@jant/core 0.6.10 → 0.6.12

package/src/lib/__tests__/url-fetch.test.ts

@@ -0,0 +1,181 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { assertPublicHttpUrl, fetchImageBytes } from "../url-fetch.js";
+import { ValidationError } from "../errors.js";
+
+describe("assertPublicHttpUrl", () => {
+  it("accepts public http(s) URLs", () => {
+    expect(assertPublicHttpUrl("https://example.com/a.png").href).toBe(
+      "https://example.com/a.png",
+    );
+    expect(assertPublicHttpUrl("http://cdn.example.com/b.jpg").hostname).toBe(
+      "cdn.example.com",
+    );
+  });
+
+  it.each([
+    ["ftp scheme", "ftp://example.com/a.png"],
+    ["data scheme", "data:image/png;base64,AAAA"],
+    ["embedded credentials", "https://user:pass@example.com/a.png"],
+    ["localhost", "http://localhost/a.png"],
+    ["sub.localhost", "http://api.localhost/a.png"],
+    ["0.0.0.0", "http://0.0.0.0/a.png"],
+    ["loopback v4", "http://127.0.0.1/a.png"],
+    ["private 10/8", "http://10.0.0.5/a.png"],
+    ["private 172.16/12", "http://172.16.5.5/a.png"],
+    ["private 192.168/16", "http://192.168.1.1/a.png"],
+    ["CGNAT 100.64/10", "http://100.64.0.1/a.png"],
+    ["link-local / metadata", "http://169.254.169.254/latest/meta-data"],
+    ["loopback v6", "http://[::1]/a.png"],
+    ["link-local v6", "http://[fe80::1]/a.png"],
+    ["ULA v6", "http://[fd00::1]/a.png"],
+    ["v4-mapped private v6", "http://[::ffff:10.0.0.1]/a.png"],
+  ])("rejects %s", (_label, url) => {
+    expect(() => assertPublicHttpUrl(url)).toThrow(ValidationError);
+  });
+
+  it("rejects a non-URL string", () => {
+    expect(() => assertPublicHttpUrl("not a url")).toThrow(ValidationError);
+  });
+});
+
+describe("fetchImageBytes", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  function pngBytes(length = 64): Uint8Array {
+    const bytes = new Uint8Array(length);
+    bytes.set([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+    return bytes;
+  }
+
+  it("returns the bytes and content-type on success", async () => {
+    const bytes = pngBytes();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(bytes, {
+            headers: { "content-type": "image/png" },
+          }),
+      ),
+    );
+
+    const result = await fetchImageBytes(new URL("https://example.com/a.png"), {
+      maxBytes: 1024,
+      timeoutMs: 5000,
+    });
+
+    expect(result.contentType).toBe("image/png");
+    expect(result.bytes.byteLength).toBe(bytes.byteLength);
+  });
+
+  it("sends a Referer matching the image origin (hotlink protection)", async () => {
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(pngBytes(), { headers: { "content-type": "image/png" } }),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    await fetchImageBytes(
+      new URL("https://img9.doubanio.com/view/photo/p1.webp"),
+      { maxBytes: 1024, timeoutMs: 5000 },
+    );
+
+    const headers = fetchMock.mock.calls[0]?.[1]?.headers as
+      | Record<string, string>
+      | undefined;
+    expect(headers?.Referer).toBe("https://img9.doubanio.com/");
+  });
+
+  it("rejects via the Content-Length precheck", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(pngBytes(16), {
+            headers: {
+              "content-type": "image/png",
+              "content-length": "999999",
+            },
+          }),
+      ),
+    );
+
+    await expect(
+      fetchImageBytes(new URL("https://example.com/a.png"), {
+        maxBytes: 1024,
+        timeoutMs: 5000,
+      }),
+    ).rejects.toThrow(/too large/i);
+  });
+
+  it("aborts when the streamed body exceeds maxBytes (no Content-Length)", async () => {
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new Uint8Array(2048));
+        controller.close();
+      },
+    });
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(stream, {
+            headers: { "content-type": "image/png" },
+          }),
+      ),
+    );
+
+    await expect(
+      fetchImageBytes(new URL("https://example.com/a.png"), {
+        maxBytes: 1024,
+        timeoutMs: 5000,
+      }),
+    ).rejects.toThrow(/too large/i);
+  });
+
+  it("re-validates redirect targets and rejects a hop to a private address", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(null, {
+            status: 302,
+            headers: { location: "http://169.254.169.254/" },
+          }),
+      ),
+    );
+
+    await expect(
+      fetchImageBytes(new URL("https://example.com/a.png"), {
+        maxBytes: 1024,
+        timeoutMs: 5000,
+      }),
+    ).rejects.toThrow(ValidationError);
+  });
+
+  it("follows a redirect to a public target", async () => {
+    const bytes = pngBytes();
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        new Response(null, {
+          status: 302,
+          headers: { location: "https://cdn.example.com/final.png" },
+        }),
+      )
+      .mockResolvedValueOnce(
+        new Response(bytes, { headers: { "content-type": "image/png" } }),
+      );
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await fetchImageBytes(new URL("https://example.com/a.png"), {
+      maxBytes: 1024,
+      timeoutMs: 5000,
+    });
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(result.bytes.byteLength).toBe(bytes.byteLength);
+  });
+});

package/src/lib/feed.ts

@@ -92,6 +92,49 @@ function getAtomTitle(post: PostView): string {
   return post.title || "";
 }
 
+interface SinglePostContentOptions {
+  /**
+   * Inline posts do not have their own Atom entry title/link, so their visible
+   * feed HTML must carry title and link metadata that top-level entries expose
+   * through Atom fields.
+   */
+  inline?: boolean;
+}
+
+function renderLinkedText(text: string, href?: string): string {
+  const label = escapeXml(text);
+  return href ? `<a href="${escapeXml(href)}">${label}</a>` : label;
+}
+
+function renderInlinePostHeader(
+  post: PostView,
+  permalinkUrl?: string,
+): string[] {
+  if (post.format === "quote") return [];
+
+  const parts: string[] = [];
+
+  if (post.format === "link") {
+    const linkUrl = post.url || "";
+    const domain = linkUrl ? extractDisplayDomain(linkUrl) || linkUrl : "";
+    if (domain) {
+      parts.push(`<p>${renderLinkedText(domain, linkUrl)}</p>`);
+    }
+    if (post.title) {
+      parts.push(
+        `<h2>${renderLinkedText(post.title, linkUrl || permalinkUrl)}</h2>`,
+      );
+    }
+    return parts;
+  }
+
+  if (post.title) {
+    parts.push(`<h2>${renderLinkedText(post.title, permalinkUrl)}</h2>`);
+  }
+
+  return parts;
+}
+
 /**
  * Render a star rating as HTML for feed content.
  */
@@ -242,10 +285,19 @@ function renderMediaForFeed(
  *
  * @param post - Post view data
  * @param permalinkUrl - Absolute permalink URL back to the blog post
+ * @param options - Rendering options for top-level versus inline posts
  */
-function buildSinglePostContent(post: PostView, permalinkUrl?: string): string {
+function buildSinglePostContent(
+  post: PostView,
+  permalinkUrl?: string,
+  options: SinglePostContentOptions = {},
+): string {
   const parts: string[] = [];
 
+  if (options.inline) {
+    parts.push(...renderInlinePostHeader(post, permalinkUrl));
+  }
+
   if (post.format === "quote" && post.quoteText) {
     const sourceName = post.title || "";
     const sourceUrl = post.url || "";
@@ -316,12 +368,20 @@ function buildFeedContent(
     parts.push(
       `<p><small><time datetime="${escapeXml(reply.publishedAt)}">${escapeXml(reply.publishedAtFormatted)}</time></small></p>`,
     );
-    parts.push(buildSinglePostContent(reply, replyPermalink));
+    parts.push(buildSinglePostContent(reply, replyPermalink, { inline: true }));
   }
 
   return parts.join("\n");
 }
 
+function getEntryMedia(post: FeedPostView): MediaView[] {
+  const media = [...post.media];
+  for (const reply of post.threadReplies ?? []) {
+    media.push(...reply.media);
+  }
+  return media;
+}
+
 /**
  * Default Atom feed renderer.
  *
@@ -354,7 +414,7 @@ export function defaultFeedRenderer(data: FeedData): string {
       // One <link rel="enclosure"> per attachment so podcast/offline readers
       // can fetch them. Atom omits length when size is unknown; mimeType is
       // always known from the upload pipeline.
-      const enclosureLinks = post.media
+      const enclosureLinks = getEntryMedia(post)
         .map((m) => {
           const lengthAttr =
             m.size != null && m.size > 0 ? ` length="${m.size}"` : "";

package/src/lib/post-display.ts

@@ -79,9 +79,17 @@ function resolvePostSocialImage(
   return undefined;
 }
 
-function canViewPost(post: Post, isAuthenticated: boolean): boolean {
+interface PostDisplayOptions {
+  isAuthenticated?: boolean;
+  allowDraft?: boolean;
+}
+
+function canViewPost(post: Post, options: PostDisplayOptions = {}): boolean {
+  const isAuthenticated = options.isAuthenticated ?? false;
   if (post.status !== "published") {
-    return false;
+    return Boolean(
+      post.status === "draft" && isAuthenticated && options.allowDraft,
+    );
   }
 
   if (post.visibility === "private" && !isAuthenticated) {
@@ -102,11 +110,10 @@ function canViewPost(post: Post, isAuthenticated: boolean): boolean {
 export async function assemblePostCardView(
   c: Context<Env>,
   postId: string,
-  options?: { isAuthenticated?: boolean },
+  options?: PostDisplayOptions,
 ): Promise<PostView | null> {
   const post = await c.var.services.posts.getById(postId);
-  const isAuthenticated = options?.isAuthenticated ?? false;
-  if (!post || !canViewPost(post, isAuthenticated)) {
+  if (!post || !canViewPost(post, options)) {
     return null;
   }
 
@@ -149,15 +156,14 @@ export async function assemblePostCardView(
 export async function assemblePostPageDisplay(
   c: Context<Env>,
   postOrId: string | Post,
-  options?: { isAuthenticated?: boolean },
+  options?: PostDisplayOptions,
 ): Promise<PostPageDisplayData | null> {
   const post =
     typeof postOrId === "string"
       ? await c.var.services.posts.getById(postOrId)
       : postOrId;
-  const isAuthenticated = options?.isAuthenticated ?? false;
 
-  if (!post || !canViewPost(post, isAuthenticated)) {
+  if (!post || !canViewPost(post, options)) {
     return null;
   }
 

package/src/lib/upload.ts

@@ -277,6 +277,117 @@ export function isImageMimeType(mimeType: string): boolean {
   return mimeType.startsWith("image/");
 }
 
+/** Image MIME types accepted by the remote-image sideload path. */
+const SIDELOAD_IMAGE_MIME_TYPES = new Set<string>(IMAGE_MIME_TYPES);
+
+/** Map of sideload-accepted image MIME types to their file extensions. */
+const IMAGE_MIME_EXTENSIONS: Record<string, string> = {
+  "image/jpeg": "jpg",
+  "image/png": "png",
+  "image/gif": "gif",
+  "image/webp": "webp",
+  "image/svg+xml": "svg",
+  "image/avif": "avif",
+  "image/bmp": "bmp",
+  "image/x-icon": "ico",
+};
+
+/**
+ * Whether a MIME type may be rehosted via remote-image sideload.
+ *
+ * Unlike {@link getStoredUploadPolicy} (which only allows webp/png/jpeg because
+ * the normal upload path re-encodes everything to WebP client-side), the
+ * sideload path stores the original remote bytes, so it accepts the full set of
+ * image formats Jant can display.
+ *
+ * @param contentType - The MIME type to check
+ * @returns Whether the type is an accepted sideload image
+ * @example
+ * ```ts
+ * isAllowedSideloadImageType("image/gif"); // true
+ * isAllowedSideloadImageType("text/html"); // false
+ * ```
+ */
+export function isAllowedSideloadImageType(contentType: string): boolean {
+  return SIDELOAD_IMAGE_MIME_TYPES.has(contentType);
+}
+
+/**
+ * Returns the file extension for a sideload-accepted image MIME type.
+ *
+ * @param contentType - The image MIME type
+ * @returns Extension without a dot, or null if the type isn't sideloadable
+ * @example
+ * ```ts
+ * imageExtensionForMimeType("image/jpeg"); // "jpg"
+ * ```
+ */
+export function imageExtensionForMimeType(contentType: string): string | null {
+  return IMAGE_MIME_EXTENSIONS[contentType] ?? null;
+}
+
+/**
+ * Identify an image format from its leading bytes (magic numbers), so a remote
+ * sideload can trust the actual content rather than the server's content-type
+ * header. Recognizes every {@link isAllowedSideloadImageType} format.
+ *
+ * @param bytes - The leading bytes of the file (≥ ~256 bytes recommended)
+ * @returns The detected image MIME type, or null if unrecognized
+ * @example
+ * ```ts
+ * sniffImageMimeType(pngBytes); // "image/png"
+ * ```
+ */
+export function sniffImageMimeType(bytes: Uint8Array): string | null {
+  if (
+    bytes.length >= 3 &&
+    bytes[0] === 0xff &&
+    bytes[1] === 0xd8 &&
+    bytes[2] === 0xff
+  ) {
+    return "image/jpeg";
+  }
+  if (
+    bytes.length >= 8 &&
+    bytes[0] === 0x89 &&
+    readAscii(bytes, 1, 3) === "PNG"
+  ) {
+    return "image/png";
+  }
+  if (bytes.length >= 6 && /^GIF8[79]a$/.test(readAscii(bytes, 0, 6))) {
+    return "image/gif";
+  }
+  if (
+    bytes.length >= 12 &&
+    readAscii(bytes, 0, 4) === "RIFF" &&
+    readAscii(bytes, 8, 4) === "WEBP"
+  ) {
+    return "image/webp";
+  }
+  if (bytes.length >= 12 && readAscii(bytes, 4, 4) === "ftyp") {
+    const brand = readAscii(bytes, 8, 4);
+    if (brand === "avif" || brand === "avis") return "image/avif";
+  }
+  if (bytes.length >= 2 && bytes[0] === 0x42 && bytes[1] === 0x4d) {
+    return "image/bmp";
+  }
+  if (
+    bytes.length >= 4 &&
+    bytes[0] === 0x00 &&
+    bytes[1] === 0x00 &&
+    bytes[2] === 0x01 &&
+    bytes[3] === 0x00
+  ) {
+    return "image/x-icon";
+  }
+  // SVG is text — look for an <svg> root in the leading bytes.
+  const head = new TextDecoder().decode(bytes.subarray(0, 1024)).toLowerCase();
+  if (head.includes("<svg")) {
+    return "image/svg+xml";
+  }
+  return null;
+}
+
 export interface ValidateUploadOptions {
   /** When true, only image MIME types are accepted (e.g. for avatar uploads). */
   imagesOnly?: boolean;