
 const fmt = (n) => Number(n || 0).toLocaleString('en-US');
@@ -119,12 +132,12 @@ export async function ownerRoutes(request, env, url, { catalogueOf }) {
       // A GET spends nothing: a chat app's link preview must not use up the owner's one-time link.
       return page('Sign in · stats', `<h1>${esc(cat.studio?.name ?? 'Studio')} stats</h1>
 <p class="dim">Open this studio's private stats in this browser. The link works once.</p>
-<form method="post" action="/_studio/signin?k=${esc(encodeURIComponent(key))}"><button type="submit">Open the stats</button></form>`);
+<form method="post" action="/_studio/signin?k=${esc(encodeURIComponent(key))}${nextOf(url) !== '/_studio/stats' ? `&amp;to=${esc(encodeURIComponent(nextOf(url)))}` : ''}"><button type="submit">${nextOf(url).startsWith('/_studio/codex/') ? 'Open the codex' : 'Open the stats'}</button></form>`);
     }
     if (request.method !== 'POST' || !sameOrigin(request, url)) return page('Not allowed', '<h1>Not allowed</h1>', 403);
     const session = await spendSignin(env, key);
     if (!session) return page('Link used or expired', `<h1>That link has been used or has expired</h1><p class="note">A sign-in link works once, for 30 minutes. Ask your AI for a new one: <code>npx --no-install homie-studio stats link</code>.</p>`, 403);
-    return new Response(null, { status: 303, headers: { location: '/_studio/stats', 'cache-control': 'no-store', 'set-cookie': `${OWNER_COOKIE}=${session}; Path=/_studio/; HttpOnly; SameSite=Lax; Max-Age=${30 * 24 * 3600}${secure}` } });
+    return new Response(null, { status: 303, headers: { location: nextOf(url), 'cache-control': 'no-store', 'set-cookie': `${OWNER_COOKIE}=${session}; Path=/_studio/; HttpOnly; SameSite=Lax; Max-Age=${30 * 24 * 3600}${secure}` } });
   }
   if (path === '/_studio/signout') {
     if (request.method !== 'POST' || !sameOrigin(request, url)) return page('Not allowed', '<h1>Not allowed</h1>', 403);
@@ -140,5 +153,24 @@ export async function ownerRoutes(request, env, url, { catalogueOf }) {
     }
     return page(`Stats · ${cat.studio?.name ?? 'Studio'}`, statsBody(cat, stats, url));
   }
+  // A game's Game Codex (lib/codex.mjs, built into site/dist/_studio/codex/<id>/): the owner's only, never listed.
+  const codex = /^\/_studio\/codex\/([a-z0-9][a-z0-9-]{0,39})(\/|\/index\.html)?$/.exec(path);
+  if (codex) {
+    if (request.method !== 'GET' && request.method !== 'HEAD') return page('Not allowed', '<h1>Not allowed</h1>', 405);
+    if (!codex[2]) return new Response(null, { status: 301, headers: { location: `/_studio/codex/${codex[1]}/`, 'cache-control': 'no-store' } });
+    if ((await ownerAllowed(request, env, { kinds: ['session'] })) !== 'session') {
+      return page('Codex · private', `<h1>${esc(cat.studio?.name ?? 'Studio')}: Game Codex</h1>
+<p class="dim">A game's codex is for the studio's owner only.</p>
+<p class="note">To open it, the owner asks their AI in the studio's folder to run <code>npx --no-install homie-studio codex link ${esc(codex[1])}</code>. That uses the studio's own Cloudflare login, and gives a one-time link for this browser.</p>`, 401);
+    }
+    const res = env.ASSETS ? await env.ASSETS.fetch(new Request(`${url.origin}/_studio/codex/${codex[1]}/index.html`)) : null;
+    if (!res || !res.ok) return page('No codex yet', `<h1>No codex for this game yet</h1><p class="note">Its plan is <code>games/${esc(codex[1])}/CODEX.md</code> in the studio; the next <code>npm run deploy</code> puts it here.</p>`, 404);
+    return new Response(request.method === 'HEAD' ? null : await res.text(), {
+      headers: {
+        ...PRIVATE_HEADERS,
+        'content-security-policy': `default-src 'none'; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com data:; img-src data:; script-src '${await codexScriptHash()}'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'`,
+      },
+    });
+  }
   return page('Not found', '<h1>Not found</h1>', 404);
 }

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.10.0';
+export const STUDIO_VERSION_TAG = '0.11.0';