@jant/core 0.3.36 → 0.3.37

package/src/services/__tests__/search.test.ts

@@ -2,10 +2,22 @@ import { describe, it, expect, beforeEach } from "vitest";
 import { createTestDatabase } from "../../__tests__/helpers/db.js";
 import { createSearchService } from "../search.js";
 import { createPostService } from "../post.js";
-import { createPathRegistryService } from "../path-registry.js";
 import type { Database } from "../../db/index.js";
 import type BetterSqlite3 from "better-sqlite3";
 
+/** Wraps plain text in a minimal valid TipTap JSON document. */
+function tiptapDoc(text: string): string {
+  return JSON.stringify({
+    type: "doc",
+    content: [
+      {
+        type: "paragraph",
+        content: [{ type: "text", text }],
+      },
+    ],
+  });
+}
+
 describe("SearchService", () => {
   let db: Database;
   let sqlite: BetterSqlite3.Database;
@@ -34,7 +46,7 @@ describe("SearchService", () => {
     const testDb = createTestDatabase({ fts: true });
     db = testDb.db as unknown as Database;
     sqlite = testDb.sqlite;
-    postService = createPostService(db, createPathRegistryService(db));
+    postService = createPostService(db, { slugIdLength: 5 });
   });
 
   it("returns empty results for empty query", async () => {
@@ -56,11 +68,11 @@ describe("SearchService", () => {
   it("finds posts by content", async () => {
     await postService.create({
       format: "note",
-      body: "Hello world from jant",
+      body: tiptapDoc("Hello world from jant"),
     });
     await postService.create({
       format: "note",
-      body: "Another post entirely",
+      body: tiptapDoc("Another post entirely"),
     });
 
     const d1 = createMockD1(sqlite);
@@ -68,14 +80,14 @@ describe("SearchService", () => {
 
     const results = await searchService.search("jant");
     expect(results.length).toBeGreaterThanOrEqual(1);
-    expect(results[0]?.post.body).toContain("jant");
+    expect(results[0]?.post.bodyText).toContain("jant");
   });
 
   it("finds posts by title", async () => {
     await postService.create({
       format: "note",
       title: "Introduction to TypeScript",
-      body: "Some article body",
+      body: tiptapDoc("Some article body"),
     });
 
     const d1 = createMockD1(sqlite);
@@ -89,11 +101,11 @@ describe("SearchService", () => {
   it("respects status filter", async () => {
     await postService.create({
       format: "note",
-      body: "published post about testing",
+      body: tiptapDoc("published post about testing"),
     });
     await postService.create({
       format: "note",
-      body: "draft post about testing",
+      body: tiptapDoc("draft post about testing"),
       status: "draft",
     });
 
@@ -110,7 +122,7 @@ describe("SearchService", () => {
   it("excludes deleted posts", async () => {
     const post = await postService.create({
       format: "note",
-      body: "deleted post with unique search term xyzzy",
+      body: tiptapDoc("deleted post with unique search term xyzzy"),
     });
     await postService.delete(post.id);
 
@@ -125,7 +137,7 @@ describe("SearchService", () => {
     for (let i = 0; i < 5; i++) {
       await postService.create({
         format: "note",
-        body: `searchable post number ${i}`,
+        body: tiptapDoc(`searchable post number ${i}`),
       });
     }
 
@@ -135,4 +147,49 @@ describe("SearchService", () => {
     const limited = await searchService.search("searchable", { limit: 2 });
     expect(limited.length).toBeLessThanOrEqual(2);
   });
+
+  it("finds link posts by URL", async () => {
+    await postService.create({
+      format: "link",
+      title: "Example Site",
+      url: "https://example.com/article",
+    });
+
+    const d1 = createMockD1(sqlite);
+    const searchService = createSearchService(d1);
+
+    const results = await searchService.search("example.com");
+    expect(results.length).toBeGreaterThanOrEqual(1);
+    expect(results[0]?.post.url).toContain("example.com");
+  });
+
+  it("finds posts with short queries (< 3 chars) via LIKE fallback", async () => {
+    await postService.create({
+      format: "note",
+      body: tiptapDoc("自由软件"),
+    });
+
+    const d1 = createMockD1(sqlite);
+    const searchService = createSearchService(d1);
+
+    // "自由" is 2 Chinese characters — below trigram minimum, uses LIKE
+    const results = await searchService.search("自由");
+    expect(results.length).toBeGreaterThanOrEqual(1);
+    // LIKE fallback returns no snippet
+    expect(results[0]?.snippet).toBeUndefined();
+  });
+
+  it("does not match TipTap JSON structural tokens", async () => {
+    await postService.create({
+      format: "note",
+      body: tiptapDoc("Hello world"),
+    });
+
+    const d1 = createMockD1(sqlite);
+    const searchService = createSearchService(d1);
+
+    // "paragraph" is a JSON key in TipTap but not user content
+    const results = await searchService.search("paragraph");
+    expect(results).toHaveLength(0);
+  });
 });

package/src/services/api-token.ts

@@ -0,0 +1,166 @@
+/**
+ * API Token Service
+ *
+ * Manages long-lived Bearer tokens for programmatic API access.
+ * Tokens are stored as SHA-256 hashes — the plaintext is shown only once at creation.
+ */
+
+import { eq } from "drizzle-orm";
+import { uuidv7 } from "uuidv7";
+import type { Database } from "../db/index.js";
+import { apiTokens } from "../db/schema.js";
+import { now } from "../lib/time.js";
+import type { ApiToken } from "../types/entities.js";
+
+const TOKEN_PREFIX = "jnt_";
+
+export interface ApiTokenService {
+  /**
+   * Creates a new API token.
+   *
+   * @param name - User-assigned label for the token
+   * @returns The created token metadata and the plaintext (shown only once)
+   *
+   * @example
+   * ```ts
+   * const { token, plaintext } = await apiTokens.create("iOS Shortcuts");
+   * // plaintext: "jnt_a1b2c3d4..." — display once, never stored
+   * ```
+   */
+  create(name: string): Promise<{ token: ApiToken; plaintext: string }>;
+
+  /**
+   * Lists all active API tokens (without hashes).
+   *
+   * @returns Array of tokens sorted by creation date (newest first)
+   */
+  list(): Promise<ApiToken[]>;
+
+  /**
+   * Deletes an API token by ID.
+   *
+   * @param id - Token ID (UUIDv7)
+   * @returns `true` if a token was deleted, `false` if not found
+   */
+  delete(id: string): Promise<boolean>;
+
+  /**
+   * Verifies a raw Bearer token against stored hashes.
+   *
+   * @param rawToken - The full token string (e.g. "jnt_a1b2c3d4...")
+   * @returns The token ID if valid, `null` if invalid or not found
+   */
+  verify(rawToken: string): Promise<string | null>;
+
+  /**
+   * Updates the last-used timestamp for a token.
+   * Intended to be called fire-and-forget after successful verification.
+   *
+   * @param id - Token ID (UUIDv7)
+   */
+  updateLastUsed(id: string): Promise<void>;
+}
+
+/**
+ * Hashes a raw token string using SHA-256.
+ *
+ * @param raw - The raw token bytes as a hex string (without prefix)
+ * @returns Hex-encoded SHA-256 hash
+ */
+async function hashToken(raw: string): Promise<string> {
+  const encoded = new TextEncoder().encode(raw);
+  const digest = await crypto.subtle.digest("SHA-256", encoded);
+  return Array.from(new Uint8Array(digest))
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+/**
+ * Generates cryptographically random hex bytes.
+ *
+ * @param byteCount - Number of random bytes
+ * @returns Hex string of the random bytes
+ */
+function randomHex(byteCount: number): string {
+  const bytes = new Uint8Array(byteCount);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes)
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+function toApiToken(row: typeof apiTokens.$inferSelect): ApiToken {
+  return {
+    id: row.id,
+    name: row.name,
+    prefix: row.prefix,
+    lastUsedAt: row.lastUsedAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export function createApiTokenService(db: Database): ApiTokenService {
+  return {
+    async create(name: string) {
+      const id = uuidv7();
+      const timestamp = now();
+      const hex = randomHex(32); // 64 hex chars
+      const plaintext = `${TOKEN_PREFIX}${hex}`;
+      const tokenHash = await hashToken(plaintext);
+      const prefix = hex.slice(0, 8);
+
+      const result = await db
+        .insert(apiTokens)
+        .values({
+          id,
+          name,
+          tokenHash,
+          prefix,
+          lastUsedAt: null,
+          createdAt: timestamp,
+          updatedAt: timestamp,
+        })
+        .returning();
+
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- DB insert with .returning() always returns
+      return { token: toApiToken(result[0]!), plaintext };
+    },
+
+    async list() {
+      const rows = await db
+        .select()
+        .from(apiTokens)
+        .orderBy(apiTokens.createdAt);
+      return rows.map(toApiToken);
+    },
+
+    async delete(id: string) {
+      const result = await db
+        .delete(apiTokens)
+        .where(eq(apiTokens.id, id))
+        .returning();
+      return result.length > 0;
+    },
+
+    async verify(rawToken: string) {
+      if (!rawToken.startsWith(TOKEN_PREFIX)) return null;
+
+      const tokenHash = await hashToken(rawToken);
+      const rows = await db
+        .select({ id: apiTokens.id })
+        .from(apiTokens)
+        .where(eq(apiTokens.tokenHash, tokenHash))
+        .limit(1);
+
+      return rows[0]?.id ?? null;
+    },
+
+    async updateLastUsed(id: string) {
+      await db
+        .update(apiTokens)
+        .set({ lastUsedAt: now(), updatedAt: now() })
+        .where(eq(apiTokens.id, id));
+    },
+  };
+}

package/src/services/auth.ts

@@ -45,11 +45,26 @@ export function createAuthService(
     if (!stored) return false;
 
     const separatorIndex = stored.lastIndexOf(":");
-    const storedToken = stored.substring(0, separatorIndex);
+    const storedHash = stored.substring(0, separatorIndex);
     const expiry = parseInt(stored.substring(separatorIndex + 1), 10);
     const now = Math.floor(Date.now() / 1000);
 
-    return token === storedToken && now <= expiry;
+    if (now > expiry) return false;
+
+    const hashBuffer = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(token),
+    );
+    const tokenHash = Array.from(new Uint8Array(hashBuffer))
+      .map((b) => b.toString(16).padStart(2, "0"))
+      .join("");
+
+    const encoder = new TextEncoder();
+    const a = encoder.encode(tokenHash);
+    const b = encoder.encode(storedHash);
+    if (a.byteLength !== b.byteLength) return false;
+
+    return crypto.subtle.timingSafeEqual(a, b);
   }
 
   return {