@homie-rocks/studio 0.54.0 → 0.56.0

package/worker/rooms-cache.mjs

@@ -0,0 +1,19 @@
+import {METADATA_REVISION} from './request-db.mjs';
+/** Authorize/filter the catalogue before lookup. Metadata changes get a new key,
+ * so an owner closing a room or server does not wait for a shared cache expiry. */
+export async function cachedRooms(request,env,ctx,cat,read) {
+  const cache=globalThis.caches?.default;
+  if(!cache||request.method!=='GET'||!env.DB?.[METADATA_REVISION])return read();
+  const revision=await env.DB[METADATA_REVISION]();
+  if(revision===null)return read();
+  const digest=await crypto.subtle.digest('SHA-256',new TextEncoder().encode(JSON.stringify([revision,cat.games])));
+  const tag=Array.from(new Uint8Array(digest),b=>b.toString(16).padStart(2,'0')).join('');
+  const key=new Request(new URL('/api/rooms?__cache='+tag,request.url));
+  try {const hit=await cache.match(key);if(hit)return hit;}catch(error){console.warn('Room cache read failed',error.message);}
+  const response=await read();
+  if(response.ok) {
+    const put=cache.put(key,response.clone()).catch(error=>console.warn('Room cache write failed',error.message));
+    if(ctx?.waitUntil)ctx.waitUntil(put);else await put;
+  }
+  return response;
+}

package/worker/route-auth.mjs

@@ -0,0 +1,22 @@
+import {launchOf, settingsOf, accessOf, sameOrigin} from './office.mjs';
+import {catalogue} from './catalogue.mjs';
+/** Uses the same live session/account checks as the studio office. */
+export async function isOwner(request, env) {
+  return (await import('./office.mjs')).isOwner(request, env);
+}
+/** Checks an app's declared role with its existing link, session and grant rules. */
+export async function hasRole(request, env, app, role) {
+  const url = new URL(request.url);
+  const cat = await catalogue(env, url.origin);
+  const meta = cat.games?.find(item => item.id === app && item.kind === 'app');
+  if (!meta || typeof role !== 'string' || !Object.hasOwn(meta.roles ?? {}, role)) return false;
+  const launch = launchOf(meta, await settingsOf(env, {fresh:true}), env);
+  if (launch !== 'public' && !(await accessOf(request, env, app, launch)).ok) return false;
+  url.searchParams.set('role', role);
+  return (await (await import('./app-records.mjs')).appAccess(request, env, meta, url)).ok === true;
+}
+
+/** Return a refusal response, or null when the browser supplied same-origin evidence. */
+export function requireSameOrigin(request) {
+  return sameOrigin(request, new URL(request.url)) ? null : new Response('Same origin required', {status:403});
+}