@jant/core 0.3.35 → 0.3.37

package/src/middleware/__tests__/auth.test.ts

@@ -1,6 +1,6 @@
-import { describe, it, expect } from "vitest";
+import { describe, it, expect, vi } from "vitest";
 import { Hono } from "hono";
-import { requireAuth, requireAuthApi } from "../auth.js";
+import { requireAuth, requireAuthApi, isLocalHostname } from "../auth.js";
 import { errorHandler } from "../error-handler.js";
 import type { Bindings } from "../../types.js";
 import type { AppVariables } from "../../types/app-context.js";
@@ -21,6 +21,32 @@ function createMockAuth(authenticated: boolean) {
   } as AppVariables["auth"];
 }
 
+function createMockApiTokenService(validToken?: string) {
+  const tokenId = "token-id-1";
+  return {
+    verify: vi.fn(async (raw: string) => (raw === validToken ? tokenId : null)),
+    updateLastUsed: vi.fn(async () => {}),
+    create: vi.fn(),
+    list: vi.fn(),
+    delete: vi.fn(),
+  };
+}
+
+describe("isLocalHostname", () => {
+  it.each([
+    ["localhost", true],
+    ["127.0.0.1", true],
+    ["::1", true],
+    ["jant.localtest.me", true],
+    ["sub.localtest.me", true],
+    ["myblog.com", false],
+    ["demo.jant.me", false],
+    ["localtest.me.evil.com", false],
+  ])("isLocalHostname(%s) → %s", (hostname, expected) => {
+    expect(isLocalHostname(hostname)).toBe(expected);
+  });
+});
+
 describe("requireAuth", () => {
   it("allows authenticated requests", async () => {
     const app = new Hono<Env>();
@@ -28,11 +54,11 @@ describe("requireAuth", () => {
       c.set("auth", createMockAuth(true));
       await next();
     });
-    app.get("/dash", requireAuth(), (c) => c.text("Dashboard"));
+    app.get("/settings", requireAuth(), (c) => c.text("Settings"));
 
-    const res = await app.request("/dash");
+    const res = await app.request("/settings");
     expect(res.status).toBe(200);
-    expect(await res.text()).toBe("Dashboard");
+    expect(await res.text()).toBe("Settings");
   });
 
   it("redirects unauthenticated requests to /signin", async () => {
@@ -41,9 +67,9 @@ describe("requireAuth", () => {
       c.set("auth", createMockAuth(false));
       await next();
     });
-    app.get("/dash", requireAuth(), (c) => c.text("Dashboard"));
+    app.get("/settings", requireAuth(), (c) => c.text("Settings"));
 
-    const res = await app.request("/dash", { redirect: "manual" });
+    const res = await app.request("/settings", { redirect: "manual" });
     expect(res.status).toBe(302);
     expect(res.headers.get("Location")).toBe("/signin");
   });
@@ -54,20 +80,23 @@ describe("requireAuth", () => {
       c.set("auth", createMockAuth(false));
       await next();
     });
-    app.get("/dash", requireAuth("/login"), (c) => c.text("Dashboard"));
+    app.get("/settings", requireAuth("/login"), (c) => c.text("Settings"));
 
-    const res = await app.request("/dash", { redirect: "manual" });
+    const res = await app.request("/settings", { redirect: "manual" });
     expect(res.status).toBe(302);
     expect(res.headers.get("Location")).toBe("/login");
   });
 });
 
 describe("requireAuthApi", () => {
-  it("allows authenticated requests", async () => {
+  it("allows authenticated requests via session", async () => {
     const app = new Hono<Env>();
     app.onError(errorHandler);
     app.use("*", async (c, next) => {
       c.set("auth", createMockAuth(true));
+      c.set("services", {
+        apiTokens: createMockApiTokenService(),
+      } as AppVariables["services"]);
       await next();
     });
     app.get("/api/data", requireAuthApi(), (c) => c.json({ data: "secret" }));
@@ -79,11 +108,14 @@ describe("requireAuthApi", () => {
     expect(body.data).toBe("secret");
   });
 
-  it("returns 401 for unauthenticated requests", async () => {
+  it("returns 401 for unauthenticated requests without Bearer token", async () => {
     const app = new Hono<Env>();
     app.onError(errorHandler);
     app.use("*", async (c, next) => {
       c.set("auth", createMockAuth(false));
+      c.set("services", {
+        apiTokens: createMockApiTokenService(),
+      } as AppVariables["services"]);
       await next();
     });
     app.get("/api/data", requireAuthApi(), (c) => c.json({ data: "secret" }));
@@ -107,6 +139,9 @@ describe("requireAuthApi", () => {
           },
         },
       } as AppVariables["auth"]);
+      c.set("services", {
+        apiTokens: createMockApiTokenService(),
+      } as AppVariables["services"]);
       await next();
     });
     app.get("/api/data", requireAuthApi(), (c) => c.json({ data: "secret" }));
@@ -114,4 +149,149 @@ describe("requireAuthApi", () => {
     const res = await app.request("/api/data");
     expect(res.status).toBe(401);
   });
+
+  it("allows requests with valid Bearer token when session auth fails", async () => {
+    const validToken = "jnt_abc123";
+    const mockApiTokens = createMockApiTokenService(validToken);
+
+    const app = new Hono<Env>();
+    app.onError(errorHandler);
+    app.use("*", async (c, next) => {
+      c.set("auth", createMockAuth(false));
+      c.set("services", {
+        apiTokens: mockApiTokens,
+      } as AppVariables["services"]);
+      await next();
+    });
+    app.get("/api/data", requireAuthApi(), (c) => c.json({ data: "secret" }));
+
+    const res = await app.request("/api/data", {
+      headers: { Authorization: `Bearer ${validToken}` },
+    });
+    expect(res.status).toBe(200);
+
+    const body = await res.json();
+    expect(body.data).toBe("secret");
+
+    expect(mockApiTokens.verify).toHaveBeenCalledWith(validToken);
+    expect(mockApiTokens.updateLastUsed).toHaveBeenCalledWith("token-id-1");
+  });
+
+  it("returns 401 for invalid Bearer token", async () => {
+    const mockApiTokens = createMockApiTokenService("jnt_valid");
+
+    const app = new Hono<Env>();
+    app.onError(errorHandler);
+    app.use("*", async (c, next) => {
+      c.set("auth", createMockAuth(false));
+      c.set("services", {
+        apiTokens: mockApiTokens,
+      } as AppVariables["services"]);
+      await next();
+    });
+    app.get("/api/data", requireAuthApi(), (c) => c.json({ data: "secret" }));
+
+    const res = await app.request("/api/data", {
+      headers: { Authorization: "Bearer jnt_invalid" },
+    });
+    expect(res.status).toBe(401);
+
+    expect(mockApiTokens.verify).toHaveBeenCalledWith("jnt_invalid");
+  });
+
+  it("prefers session auth over Bearer token", async () => {
+    const mockApiTokens = createMockApiTokenService("jnt_valid");
+
+    const app = new Hono<Env>();
+    app.onError(errorHandler);
+    app.use("*", async (c, next) => {
+      c.set("auth", createMockAuth(true));
+      c.set("services", {
+        apiTokens: mockApiTokens,
+      } as AppVariables["services"]);
+      await next();
+    });
+    app.get("/api/data", requireAuthApi(), (c) => c.json({ data: "secret" }));
+
+    const res = await app.request("/api/data", {
+      headers: { Authorization: "Bearer jnt_valid" },
+    });
+    expect(res.status).toBe(200);
+
+    // Should not check the token since session auth succeeded
+    expect(mockApiTokens.verify).not.toHaveBeenCalled();
+  });
+
+  it("allows DEV_API_TOKEN on localhost", async () => {
+    const devToken = "jnt_dev_test123";
+    const mockApiTokens = createMockApiTokenService();
+
+    const app = new Hono<Env>();
+    app.onError(errorHandler);
+    app.use("*", async (c, next) => {
+      c.env = { ...c.env, DEV_API_TOKEN: devToken } as Bindings;
+      c.set("auth", createMockAuth(false));
+      c.set("services", {
+        apiTokens: mockApiTokens,
+      } as AppVariables["services"]);
+      await next();
+    });
+    app.get("/api/data", requireAuthApi(), (c) => c.json({ data: "secret" }));
+
+    const res = await app.request("http://localhost:9020/api/data", {
+      headers: { Authorization: `Bearer ${devToken}` },
+    });
+    expect(res.status).toBe(200);
+
+    // Should NOT hit DB verification
+    expect(mockApiTokens.verify).not.toHaveBeenCalled();
+  });
+
+  it("rejects DEV_API_TOKEN on non-local hostname", async () => {
+    const devToken = "jnt_dev_test123";
+    const mockApiTokens = createMockApiTokenService();
+
+    const app = new Hono<Env>();
+    app.onError(errorHandler);
+    app.use("*", async (c, next) => {
+      c.env = { ...c.env, DEV_API_TOKEN: devToken } as Bindings;
+      c.set("auth", createMockAuth(false));
+      c.set("services", {
+        apiTokens: mockApiTokens,
+      } as AppVariables["services"]);
+      await next();
+    });
+    app.get("/api/data", requireAuthApi(), (c) => c.json({ data: "secret" }));
+
+    const res = await app.request("https://myblog.com/api/data", {
+      headers: { Authorization: `Bearer ${devToken}` },
+    });
+    expect(res.status).toBe(401);
+
+    // Falls through to normal DB verification (which also fails)
+    expect(mockApiTokens.verify).toHaveBeenCalledWith(devToken);
+  });
+
+  it("allows DEV_API_TOKEN on *.localtest.me", async () => {
+    const devToken = "jnt_dev_test123";
+    const mockApiTokens = createMockApiTokenService();
+
+    const app = new Hono<Env>();
+    app.onError(errorHandler);
+    app.use("*", async (c, next) => {
+      c.env = { ...c.env, DEV_API_TOKEN: devToken } as Bindings;
+      c.set("auth", createMockAuth(false));
+      c.set("services", {
+        apiTokens: mockApiTokens,
+      } as AppVariables["services"]);
+      await next();
+    });
+    app.get("/api/data", requireAuthApi(), (c) => c.json({ data: "secret" }));
+
+    const res = await app.request("https://jant.localtest.me/api/data", {
+      headers: { Authorization: `Bearer ${devToken}` },
+    });
+    expect(res.status).toBe(200);
+    expect(mockApiTokens.verify).not.toHaveBeenCalled();
+  });
 });

package/src/middleware/__tests__/onboarding.test.ts

@@ -31,14 +31,14 @@ function createApp(complete: boolean) {
 
   // Register routes for testing
   app.get("/", (c) => c.text("Home"));
-  app.get("/dash", (c) => c.text("Dashboard"));
-  app.get("/dash/posts", (c) => c.text("Posts"));
+  app.get("/settings", (c) => c.text("Settings"));
+  app.get("/settings/general", (c) => c.text("General"));
   app.get("/archive", (c) => c.text("Archive"));
   app.get("/p/abc", (c) => c.text("Post"));
   app.get("/setup", (c) => c.text("Setup"));
   app.get("/health", (c) => c.text("OK"));
   app.get("/signin", (c) => c.text("Signin"));
-  app.get("/signout", (c) => c.text("Signout"));
+  app.post("/signout", (c) => c.text("Signout"));
   app.get("/reset", (c) => c.text("Reset"));
   app.get("/api/auth/session", (c) => c.json({ ok: true }));
   app.get("/assets/client-B2b-1X3C.js", (c) => c.text("js"));
@@ -63,16 +63,18 @@ describe("requireOnboarding", () => {
       expect(res.headers.get("Location")).toBe("/setup");
     });
 
-    it("redirects /dash to /setup when onboarding not complete", async () => {
+    it("redirects /settings to /setup when onboarding not complete", async () => {
       const { app } = createApp(false);
-      const res = await app.request("/dash", { redirect: "manual" });
+      const res = await app.request("/settings", { redirect: "manual" });
       expect(res.status).toBe(302);
       expect(res.headers.get("Location")).toBe("/setup");
     });
 
-    it("redirects /dash/* to /setup when onboarding not complete", async () => {
+    it("redirects /settings/* to /setup when onboarding not complete", async () => {
       const { app } = createApp(false);
-      const res = await app.request("/dash/posts", { redirect: "manual" });
+      const res = await app.request("/settings/general", {
+        redirect: "manual",
+      });
       expect(res.status).toBe(302);
       expect(res.headers.get("Location")).toBe("/setup");
     });
@@ -105,7 +107,7 @@ describe("requireOnboarding", () => {
     await app.request("/");
     expect(getCallCount()).toBe(1);
 
-    await app.request("/dash");
+    await app.request("/settings");
     expect(getCallCount()).toBe(1); // still 1 — cached
   });
 
@@ -115,7 +117,7 @@ describe("requireOnboarding", () => {
     await app.request("/", { redirect: "manual" });
     expect(getCallCount()).toBe(1);
 
-    await app.request("/dash", { redirect: "manual" });
+    await app.request("/settings", { redirect: "manual" });
     expect(getCallCount()).toBe(2); // queried again
   });
 
@@ -136,7 +138,7 @@ describe("requireOnboarding", () => {
 
     it("allows /signout", async () => {
       const { app, getCallCount } = createApp(false);
-      const res = await app.request("/signout");
+      const res = await app.request("/signout", { method: "POST" });
       expect(res.status).toBe(200);
       expect(getCallCount()).toBe(0);
     });

package/src/middleware/auth.ts

@@ -1,19 +1,42 @@
 /**
  * Authentication Middleware
  *
- * Protects routes by requiring authentication
+ * Protects routes by requiring authentication via session cookies
+ * or Bearer API tokens.
  */
 
 import type { MiddlewareHandler } from "hono";
 import type { Bindings } from "../types.js";
 import type { AppVariables } from "../types/app-context.js";
-import { DomainError, UnauthorizedError } from "../lib/errors.js";
+import { UnauthorizedError } from "../lib/errors.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
+/**
+ * Checks whether a hostname is local (dev environment).
+ *
+ * @param hostname - The hostname to check
+ * @returns `true` for localhost, 127.0.0.1, ::1, and *.localtest.me
+ *
+ * @example
+ * ```ts
+ * isLocalHostname("localhost") // true
+ * isLocalHostname("myblog.com") // false
+ * ```
+ */
+export function isLocalHostname(hostname: string): boolean {
+  return (
+    hostname === "localhost" ||
+    hostname === "127.0.0.1" ||
+    hostname === "::1" ||
+    hostname.endsWith(".localtest.me")
+  );
+}
+
 /**
  * Middleware that requires authentication.
  * Redirects to signin page if not authenticated.
+ * Session-only — Bearer tokens are not accepted for dashboard pages.
  */
 export function requireAuth(redirectTo = "/signin"): MiddlewareHandler<Env> {
   return async (c, next) => {
@@ -35,23 +58,54 @@ export function requireAuth(redirectTo = "/signin"): MiddlewareHandler<Env> {
 
 /**
  * Middleware for API routes that requires authentication.
- * Returns 401 if not authenticated.
+ * Tries session auth first, then falls back to Bearer API token.
+ * Returns 401 if neither method succeeds.
  */
 export function requireAuthApi(): MiddlewareHandler<Env> {
   return async (c, next) => {
+    // 1. Try session auth (existing behavior)
     try {
       const session = await c.var.auth.api.getSession({
         headers: c.req.raw.headers,
       });
 
-      if (!session?.user) {
-        throw new UnauthorizedError();
+      if (session?.user) {
+        await next();
+        return;
       }
+    } catch {
+      // Session check failed — fall through to Bearer token
+    }
 
-      await next();
-    } catch (err) {
-      if (err instanceof DomainError) throw err;
-      throw new UnauthorizedError();
+    // 2. Try Bearer token auth
+    const authHeader = c.req.header("Authorization");
+    if (authHeader?.startsWith("Bearer ")) {
+      const rawToken = authHeader.slice(7);
+
+      // Dev shortcut: bypass DB lookup when DEV_API_TOKEN matches on a local hostname
+      const devToken = c.env?.DEV_API_TOKEN;
+      if (devToken && rawToken === devToken) {
+        const hostname = new URL(c.req.url).hostname;
+        if (isLocalHostname(hostname)) {
+          await next();
+          return;
+        }
+      }
+
+      const tokenId = await c.var.services.apiTokens.verify(rawToken);
+      if (tokenId) {
+        // Fire-and-forget last-used update (non-blocking)
+        const updatePromise = c.var.services.apiTokens.updateLastUsed(tokenId);
+        try {
+          c.executionCtx.waitUntil(updatePromise);
+        } catch {
+          // executionCtx not available (e.g. in tests) — ignore
+        }
+        await next();
+        return;
+      }
     }
+
+    throw new UnauthorizedError();
   };
 }

package/src/middleware/error-handler.ts

@@ -33,7 +33,7 @@ export const errorHandler: ErrorHandler<Env> = (err, c) => {
     // Unknown API error
     // eslint-disable-next-line no-console -- Server error logging is intentional
     console.error("[Jant] Unhandled error:", err);
-    return c.json({ error: "Internal server error" }, 500);
+    return c.json({ error: "Something went wrong on our end" }, 500);
   }
 
   // Datastar requests: return toast
@@ -43,7 +43,7 @@ export const errorHandler: ErrorHandler<Env> = (err, c) => {
     }
     // eslint-disable-next-line no-console -- Server error logging is intentional
     console.error("[Jant] Unhandled error:", err);
-    return dsToast("An unexpected error occurred", "error");
+    return dsToast("Something went wrong. Try refreshing the page.", "error");
   }
 
   // JSON-accepting requests (Lit bridges)
@@ -59,7 +59,7 @@ export const errorHandler: ErrorHandler<Env> = (err, c) => {
     }
     // eslint-disable-next-line no-console -- Server error logging is intentional
     console.error("[Jant] Unhandled error:", err);
-    return c.json({ error: "Internal server error" }, 500);
+    return c.json({ error: "Something went wrong on our end" }, 500);
   }
 
   // Non-API routes: map NotFoundError to Hono's built-in 404

package/src/middleware/onboarding.ts

@@ -51,7 +51,7 @@ function shouldRedirect(path: string): boolean {
     path === "/" ||
     path === "/signin" ||
     path === "/reset" ||
-    path.startsWith("/dash")
+    path.startsWith("/settings")
   );
 }
 

package/src/middleware/secure-headers.ts

@@ -0,0 +1,40 @@
+/**
+ * Security Headers Middleware
+ *
+ * Adds Content-Security-Policy and other security headers via Hono's
+ * built-in secureHeaders middleware. Uses a baseline CSP that works with
+ * the current tech stack (Datastar, Lit, inline theme styles).
+ */
+
+import { secureHeaders } from "hono/secure-headers";
+import type { MiddlewareHandler } from "hono";
+import type { Bindings } from "../types.js";
+import type { AppVariables } from "../types/app-context.js";
+import { IS_VITE_DEV } from "../lib/version.js";
+
+type Env = { Bindings: Bindings; Variables: AppVariables };
+
+export function secureHeadersMiddleware(): MiddlewareHandler<Env> {
+  return secureHeaders({
+    contentSecurityPolicy: {
+      defaultSrc: ["'self'"],
+      scriptSrc: [
+        "'self'",
+        // Datastar evaluates expressions in data-on-* / data-signals attributes
+        "'unsafe-eval'",
+      ],
+      styleSrc: [
+        "'self'",
+        // Theme styles and custom CSS are injected as inline <style> tags
+        "'unsafe-inline'",
+      ],
+      imgSrc: ["'self'", "data:", "blob:", "https:"],
+      fontSrc: ["'self'"],
+      connectSrc: IS_VITE_DEV ? ["'self'", "ws:"] : ["'self'"],
+      frameSrc: ["'none'"],
+      objectSrc: ["'none'"],
+      baseUri: ["'self'"],
+      formAction: ["'self'"],
+    },
+  });
+}

package/src/preset.css

@@ -13,6 +13,12 @@
 @import "./styles/tokens.css";
 @import "./styles/ui.css";
 
+/*
+ * Override BaseCoat's class-based dark mode with media-query-based.
+ * Jant follows system preference automatically — no manual toggle.
+ */
+@custom-variant dark (@media (prefers-color-scheme: dark));
+
 @theme {
   --radius-default: 0.5rem;
   --color-success: var(--success);
@@ -24,8 +30,45 @@
   --success: oklch(0.518 0.16 145.071);
 }
 
-.dark {
-  --success: oklch(0.627 0.194 149.214);
+/*
+ * BaseCoat dark mode fallback — mirrors BaseCoat's `.dark { }` variables
+ * via media query so dark mode works without JS class toggling.
+ * These are overridden by the active color theme (higher specificity).
+ *
+ * Source: basecoat-css@0.3.11 .dark { } block
+ */
+@media (prefers-color-scheme: dark) {
+  :root {
+    color-scheme: dark;
+    --background: oklch(0.145 0 0);
+    --foreground: oklch(0.985 0 0);
+    --card: oklch(0.205 0 0);
+    --card-foreground: oklch(0.985 0 0);
+    --popover: oklch(0.269 0 0);
+    --popover-foreground: oklch(0.985 0 0);
+    --primary: oklch(0.922 0 0);
+    --primary-foreground: oklch(0.205 0 0);
+    --secondary: oklch(0.269 0 0);
+    --secondary-foreground: oklch(0.985 0 0);
+    --muted: oklch(0.269 0 0);
+    --muted-foreground: oklch(0.708 0 0);
+    --accent: oklch(0.371 0 0);
+    --accent-foreground: oklch(0.985 0 0);
+    --destructive: oklch(0.704 0.191 22.216);
+    --border: oklch(1 0 0 / 10%);
+    --input: oklch(1 0 0 / 15%);
+    --ring: oklch(0.556 0 0);
+    --sidebar: oklch(0.205 0 0);
+    --sidebar-foreground: oklch(0.985 0 0);
+    --sidebar-primary: oklch(0.488 0.243 264.376);
+    --sidebar-primary-foreground: oklch(0.985 0 0);
+    --sidebar-accent: oklch(0.269 0 0);
+    --sidebar-accent-foreground: oklch(0.985 0 0);
+    --sidebar-border: oklch(1 0 0 / 10%);
+    --sidebar-ring: oklch(0.439 0 0);
+    --scrollbar-thumb: rgba(255, 255, 255, 0.3);
+    --success: oklch(0.627 0.194 149.214);
+  }
 }
 
 /**
@@ -73,4 +116,42 @@
   :where(h1, h2, h3, h4, h5, h6) {
     font-family: var(--font-heading);
   }
+
+  /* Image figures */
+  figure {
+    margin: 1.5em 0;
+  }
+
+  figure img {
+    width: 100%;
+    max-height: 500px;
+    object-fit: contain;
+    border-radius: 6px;
+    cursor: pointer;
+  }
+
+  figcaption {
+    text-align: center;
+    font-size: 0.875rem;
+    color: var(--tw-prose-captions);
+    margin-top: 0.5em;
+  }
+
+  /* Layout variants — center-breakout via margin+transform (no scrollbars) */
+  figure[data-layout="wide"] {
+    width: 1200px;
+    max-width: 100vw;
+    margin-left: 50%;
+    transform: translateX(-50%);
+  }
+
+  figure[data-layout="full"] {
+    width: 100vw;
+    margin-left: 50%;
+    transform: translateX(-50%);
+  }
+
+  figure[data-layout="full"] img {
+    border-radius: 0;
+  }
 }