@hot-updater/console 1.1.4 → 1.2.0-rc.1

package/.output/server/_ssr/{releaseReachability-bFsuElSS.mjs → releaseReachability-DZOK_dH-.mjs}

@@ -1,5 +1,5 @@
-import { S as isReleaseEligibleForCohort, i as NUMERIC_COHORT_SIZE } from "./dist-CbQbBIw-.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/releaseReachability-bFsuElSS.js
+import { C as isReleaseEligibleForCohort, i as NUMERIC_COHORT_SIZE } from "./dist-TEpM_UAD.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/releaseReachability-DZOK_dH-.js
 var NON_TARGETED_COHORT = "release-catalog-non-targeted-cohort";
 function collectReachableFromIndexes(catalog, indexes, reachableReleaseIds) {
 	const descriptors = indexes.flatMap((index) => {

package/.output/server/_ssr/{remote-config-Mj05qVYZ.mjs → remote-config-DjsEl270.mjs}

@@ -1,27 +1,28 @@
 import { i as __toESM } from "../_runtime.mjs";
-import { u as createServerFn } from "./createMiddleware-B1iPez7u.mjs";
+import { l as createServerFn } from "./createServerFn-AQvBMBjJ.mjs";
+import { t as consoleAccess } from "./console-access-33BNlH97.mjs";
 import { bt as require_react, n as Toggle, t as ToggleGroup, yt as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
-import { A as GitBranch, J as Braces, L as Clipboard, N as Eye, T as LoaderCircle, Y as ArrowUp, Z as ArrowRight, _ as Plus, a as Trash2, d as SlidersHorizontal, et as ArrowDown, g as RefreshCw, h as RotateCcw, i as TriangleAlert, k as History, n as Upload, p as Search, r as Undo2, t as X, u as Smartphone, v as Pencil } from "../_libs/lucide-react.mjs";
+import { $ as Braces, D as LoaderCircle, H as Clipboard, P as GitBranch, R as Eye, _ as RefreshCw, a as Trash2, at as ArrowDown, d as SlidersHorizontal, et as ArrowUp, g as RotateCcw, i as TriangleAlert, j as History, m as Search, n as Upload, nt as ArrowRight, r as Undo2, t as X, u as Smartphone, v as Plus, y as Pencil } from "../_libs/lucide-react.mjs";
 import { t as cva } from "../_libs/class-variance-authority+clsx.mjs";
-import { A as createSsrRpc, C as Skeleton, S as SidebarTrigger, k as cn, n as Input, t as Button$1 } from "./sidebar-CVsgosaD.mjs";
-import { t as consoleAccess } from "./console-access-aUpQs49I.mjs";
-import { f as lazyRouteComponent, p as createFileRoute } from "../_libs/@tanstack/react-router+[...].mjs";
+import { A as createSsrRpc, C as Skeleton, S as SidebarTrigger, k as cn, n as Input, t as Button$1 } from "./sidebar-DB2YQlok.mjs";
+import { a as Badge, c as CardDescription, d as CardTitle, i as AlertTitle, n as AlertAction, o as Card, r as AlertDescription, s as CardContent, t as Alert, u as CardHeader } from "./badge-CEdVRgyl.mjs";
+import { a as AlertDialogDescription, i as AlertDialogContent, l as AlertDialogTitle, n as AlertDialogAction, o as AlertDialogFooter, r as AlertDialogCancel, s as AlertDialogHeader, t as AlertDialog$1 } from "./alert-dialog-CvNvTvIJ.mjs";
+import { a as DialogHeader, i as DialogFooter, n as DialogContent, o as DialogTitle, r as DialogDescription, t as Dialog$1 } from "./dialog-C8CS8RMt.mjs";
+import { a as FieldLabel, i as FieldGroup, n as FieldDescription, o as FieldLegend, r as FieldError, s as FieldSet, t as Field } from "./field-CW08sZXd.mjs";
 import { i as useQuery, n as useMutation, s as useQueryClient, t as useInfiniteQuery } from "../_libs/tanstack__react-query.mjs";
 import { l as keepPreviousData } from "../_libs/tanstack__query-core.mjs";
-import { r as requireConsoleFeature } from "./console-features-api-DSSgCV3v.mjs";
-import { a as EmptyMedia, i as EmptyHeader, n as EmptyContent, o as EmptyTitle, r as EmptyDescription, t as Empty } from "./empty-Bh1FEeYF.mjs";
-import { a as Badge, c as CardDescription, d as CardTitle, i as AlertTitle, n as AlertAction, o as Card, r as AlertDescription, s as CardContent, t as Alert, u as CardHeader } from "./badge-BpT7r-ng.mjs";
-import { a as AlertDialogDescription, i as AlertDialogContent, l as AlertDialogTitle, n as AlertDialogAction, o as AlertDialogFooter, r as AlertDialogCancel, s as AlertDialogHeader, t as AlertDialog$1 } from "./alert-dialog-B8AqlJwo.mjs";
-import { a as DialogHeader, i as DialogFooter, n as DialogContent, o as DialogTitle, r as DialogDescription, t as Dialog$1 } from "./dialog-B4ALf7NJ.mjs";
-import { a as FieldLabel, i as FieldGroup, n as FieldDescription, o as FieldLegend, r as FieldError, s as FieldSet, t as Field } from "./field-HKCaPH3e.mjs";
 import { n as toast } from "../_libs/sonner.mjs";
-import { i as TabsTrigger, n as TabsContent, r as TabsList, t as Tabs$1 } from "./tabs-CrmfOlJj.mjs";
-import { a as SelectItem, i as SelectGroup, n as Select$1, o as SelectTrigger, r as SelectContent, s as SelectValue, t as PlatformIcon } from "./select-BtdGNSmp.mjs";
-import { i as InputGroupInput, n as InputGroupAddon, o as Textarea, r as InputGroupButton, t as InputGroup } from "./input-group-xm3LzDuq.mjs";
-import { i as useChannelsQuery } from "./api-C_0B7NXM.mjs";
-import { n as useDialogTarget, r as useOpenSession, t as Switch$1 } from "./switch-BmARgkUP.mjs";
+import { f as lazyRouteComponent, p as createFileRoute } from "../_libs/@tanstack/react-router+[...].mjs";
+import { r as requireConsoleFeature } from "./console-features-api-v1fSycue.mjs";
+import { a as EmptyMedia, i as EmptyHeader, n as EmptyContent, o as EmptyTitle, r as EmptyDescription, t as Empty } from "./empty-CkdEAvCY.mjs";
+import { i as TabsTrigger, n as TabsContent, r as TabsList, t as Tabs$1 } from "./tabs-B7ZeLicF.mjs";
+import { t as PlatformIcon } from "./PlatformIcon-CFLiTjh1.mjs";
+import { i as InputGroupInput, n as InputGroupAddon, o as Textarea, r as InputGroupButton, t as InputGroup } from "./input-group-D-TpFPuG.mjs";
+import { a as SelectTrigger, i as SelectItem, n as SelectContent, o as SelectValue, r as SelectGroup, t as Select$1 } from "./select-DM1uwtk9.mjs";
+import { i as useChannelsQuery } from "./api-0vtwA5vY.mjs";
 import { n as require_dayjs_min, t as require_relativeTime } from "../_libs/dayjs.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/remote-config-Mj05qVYZ.js
+import { n as useDialogTarget, r as useOpenSession, t as Switch$1 } from "./switch-DLD58zLy.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/remote-config-DjsEl270.js
 var import_react = /* @__PURE__ */ __toESM(require_react());
 var import_jsx_runtime = require_jsx_runtime();
 var import_dayjs_min = /* @__PURE__ */ __toESM(require_dayjs_min());
@@ -2637,8 +2638,8 @@ function RemoteConfigPage({ tab, onTabChange }) {
 		]
 	});
 }
-var $$splitComponentImporter = () => import("./remote-config-10-obSZ0.mjs");
-var $$splitNotFoundComponentImporter = () => import("./remote-config-Dj1eTYi4.mjs");
+var $$splitComponentImporter = () => import("./remote-config-DlyyohL2.mjs");
+var $$splitNotFoundComponentImporter = () => import("./remote-config-XdYuByHz.mjs");
 var Route = createFileRoute("/remote-config")({
 	beforeLoad: ({ context }) => requireConsoleFeature(context.queryClient, "remoteConfig"),
 	notFoundComponent: lazyRouteComponent($$splitNotFoundComponentImporter, "notFoundComponent"),

package/.output/server/_ssr/{remote-config-10-obSZ0.mjs → remote-config-DlyyohL2.mjs}

@@ -1,6 +1,6 @@
 import { yt as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
-import { n as Route, t as RemoteConfigPage } from "./remote-config-Mj05qVYZ.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/remote-config-10-obSZ0.js
+import { n as Route, t as RemoteConfigPage } from "./remote-config-DjsEl270.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/remote-config-DlyyohL2.js
 var import_jsx_runtime = require_jsx_runtime();
 function RemoteConfigRoute() {
 	const { tab = "parameters" } = Route.useSearch();

package/.output/server/_ssr/{remote-config-Dj1eTYi4.mjs → remote-config-XdYuByHz.mjs}

@@ -1,5 +1,5 @@
-import { t as ConsoleFeatureUnavailable } from "./ConsoleFeatureUnavailable-CHxn9f-w.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/remote-config-Dj1eTYi4.js
+import { t as ConsoleFeatureUnavailable } from "./ConsoleFeatureUnavailable-Xb1JKqcc.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/remote-config-XdYuByHz.js
 var SplitNotFoundComponent = ConsoleFeatureUnavailable;
 //#endregion
 export { SplitNotFoundComponent as notFoundComponent };

package/.output/server/_ssr/{remote-config-rpc-lteqDSLn.mjs → remote-config-rpc-GMLPb-90.mjs}

@@ -1,10 +1,10 @@
-import { u as createServerFn } from "./createMiddleware-B1iPez7u.mjs";
-import { t as consoleAccess } from "./console-access-aUpQs49I.mjs";
-import { t as createServerRpc } from "./createServerRpc-BaDJLGBx.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/remote-config-rpc-lteqDSLn.js
+import { l as createServerFn } from "./createServerFn-AQvBMBjJ.mjs";
+import { t as consoleAccess } from "./console-access-33BNlH97.mjs";
+import { t as createServerRpc } from "./createServerRpc-BVvRVOz5.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/remote-config-rpc-GMLPb-90.js
 /** Remote Config, once the console's access check and the feature guard pass. */
 var remoteConfig = async () => {
-	const [{ prepareConfig }, { requireFeature }] = await Promise.all([import("./config.server-DTdsG47T.mjs"), import("./runtime.server-DsHqVqTr.mjs")]);
+	const [{ prepareConfig }, { requireFeature }] = await Promise.all([import("./config.server-NnMFjMFX.mjs"), import("./runtime.server-BdMY1blX.mjs")]);
 	const { runtime } = await prepareConfig();
 	return requireFeature(runtime, "remoteConfig");
 };
@@ -97,7 +97,7 @@ var previewRemoteConfigRpc_createServerFn_handler = createServerRpc({
 }, (opts) => previewRemoteConfigRpc.__executeServer(opts));
 var previewRemoteConfigRpc = createServerFn({ method: "POST" }).middleware([consoleAccess]).validator(parsePreview).handler(previewRemoteConfigRpc_createServerFn_handler, async ({ data }) => {
 	await remoteConfig();
-	const { evaluateRemoteConfig, RemoteConfigValidationError, validateRemoteConfigTemplate } = await import("./plugins-BaD1slHx.mjs").then((n) => n.t);
+	const { evaluateRemoteConfig, RemoteConfigValidationError, validateRemoteConfigTemplate } = await import("./plugins-RIryUNWj.mjs").then((n) => n.t);
 	try {
 		return {
 			status: "ok",

package/.output/server/_ssr/request-guard-CPdRBuGW.mjs

@@ -0,0 +1,108 @@
+//#region node_modules/.nitro/vite/services/ssr/assets/request-guard-CPdRBuGW.js
+/** The query parameter of the link `hot-updater console` prints. */
+var LOCAL_CONSOLE_SESSION_PARAM = "hot-updater-session";
+var LOOPBACK_HOSTNAMES = new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+var SAFE_METHODS = new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+/** Compares in time that depends only on the lengths. */
+var sameSecret = (given, expected) => {
+	if (given.length !== expected.length) return false;
+	let difference = 0;
+	for (let index = 0; index < given.length; index += 1) difference |= given.charCodeAt(index) ^ expected.charCodeAt(index);
+	return difference === 0;
+};
+/**
+* The session cookie's name. Browsers send a cookie to every port of a
+* host, so the port keeps two local consoles' sessions apart.
+*/
+var cookieName = (port) => port === void 0 ? "hot_updater_console_session" : `hot_updater_console_session_${port}`;
+var cookieOf = (request, name) => {
+	for (const part of request.headers.get("cookie")?.split(";") ?? []) {
+		const separator = part.indexOf("=");
+		if (separator !== -1 && part.slice(0, separator).trim() === name) return part.slice(separator + 1).trim();
+	}
+};
+/** A port as digits without leading zeros, so `80` and `080` agree. */
+var normalPort = (port) => String(Number(port));
+/** A `Host` header's name and port, or undefined when it is not one. */
+var hostPartsOf = (host) => {
+	const match = /^(\[[0-9a-f:.]+\]|[a-z0-9.-]+)(?::(\d{1,5}))?$/iu.exec(host);
+	if (!match) return void 0;
+	return {
+		hostname: match[1].toLowerCase(),
+		port: normalPort(match[2] ?? "80")
+	};
+};
+/** Whether `origin` is the plain-HTTP origin of `host`. */
+var isOriginOf = (origin, host) => {
+	if (host === void 0) return false;
+	let parsed;
+	try {
+		parsed = new URL(origin);
+	} catch {
+		return false;
+	}
+	return parsed.protocol === "http:" && parsed.hostname === host.hostname && normalPort(parsed.port || "80") === host.port;
+};
+var refuse = (status, message) => new Response(message, {
+	status,
+	headers: {
+		"cache-control": "no-store",
+		"content-type": "text/plain; charset=utf-8"
+	}
+});
+/**
+* What the local console answers before a request reaches a page, a server
+* function, or a route, or undefined to let it through:
+*
+* - a `Host` that is not this machine on the console's port is refused, so
+*   a site that rebinds its name to 127.0.0.1 reaches nothing;
+* - a request that changes something from another origin is refused;
+* - the link `hot-updater console` prints carries the run's session secret,
+*   which becomes an HttpOnly, SameSite=Strict cookie, and every other page
+*   and server function needs that cookie, so another user of the machine
+*   or a local process without the secret reaches nothing.
+*/
+var guardLocalConsoleRequest = (request, { session, port, checkHost }) => {
+	const header = request.headers.get("host");
+	const host = header === null ? void 0 : hostPartsOf(header);
+	if (checkHost && (host === void 0 || !LOOPBACK_HOSTNAMES.has(host.hostname) || port !== void 0 && host.port !== normalPort(port))) return refuse(403, `This console answers only at http://localhost${port === void 0 ? "" : `:${port}`}.`);
+	if (!SAFE_METHODS.has(request.method.toUpperCase())) {
+		const origin = request.headers.get("origin");
+		const site = request.headers.get("sec-fetch-site");
+		if (origin !== null && !isOriginOf(origin, host) || site !== null && site !== "same-origin" && site !== "none") return refuse(403, "This console takes changes only from its own pages.");
+	}
+	const url = new URL(request.url);
+	const name = cookieName(port);
+	const given = url.searchParams.get(LOCAL_CONSOLE_SESSION_PARAM);
+	if (session && given !== null && sameSecret(given, session)) {
+		url.searchParams.delete(LOCAL_CONSOLE_SESSION_PARAM);
+		return new Response(null, {
+			status: 303,
+			headers: {
+				"cache-control": "no-store",
+				location: `${url.pathname}${url.search}${url.hash}`,
+				"set-cookie": `${name}=${session}; Path=/; HttpOnly; SameSite=Strict`
+			}
+		});
+	}
+	const cookie = cookieOf(request, name);
+	if (session && cookie !== void 0 && sameSecret(cookie, session)) return;
+	return refuse(401, session ? "Open this console with the link hot-updater console printed." : "Start this console with hot-updater console, and open the link it prints.");
+};
+var session = process.env["HOT_UPDATER_CONSOLE_SESSION"] || void 0;
+var port = process.env.NITRO_PORT || process.env.PORT || void 0;
+var request_guard_default = (request) => guardLocalConsoleRequest(request, {
+	session,
+	port,
+	checkHost: true
+});
+//#endregion
+export { request_guard_default as default };