@indecisivedev/openplan 0.2.0-alpha.2

package/dist/api.js

@@ -0,0 +1,867 @@
+import { APPLICATION_CSP } from "./browser-security.js";
+import express from "express";
+import { database } from "./database.js";
+import { contentHash, randomToken, sha256 } from "./crypto.js";
+import { assertBrowserAuthConfigured, browserAuthProvider, config } from "./config.js";
+import { findApiKeyByToken, newEventId, pool, publicUploadAuth, revokeApiKey, withTransaction } from "./db.js";
+import { newDraftId, newInternalId } from "./ids.js";
+import { renderHome, renderNotFound } from "./render.js";
+import { checkRateLimit, createRateLimiter } from "./rate-limit.js";
+import { getHtmlObject, probeStorage, putHtmlObject } from "./storage.js";
+import { finalizeReservedVersion, recordUploadWriteError } from "./upload-state.js";
+import { validateHtml } from "./html-policy.js";
+import { clientIp } from "./client-ip.js";
+import { listAccountDrafts } from "./drafts.js";
+import { registerWebRoutes } from "./web.js";
+import { renderSharePassword } from "./render-web.js";
+import { readWebSession } from "./local-auth.js";
+import { getDraftIdFromHost, getDraftPublicUrl, getDraftRawUrl, getHomeUrl, getRequestBaseUrl } from "./public-url.js";
+import { canAccountReadDraft, createDefaultPolicy, findDraftAccessTarget, getDraftAccessOverview, setAccessPolicy } from "./access-store.js";
+import { createUnlockToken, hasValidUnlock, unlockCookie, verifyPassword } from "./access-policy.js";
+import { getBrowserLocalAnnotationsSetting } from "./feature-settings.js";
+import { annotationViewerContentSecurityPolicy, renderAnnotationViewer } from "./render-annotations.js";
+import { ANNOTATION_CLIENT } from "./generated/annotation-client.js";
+class HttpError extends Error {
+    statusCode;
+    constructor(message, statusCode) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
+export function createApp() {
+    const app = express();
+    app.set("trust proxy", config.trustedProxies);
+    const uploadIpRateLimit = createRateLimiter({
+        windowMs: Number(process.env.UPLOAD_IP_RATE_LIMIT_WINDOW_MS || 60_000),
+        max: Number(process.env.UPLOAD_IP_RATE_LIMIT_MAX || 60),
+        keyPrefix: "upload-ip",
+        key: (req) => clientIp(req) || "anonymous"
+    });
+    const uploadKeyRateLimit = createRateLimiter({
+        windowMs: Number(process.env.UPLOAD_RATE_LIMIT_WINDOW_MS || 60_000),
+        max: Number(process.env.UPLOAD_RATE_LIMIT_MAX || 30),
+        keyPrefix: "upload-key",
+        key: (req) => req.auth?.id || clientIp(req) || "anonymous"
+    });
+    // Scoped to /api so that draft GETs carrying a stray JSON body (some HTTP
+    // clients always send Content-Type: application/json) can never fail with a
+    // body-parser error instead of the draft HTML.
+    app.use(noStoreHeaders);
+    app.use("/api", express.json({ limit: process.env.UPLOAD_BODY_LIMIT || "2mb" }));
+    app.get("/assets/openplan-annotations.v1.js", async (_req, res, next) => {
+        try {
+            if (!(await getBrowserLocalAnnotationsSetting()).enabled)
+                return next();
+            res
+                .setHeader("Cache-Control", "public, max-age=31536000, immutable")
+                .type("application/javascript")
+                .send(ANNOTATION_CLIENT);
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.get("/", async (req, res, next) => {
+        try {
+            const draftId = getDraftIdFromRequest(req);
+            if (draftId) {
+                await renderDraft(req, res, { draftId });
+                return;
+            }
+            res.type("html").send(renderHome({ publicBaseUrl: getHomeUrlForRequest(req) }));
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.get("/healthz", async (req, res) => {
+        try {
+            await pool.query("SELECT 1");
+            res.json({
+                ok: true,
+                runtime: "node",
+                profile: config.runtimeProfile,
+                database: database.kind
+            });
+        }
+        catch (error) {
+            console.error("openplan health check failed", { requestId: res.getHeader("X-Openplan-Request-Id"), error });
+            res.status(503).json({ ok: false, error: "Service health check failed." });
+        }
+    });
+    app.get("/readyz", async (_req, res) => {
+        const connectors = {
+            metadata: database.kind,
+            objects: "s3-compatible",
+            identity: browserAuthProvider() === "local" ? "local-password" : browserAuthProvider(),
+            sessions: "signed-cookie",
+            maintenance: config.reconcileIntervalMs > 0 ? "scheduled" : "manual"
+        };
+        try {
+            await pool.query("SELECT 1");
+            await probeStorage();
+            if (config.sessionSecret && config.publicBaseUrl)
+                assertBrowserAuthConfigured();
+            if (browserAuthProvider() === "local") {
+                const accounts = await pool.query("SELECT COUNT(*) AS count FROM local_credentials");
+                if (Number(accounts.rows[0]?.count || 0) < 1) {
+                    throw new Error("No local administrator has been bootstrapped.");
+                }
+            }
+            res.json({ ok: true, runtime: "node", profile: config.runtimeProfile, connectors });
+        }
+        catch (error) {
+            console.error("openplan readiness check failed", { requestId: res.getHeader("X-Openplan-Request-Id"), error });
+            res.status(503).json({
+                ok: false,
+                runtime: "node",
+                profile: config.runtimeProfile,
+                connectors,
+                error: "Service is not ready."
+            });
+        }
+    });
+    app.get("/api/me", requireAuth, (req, res) => {
+        res.json({
+            accountId: req.auth.account_id,
+            accountName: req.auth.account_name,
+            apiKeyId: req.auth.id,
+            apiKeyName: req.auth.name
+        });
+    });
+    // The "my docs" feed — shared with the dashboard (src/drafts.js).
+    app.get("/api/drafts", requireAuth, async (req, res, next) => {
+        try {
+            const drafts = await listAccountDrafts(req.auth.account_id, {
+                requestBaseUrl: getRequestBaseUrl(req)
+            });
+            res.json({ ok: true, drafts });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.get("/api/drafts/:draftId/access", requireAuth, async (req, res, next) => {
+        try {
+            const overview = await getDraftAccessOverview(req.auth.account_id, routeParam(req, "draftId"));
+            if (!overview)
+                return res.status(404).json({ ok: false, error: "Draft not found." });
+            res.json({ ok: true, access: overview.plan });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.put("/api/drafts/:draftId/access", requireAuth, async (req, res, next) => {
+        try {
+            const mutation = accessMutation(req.body, false);
+            requireModeConfiguration(mutation.mode);
+            if (mutation.mode === "password" && !config.shareSecret) {
+                throw new HttpError("Password sharing is not configured.", 503);
+            }
+            const access = await setAccessPolicy({
+                accountId: req.auth.account_id,
+                apiKeyId: req.auth.id,
+                draftId: routeParam(req, "draftId"),
+                ...mutation,
+                requestId: cleanText(req.get("x-request-id"))
+            });
+            if (!access)
+                return res.status(404).json({ ok: false, error: "Draft not found." });
+            res.json({ ok: true, access });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.get("/api/drafts/:draftId/versions/:versionNumber/access", requireAuth, async (req, res, next) => {
+        try {
+            const versionNumber = positiveVersion(req.params.versionNumber);
+            const overview = await getDraftAccessOverview(req.auth.account_id, routeParam(req, "draftId"));
+            const access = overview?.versions.get(versionNumber);
+            if (!access)
+                return res.status(404).json({ ok: false, error: "Draft version not found." });
+            res.json({ ok: true, access });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.put("/api/drafts/:draftId/versions/:versionNumber/access", requireAuth, async (req, res, next) => {
+        try {
+            const mutation = accessMutation(req.body, true);
+            requireModeConfiguration(mutation.mode);
+            if (mutation.mode === "password" && !config.shareSecret) {
+                throw new HttpError("Password sharing is not configured.", 503);
+            }
+            const access = await setAccessPolicy({
+                accountId: req.auth.account_id,
+                apiKeyId: req.auth.id,
+                draftId: routeParam(req, "draftId"),
+                versionNumber: positiveVersion(req.params.versionNumber),
+                ...mutation,
+                requestId: cleanText(req.get("x-request-id"))
+            });
+            if (!access)
+                return res.status(404).json({ ok: false, error: "Draft version not found." });
+            res.json({ ok: true, access });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.post("/api/api-keys", requireAuth, async (req, res, next) => {
+        try {
+            const token = `op_${randomToken(32)}`;
+            const apiKeyId = newInternalId();
+            const name = cleanText(req.body?.name) || "CLI API Key";
+            const limit = checkRateLimit(`key-mint:${req.auth.account_id}`, 3_600_000, 10);
+            if (!limit.allowed) {
+                res.setHeader("Retry-After", String(limit.retryAfter));
+                return res.status(429).json({ ok: false, error: "Too many API keys were created." });
+            }
+            await withTransaction(async (client) => {
+                await client.query("SELECT id FROM accounts WHERE id = $1 FOR UPDATE", [req.auth.account_id]);
+                const result = await client.query(`
+          INSERT INTO api_keys (id, account_id, name, key_hash, parent_api_key_id)
+          SELECT $1, $2, $3, $4, id FROM api_keys
+          WHERE id = $5 AND account_id = $2 AND revoked_at IS NULL AND key_hash = $6
+          RETURNING id
+        `, [apiKeyId, req.auth.account_id, name, sha256(token), req.auth.id, req.auth.keyHash]);
+                if (!result.rowCount)
+                    throw new HttpError("API key has been revoked.", 401);
+            });
+            res.status(201).json({
+                ok: true,
+                apiKey: {
+                    id: apiKeyId,
+                    name
+                },
+                token
+            });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.post("/api/api-keys/:apiKeyId/revoke", requireAuth, async (req, res, next) => {
+        try {
+            const revoked = await revokeApiKey(req.auth.account_id, routeParam(req, "apiKeyId"));
+            if (!revoked) {
+                return res.status(404).json({ ok: false, error: "API key not found." });
+            }
+            res.json({ ok: true });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.post("/api/uploads", uploadIpRateLimit, optionalUploadAuth, uploadKeyRateLimit, async (req, res, next) => {
+        try {
+            const { html, filename, metadata = {}, draftId, description } = req.body || {};
+            const validation = validateHtml(html, { maxBytes: config.maxHtmlBytes });
+            if (!validation.ok) {
+                return res.status(422).json({
+                    ok: false,
+                    errors: validation.errors,
+                    warnings: validation.warnings
+                });
+            }
+            const byteLength = Buffer.byteLength(html, "utf8");
+            const nowHash = contentHash(html);
+            const sourceIp = clientIp(req);
+            // Railway's edge sets X-Railway-Request-Id and documents it for correlating
+            // against network logs, so we store it verbatim rather than minting our own.
+            const requestId = cleanText(req.get("x-railway-request-id"));
+            const stats = validation.stats || { hasInlineScript: false, externalImageHosts: [] };
+            const result = await withTransaction(async (client) => {
+                const existingDraft = draftId
+                    ? await findOwnedDraft(client, draftId, req.auth.account_id)
+                    : null;
+                if (draftId && !existingDraft) {
+                    throw new HttpError("Draft not found.", 404);
+                }
+                const draft = existingDraft || {
+                    id: newDraftId(),
+                    account_id: req.auth.account_id
+                };
+                const versionNumber = existingDraft
+                    ? Number((await client.query("SELECT COALESCE(MAX(version_number), 0) + 1 AS next_version FROM draft_versions WHERE draft_id = $1", [draft.id])).rows[0].next_version)
+                    : 1;
+                const versionId = newInternalId();
+                const objectKey = `drafts/${draft.id}/versions/${versionId}.html`;
+                const title = validation.title || existingDraft?.title || filename || "Untitled Draft";
+                const draftMetadata = {
+                    title,
+                    description: cleanText(description, 1000),
+                    repoOrg: cleanText(metadata.repoOrg),
+                    repoName: cleanText(metadata.repoName),
+                    repoHost: cleanText(metadata.repoHost),
+                    eventType: existingDraft ? "draft.updated" : "draft.created",
+                    requestMetadata: metadata
+                };
+                if (!existingDraft) {
+                    const defaultAccessPolicyId = await createDefaultPolicy(client, req.auth.account_id, req.auth.id === publicUploadAuth.id ? "public" : "private");
+                    await client.query(`
+              INSERT INTO drafts (
+                id, account_id, title, description, repo_org, repo_name, repo_host,
+                default_access_policy_id
+              )
+              VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+            `, [
+                        draft.id,
+                        req.auth.account_id,
+                        title,
+                        draftMetadata.description,
+                        draftMetadata.repoOrg,
+                        draftMetadata.repoName,
+                        draftMetadata.repoHost,
+                        defaultAccessPolicyId
+                    ]);
+                }
+                await client.query(`
+            INSERT INTO draft_versions (
+              id, draft_id, version_number, object_key, content_hash, file_size,
+              created_by_api_key_id, source_ip, user_agent, cli_version,
+              git_branch, git_commit_sha, original_filename,
+              git_commit_subject, git_dirty, request_id, has_inline_script,
+              external_image_hosts, ci_run_url, ci_actor, status, draft_metadata_json
+            )
+            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13,
+                    $14, $15, $16, $17, $18, $19, $20, $21, $22)
+          `, [
+                    versionId,
+                    draft.id,
+                    versionNumber,
+                    objectKey,
+                    nowHash,
+                    byteLength,
+                    req.auth.id,
+                    sourceIp,
+                    req.get("user-agent") || null,
+                    cleanText(metadata.cliVersion),
+                    cleanText(metadata.gitBranch),
+                    cleanText(metadata.gitCommitSha),
+                    cleanText(filename),
+                    cleanText(metadata.gitCommitSubject),
+                    typeof metadata.gitDirty === "boolean" ? metadata.gitDirty : null,
+                    requestId,
+                    stats.hasInlineScript,
+                    JSON.stringify(stats.externalImageHosts || []),
+                    cleanText(metadata.ciRunUrl),
+                    cleanText(metadata.ciActor),
+                    "pending",
+                    draftMetadata
+                ]);
+                await client.query(`
+            INSERT INTO upload_events (
+              id, draft_id, draft_version_id, api_key_id, event_type,
+              source_ip, user_agent, metadata_json
+            )
+            VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+          `, [
+                    newEventId(),
+                    draft.id,
+                    versionId,
+                    req.auth.id,
+                    "upload.reserved",
+                    sourceIp,
+                    req.get("user-agent") || null,
+                    metadata
+                ]);
+                return {
+                    draftId: draft.id,
+                    versionId,
+                    versionNumber,
+                    title,
+                    requestId,
+                    publicUrl: getDraftPublicUrl({
+                        draftId: draft.id,
+                        publicBaseUrl: config.publicBaseUrl,
+                        requestBaseUrl: getRequestBaseUrl(req)
+                    }),
+                    rawUrl: getDraftRawUrl({
+                        draftId: draft.id,
+                        publicBaseUrl: config.publicBaseUrl,
+                        requestBaseUrl: getRequestBaseUrl(req)
+                    }),
+                    warnings: validation.warnings
+                };
+            });
+            try {
+                await putHtmlObject(`drafts/${result.draftId}/versions/${result.versionId}.html`, html);
+            }
+            catch (error) {
+                await recordUploadWriteError(result.versionId, error);
+                throw error;
+            }
+            if (!await finalizeReservedVersion(result.versionId)) {
+                throw new HttpError("Upload could not be finalized.", 503);
+            }
+            // Read persisted policy after finalization: an owner may have changed it
+            // while the object write was in flight. Never infer sharing from the URL.
+            const overview = await getDraftAccessOverview(req.auth.account_id, result.draftId);
+            if (!overview)
+                throw new HttpError("Uploaded draft is unavailable.", 503);
+            res.status(draftId ? 200 : 201).json({
+                ok: true, ...result,
+                access: overview.versions.get(result.versionNumber),
+                planAccess: overview.plan,
+                versionUrl: `${getHomeUrlForRequest(req)}/d/${result.draftId}/v/${result.versionNumber}`,
+                versionRawUrl: `${getHomeUrlForRequest(req)}/d/${result.draftId}/v/${result.versionNumber}/raw`
+            });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.delete("/api/drafts/:draftId", requireAuth, async (req, res, next) => {
+        try {
+            const result = await pool.query(`
+          UPDATE drafts
+          SET deleted_at = now(), updated_at = now()
+          WHERE id = $1
+            AND account_id = $2
+            AND deleted_at IS NULL
+          RETURNING id
+        `, [req.params.draftId, req.auth.account_id]);
+            if (!result.rowCount) {
+                return res.status(404).json({ ok: false, error: "Draft not found." });
+            }
+            res.json({ ok: true });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.post("/api/drafts/:draftId/disable", requireAuth, async (req, res, next) => {
+        try {
+            const reason = cleanText(req.body?.reason) || "Disabled by owner.";
+            const result = await pool.query(`
+          UPDATE drafts
+          SET disabled_at = now(), disabled_reason = $3, updated_at = now()
+          WHERE id = $1
+            AND account_id = $2
+            AND deleted_at IS NULL
+          RETURNING id
+        `, [req.params.draftId, req.auth.account_id, reason]);
+            if (!result.rowCount) {
+                return res.status(404).json({ ok: false, error: "Draft not found." });
+            }
+            res.json({ ok: true });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    registerWebRoutes(app);
+    const unlockBody = [
+        express.json({ limit: "8kb" }),
+        express.urlencoded({ extended: false, limit: "8kb" })
+    ];
+    app.post("/unlock", ...unlockBody, async (req, res, next) => {
+        try {
+            const draftId = getDraftIdFromRequest(req);
+            if (!draftId)
+                return next();
+            await unlockDraft(req, res, { draftId });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.post("/v/:versionNumber/unlock", ...unlockBody, async (req, res, next) => {
+        try {
+            const draftId = getDraftIdFromRequest(req);
+            if (!draftId)
+                return next();
+            await unlockDraft(req, res, { draftId, versionNumber: Number(req.params.versionNumber) });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.post("/d/:draftId/unlock", ...unlockBody, async (req, res, next) => {
+        try {
+            await unlockDraft(req, res, { draftId: routeParam(req, "draftId") });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.post("/d/:draftId/v/:versionNumber/unlock", ...unlockBody, async (req, res, next) => {
+        try {
+            await unlockDraft(req, res, {
+                draftId: routeParam(req, "draftId"),
+                versionNumber: Number(req.params.versionNumber)
+            });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    // Every draft URL serves the raw uploaded HTML. The `/raw` aliases are kept
+    // because the upload API and CLI hand them out as the canonical agent URL.
+    const serveCurrent = async (req, res, next) => {
+        try {
+            const draftId = getDraftIdFromRequest(req);
+            if (!draftId) {
+                next();
+                return;
+            }
+            await renderDraft(req, res, { draftId });
+        }
+        catch (error) {
+            next(error);
+        }
+    };
+    const serveVersion = async (req, res, next) => {
+        try {
+            const draftId = getDraftIdFromRequest(req);
+            if (!draftId) {
+                next();
+                return;
+            }
+            await renderDraft(req, res, {
+                draftId,
+                versionNumber: Number(req.params.versionNumber)
+            });
+        }
+        catch (error) {
+            next(error);
+        }
+    };
+    const annotateCurrent = async (req, res, next) => {
+        try {
+            const draftId = getDraftIdFromRequest(req);
+            if (!draftId)
+                return next();
+            await renderAnnotations(req, res, { draftId });
+        }
+        catch (error) {
+            next(error);
+        }
+    };
+    const annotateVersion = async (req, res, next) => {
+        try {
+            const draftId = getDraftIdFromRequest(req);
+            if (!draftId)
+                return next();
+            await renderAnnotations(req, res, {
+                draftId,
+                versionNumber: Number(req.params.versionNumber)
+            });
+        }
+        catch (error) {
+            next(error);
+        }
+    };
+    app.get("/annotate", annotateCurrent);
+    app.get("/v/:versionNumber/annotate", annotateVersion);
+    app.get("/raw", serveCurrent);
+    app.get("/v/:versionNumber", serveVersion);
+    app.get("/v/:versionNumber/raw", serveVersion);
+    app.get(["/d/:draftId", "/d/:draftId/raw"], async (req, res, next) => {
+        try {
+            await renderDraft(req, res, { draftId: routeParam(req, "draftId") });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.get("/d/:draftId/annotate", async (req, res, next) => {
+        try {
+            await renderAnnotations(req, res, { draftId: routeParam(req, "draftId") });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.get("/d/:draftId/v/:versionNumber/annotate", async (req, res, next) => {
+        try {
+            await renderAnnotations(req, res, {
+                draftId: routeParam(req, "draftId"),
+                versionNumber: Number(req.params.versionNumber)
+            });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.get(["/d/:draftId/v/:versionNumber", "/d/:draftId/v/:versionNumber/raw"], async (req, res, next) => {
+        try {
+            await renderDraft(req, res, {
+                draftId: routeParam(req, "draftId"),
+                versionNumber: Number(req.params.versionNumber)
+            });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    app.use((req, res) => {
+        res.status(404).type("html").send(renderNotFound());
+    });
+    const errorHandler = (error, _req, res, _next) => {
+        const status = error instanceof HttpError ? error.statusCode : 500;
+        const message = status >= 500 ? "Internal server error." : errorMessage(error);
+        if (status >= 500) {
+            console.error(error);
+        }
+        res.status(status).json({ ok: false, error: message });
+    };
+    app.use(errorHandler);
+    return app;
+}
+// Serve the exact uploaded HTML, byte for byte, to EVERY client — browsers,
+// curl, and agent fetchers alike. There is deliberately no browser detection,
+// iframe wrapper, or consent interstitial: any heuristic that tried to tell an
+// agent from a browser inevitably misclassified some agent fetcher and hid the
+// draft content the service exists to share. A draft URL is now just its HTML.
+async function renderDraft(req, res, { draftId, versionNumber }) {
+    const target = await authorizeDraftRead(req, res, draftId, versionNumber);
+    if (!target)
+        return;
+    const html = await getHtmlObject(target.objectKey);
+    res.setHeader("Content-Security-Policy", draftContentSecurityPolicy());
+    if (target.mode !== "public") {
+        res.setHeader("X-Robots-Tag", "noindex, nofollow, noarchive");
+    }
+    res.setHeader("X-Openplan-Draft-Id", target.draftId);
+    res.setHeader("X-Openplan-Draft-Version", String(target.versionNumber));
+    res.type("html").send(html);
+}
+async function renderAnnotations(req, res, { draftId, versionNumber }) {
+    if (!(await getBrowserLocalAnnotationsSetting()).enabled) {
+        return res.status(404).type("html").send(renderNotFound());
+    }
+    const target = await authorizeDraftRead(req, res, draftId, versionNumber);
+    if (!target)
+        return;
+    const wildcard = !req.path.startsWith("/d/");
+    const frameSrc = wildcard
+        ? versionNumber === undefined ? "/raw" : `/v/${target.versionNumber}/raw`
+        : versionNumber === undefined
+            ? `/d/${encodeURIComponent(draftId)}/raw`
+            : `/d/${encodeURIComponent(draftId)}/v/${target.versionNumber}/raw`;
+    res.setHeader("Content-Security-Policy", annotationViewerContentSecurityPolicy());
+    res.setHeader("X-Robots-Tag", "noindex, nofollow, noarchive");
+    res.type("html").send(renderAnnotationViewer({
+        title: target.title,
+        frameSrc,
+        draftId: target.draftId,
+        versionId: target.versionId,
+        versionNumber: target.versionNumber,
+        contentHash: target.contentHash
+    }));
+}
+async function authorizeDraftRead(req, res, draftId, versionNumber) {
+    if (versionNumber !== undefined && (!Number.isInteger(versionNumber) || versionNumber < 1)) {
+        res.status(404).type("html").send(renderNotFound());
+        return null;
+    }
+    const target = await findDraftAccessTarget(draftId, versionNumber);
+    if (!target) {
+        res.status(404).type("html").send(renderNotFound());
+        return null;
+    }
+    // Browser sessions/unlock cookies are host-only on the application apex.
+    // Protected wildcard URLs must reach that origin, never a dead subdomain
+    // sign-in route, and never require widening the session cookie Domain.
+    if (target.mode !== "public" && getDraftIdFromHost({
+        publicBaseUrl: config.publicBaseUrl, host: req.get("host")
+    })) {
+        const suffix = req.path.endsWith("/raw") ? "/raw" : req.path.endsWith("/annotate") ? "/annotate" : "";
+        const versionPath = versionNumber === undefined ? "" : `/v/${versionNumber}`;
+        res.redirect(302, `${getHomeUrlForRequest(req)}/d/${draftId}${versionPath}${suffix}`);
+        return null;
+    }
+    if (target.mode === "authenticated" || target.mode === "private") {
+        if (!config.sessionSecret || !config.publicBaseUrl) {
+            throw new HttpError("Private sharing requires web sign-in configuration.", 503);
+        }
+        const session = await readWebSession(req);
+        if (!session) {
+            res.redirect(302, `/auth/sign-in?next=${encodeURIComponent(req.originalUrl)}`);
+            return null;
+        }
+        if (target.mode === "private" && !await canAccountReadDraft(session.accountId, target.ownerAccountId)) {
+            res.status(404).type("html").send(renderNotFound());
+            return null;
+        }
+    }
+    else if (target.mode === "password") {
+        if (!target.policy || !config.shareSecret) {
+            throw new HttpError("Password sharing is not configured.", 503);
+        }
+        if (!hasValidUnlock(req, target.policy, draftId, target.versionId, versionNumber)) {
+            res.setHeader("X-Robots-Tag", "noindex, nofollow, noarchive");
+            res.status(401).type("html").send(renderSharePassword({
+                title: "Protected plan",
+                action: unlockAction(req, draftId, versionNumber)
+            }));
+            return null;
+        }
+    }
+    return target;
+}
+// A CSP is the only thing kept from the old serving path. It never alters the
+// bytes a curl/agent client reads, so it does not gate content in any way; it
+// only constrains what the page may do if a human opens it in a browser —
+// blocking script execution, cross-origin network requests, and form posts.
+// Uploaded drafts are already external-script/-form/-iframe free (see
+// validateHtml) and live on isolated per-draft origins.
+function draftContentSecurityPolicy() {
+    return [
+        "default-src 'none'",
+        "script-src 'none'",
+        "style-src 'unsafe-inline'",
+        "img-src https: data:",
+        "connect-src 'none'",
+        "base-uri 'none'",
+        "form-action 'none'"
+    ].join("; ");
+}
+async function unlockDraft(req, res, { draftId, versionNumber }) {
+    const target = await findDraftAccessTarget(draftId, versionNumber);
+    if (!target || target.mode !== "password" || !target.policy) {
+        return res.status(404).type("html").send(renderNotFound());
+    }
+    if (!config.shareSecret)
+        throw new HttpError("Password sharing is not configured.", 503);
+    const source = clientIp(req) || "anonymous";
+    for (const bucket of [`share-ip:${source}`, `share-target:${draftId}:${versionNumber ?? "current"}`]) {
+        const limit = checkRateLimit(bucket, 15 * 60_000, 20);
+        if (!limit.allowed) {
+            res.setHeader("Retry-After", String(limit.retryAfter));
+            return res.status(429).type("html").send(renderSharePassword({
+                title: "Protected plan",
+                action: unlockAction(req, draftId, versionNumber),
+                error: "Too many attempts. Please try again later."
+            }));
+        }
+    }
+    const password = typeof req.body?.password === "string" ? req.body.password : "";
+    if (!verifyPassword(password, target.policy)) {
+        return res.status(403).type("html").send(renderSharePassword({
+            title: "Protected plan",
+            action: unlockAction(req, draftId, versionNumber),
+            error: "That password is incorrect."
+        }));
+    }
+    const token = createUnlockToken(target.policy, draftId, target.versionId);
+    if ((req.get("content-type") || "").toLowerCase().includes("application/json")) {
+        return res.json({ ok: true, token, expiresIn: 12 * 60 * 60 });
+    }
+    res.append("Set-Cookie", unlockCookie(token, draftId, versionNumber));
+    return res.redirect(303, canonicalDraftPath(draftId, versionNumber, Boolean(getDraftIdFromRequest(req))));
+}
+function unlockAction(req, draftId, versionNumber) {
+    return getDraftIdFromRequest(req)
+        ? versionNumber === undefined ? "/unlock" : `/v/${versionNumber}/unlock`
+        : versionNumber === undefined
+            ? `/d/${draftId}/unlock`
+            : `/d/${draftId}/v/${versionNumber}/unlock`;
+}
+function canonicalDraftPath(draftId, versionNumber, wildcard) {
+    if (wildcard)
+        return versionNumber === undefined ? "/" : `/v/${versionNumber}`;
+    return versionNumber === undefined ? `/d/${draftId}` : `/d/${draftId}/v/${versionNumber}`;
+}
+function accessMutation(body, allowInherit) {
+    if (!body || typeof body !== "object")
+        throw new HttpError("Invalid access policy body.", 400);
+    const input = body;
+    if (allowInherit && input.inherit === true)
+        return { inherit: true };
+    const mode = input.mode;
+    if (mode !== "private" && mode !== "password" && mode !== "public") {
+        throw new HttpError("Access mode must be private, password, or public.", 400);
+    }
+    const password = typeof input.password === "string" ? input.password : undefined;
+    if (mode === "password" && (!password || password.length < 8 || password.length > 512)) {
+        throw new HttpError("Password must be between 8 and 512 characters.", 400);
+    }
+    return password === undefined ? { mode } : { mode, password };
+}
+function positiveVersion(value) {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1)
+        throw new HttpError("Invalid version number.", 400);
+    return parsed;
+}
+function requireModeConfiguration(mode) {
+    if (mode === "private" && (!config.sessionSecret || !config.publicBaseUrl)) {
+        throw new HttpError("Private sharing requires web sign-in configuration.", 503);
+    }
+}
+async function findOwnedDraft(client, draftId, accountId) {
+    const result = await client.query(`
+      SELECT *
+      FROM drafts
+      WHERE id = $1
+        AND account_id = $2
+        AND deleted_at IS NULL
+      LIMIT 1
+    `, [draftId, accountId]);
+    return result.rows[0] || null;
+}
+async function requireAuth(req, res, next) {
+    const auth = await optionalAuth(req);
+    if (!auth) {
+        return res.status(401).json({ ok: false, error: "Missing or invalid API key." });
+    }
+    req.auth = auth;
+    next();
+}
+async function optionalUploadAuth(req, res, next) {
+    const auth = await optionalAuth(req);
+    // A stale or malformed credential must not turn an intended owned upload
+    // into an anonymous public upload on compatibility deployments.
+    if (!auth && (req.get("authorization") !== undefined || !config.allowAnonymousUploads)) {
+        return res.status(401).json({ ok: false, error: "An API key is required for uploads." });
+    }
+    req.auth = auth || publicUploadAuth;
+    next();
+}
+async function optionalAuth(req) {
+    const header = req.get("authorization") || "";
+    const match = header.match(/^Bearer\s+(.+)$/i);
+    if (!match)
+        return null;
+    return findApiKeyByToken(match[1].trim());
+}
+const noStoreHeaders = (_req, res, next) => {
+    res.setHeader("X-Openplan-Request-Id", newInternalId());
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Cache-Control", "no-store");
+    res.setHeader("Content-Security-Policy", APPLICATION_CSP);
+    next();
+};
+function getHomeUrlForRequest(req) {
+    return getHomeUrl({
+        publicBaseUrl: config.publicBaseUrl,
+        requestBaseUrl: getRequestBaseUrl(req)
+    });
+}
+function getDraftIdFromRequest(req) {
+    return getDraftIdFromHost({
+        publicBaseUrl: config.publicBaseUrl,
+        host: req.hostname || req.get("host")
+    });
+}
+function cleanText(value, maxLength = 255) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    return trimmed ? trimmed.slice(0, maxLength) : null;
+}
+function routeParam(req, name) {
+    const value = req.params[name];
+    return Array.isArray(value) ? value[0] ?? "" : value ?? "";
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=api.js.map