@jchat/runtime 1.0.0-alpha.1 → 1.0.0-alpha.11

package/src/audit.ts

@@ -1,25 +0,0 @@
-import fs from "node:fs/promises"
-import path from "node:path"
-
-export type AuditEvent = "check_success" | "check_unreachable" | "check_rejected"
-
-function redact(value: string | undefined): string | undefined {
-  if (!value) return undefined
-  return value.length <= 8 ? "redacted" : `${value.slice(0, 4)}…${value.slice(-4)}`
-}
-
-export async function recordAudit(
-  event: AuditEvent,
-  details: { domain?: string; installationId?: string; reference?: string },
-  filePath = path.resolve(process.cwd(), "data/license-events.log")
-): Promise<void> {
-  await fs.mkdir(path.dirname(filePath), { recursive: true })
-  const line = JSON.stringify({
-    at: new Date().toISOString(),
-    event,
-    domain: redact(details.domain),
-    installationId: redact(details.installationId),
-    reference: redact(details.reference)
-  })
-  await fs.appendFile(filePath, `${line}\n`, "utf8")
-}

package/src/check.test.ts

@@ -1,77 +0,0 @@
-import { describe, expect, test } from "bun:test"
-import { activateRegistry, checkRegistry } from "./check"
-
-describe("license check", () => {
-  test("activates through the default registry endpoint", async () => {
-    let request: Request | undefined
-    const result = await activateRegistry({
-      purchaseCode: "purchase-code",
-      domain: "www.example.com:8080",
-      provider: "envato",
-      routingMode: "path",
-      installationId: "installation-1",
-      installationPublicKey: "public-key",
-      machineFingerprint: "machine-1",
-      fetchImpl: async (input, init) => {
-        request = new Request(input, init)
-        return Response.json({ success: true, buyer: "Buyer", token: "signed-token" })
-      }
-    })
-    expect(result).toEqual({
-      success: true,
-      buyer: "Buyer",
-      token: "signed-token",
-      domain: "example.com"
-    })
-    expect(request?.url).toBe("http://localhost:4000/api/activate")
-    expect((await request?.json())?.domain).toBe("example.com")
-  })
-
-  test("uses the local registry endpoint by default", async () => {
-    let requestedUrl = ""
-    await checkRegistry({
-      token: "local-token",
-      domain: "example.com",
-      routingMode: "path",
-      installationId: "installation-1",
-      machineFingerprint: "machine-1",
-      localTokenValidator: () => true,
-      fetchImpl: async (input) => {
-        requestedUrl = String(input)
-        return new Response("down", { status: 503 })
-      }
-    })
-    expect(requestedUrl).toBe("http://localhost:4000/api/check")
-  })
-
-  test("falls back to the local token on server errors", async () => {
-    const result = await checkRegistry({
-      token: "local-token",
-      domain: "example.com",
-      routingMode: "path",
-      registryEndpoint: "https://license.example",
-      installationId: "installation-1",
-      machineFingerprint: "machine-1",
-      localTokenValidator: () => true,
-      fetchImpl: async () => new Response("down", { status: 503 })
-    })
-    expect(result).toEqual({
-      status: "unreachable-fallback",
-      token: "local-token",
-      error: "HTTP 503"
-    })
-  })
-
-  test("fails closed on an explicit client error", async () => {
-    const result = await checkRegistry({
-      token: "local-token",
-      domain: "example.com",
-      routingMode: "path",
-      registryEndpoint: "https://license.example",
-      installationId: "installation-1",
-      machineFingerprint: "machine-1",
-      fetchImpl: async () => new Response("invalid", { status: 403 })
-    })
-    expect(result.status).toBe("invalid")
-  })
-})

package/src/check.ts

@@ -1,202 +0,0 @@
-import crypto from "node:crypto"
-import { recordAudit } from "./audit"
-import { normalizeDomain } from "./domain"
-import { parsePayload, verifyEntitlement, type RuntimeOptions } from "./index"
-import { setRuntimeStatus } from "./runtime"
-
-const DEFAULT_REGISTRY_ENDPOINT = Buffer.from("aHR0cDovL2xvY2FsaG9zdDo0MDAw", "base64").toString(
-  "utf8"
-)
-
-export type CheckResult =
-  | { status: "valid"; token: string }
-  | { status: "unreachable-fallback"; token: string; error: string }
-  | { status: "invalid"; error: string; reference: string }
-
-export type RegistryProvider = "envato" | "jchat"
-export type RegistryRoutingMode = "path" | "subdomain"
-
-export type ActivationInput = {
-  purchaseCode: string
-  domain: string
-  siteSlug?: string
-  domainScope?: "current-host" | "parent-domain"
-  provider: RegistryProvider
-  routingMode: RegistryRoutingMode
-  installationId: string
-  installationPublicKey: string
-  machineFingerprint: string
-  registryEndpoint?: string
-  fetchImpl?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>
-}
-
-export type ActivationResult =
-  | { success: true; buyer: string; token: string; domain: string }
-  | { success: false; message: string }
-
-export async function activateRegistry(input: ActivationInput): Promise<ActivationResult> {
-  try {
-    const response = await (input.fetchImpl ?? fetch)(
-      `${input.registryEndpoint ?? DEFAULT_REGISTRY_ENDPOINT}/api/activate`,
-      {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          purchaseCode: input.purchaseCode,
-          domain: normalizeDomain(input.domain).host,
-          siteSlug: input.siteSlug,
-          domainScope: input.domainScope,
-          provider: input.provider,
-          routingMode: input.routingMode,
-          installationId: input.installationId,
-          installationPublicKey: input.installationPublicKey,
-          machineFingerprint: input.machineFingerprint
-        })
-      }
-    )
-    const body = (await response.json()) as {
-      success?: boolean
-      buyer?: string
-      token?: string
-      domain?: string
-      message?: string
-    }
-    if (response.ok === false || !body.success || !body.token) {
-      return {
-        success: false,
-        message:
-          body.message ??
-          "This license is already active on another domain. Please deactivate it first."
-      }
-    }
-    return {
-      success: true,
-      buyer: body.buyer ?? "Customer",
-      token: body.token,
-      domain: body.domain ?? normalizeDomain(input.domain).host
-    }
-  } catch {
-    return {
-      success: false,
-      message: "Failed to connect to the central registry. Please try again later."
-    }
-  }
-}
-
-export type CheckInput = {
-  token: string
-  domain: string
-  routingMode: RegistryRoutingMode
-  installationId: string
-  machineFingerprint: string
-  registryEndpoint?: string
-  runtimeOptions?: RuntimeOptions
-  auditPath?: string
-  fetchImpl?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>
-  localTokenValidator?: (
-    token: string,
-    domain: string,
-    installationId: string,
-    machineFingerprint: string
-  ) => boolean
-}
-
-export async function checkRegistry(input: CheckInput): Promise<CheckResult> {
-  const fetchImpl = input.fetchImpl ?? fetch
-  const localTokenValidator =
-    input.localTokenValidator ??
-    ((token, domain, installationId, machineFingerprint) =>
-      input.runtimeOptions
-        ? verifyEntitlement(token, domain, installationId, machineFingerprint, input.runtimeOptions)
-        : false)
-
-  const reject = (domain: string, error: string): CheckResult => {
-    const reference = crypto.randomUUID()
-    setRuntimeStatus("invalid", reference)
-    void recordAudit("check_rejected", { domain, reference }, input.auditPath)
-    return { status: "invalid", error, reference }
-  }
-
-  const useLocalFallback = (error: string): CheckResult => {
-    const normalizedDomain = normalizeDomain(input.domain).host
-    if (
-      !localTokenValidator(
-        input.token,
-        normalizedDomain,
-        input.installationId,
-        input.machineFingerprint
-      )
-    ) {
-      return reject(normalizedDomain, "Local license validation failed.")
-    }
-    setRuntimeStatus("unreachable-fallback")
-    void recordAudit("check_unreachable", { domain: normalizedDomain }, input.auditPath)
-    return { status: "unreachable-fallback", token: input.token, error }
-  }
-
-  try {
-    const normalizedDomain = normalizeDomain(input.domain).host
-    const registryEndpoint = input.registryEndpoint ?? DEFAULT_REGISTRY_ENDPOINT
-    const response = await fetchImpl(`${registryEndpoint}/api/check`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        token: input.token,
-        domain: normalizedDomain,
-        routingMode: input.routingMode,
-        installationId: input.installationId,
-        machineFingerprint: input.machineFingerprint
-      })
-    })
-
-    if (!response.ok) {
-      if (response.status >= 500) return useLocalFallback(`HTTP ${response.status}`)
-      return reject(normalizedDomain, "License rejected by jchat service.")
-    }
-
-    const body = (await response.json()) as { success?: boolean; token?: string }
-    if (!body.success || !body.token) {
-      return reject(normalizedDomain, "License rejected by jchat service.")
-    }
-
-    const isValid = input.runtimeOptions
-      ? verifyEntitlement(
-          body.token,
-          normalizedDomain,
-          input.installationId,
-          input.machineFingerprint,
-          input.runtimeOptions
-        )
-      : false
-    if (!isValid && !input.localTokenValidator) {
-      return reject(normalizedDomain, "License rejected by jchat service.")
-    }
-    if (
-      input.localTokenValidator &&
-      !input.localTokenValidator(
-        body.token,
-        normalizedDomain,
-        input.installationId,
-        input.machineFingerprint
-      )
-    ) {
-      return reject(normalizedDomain, "License rejected by jchat service.")
-    }
-
-    const payload = parsePayload(body.token)
-    if (
-      !payload ||
-      payload.installationId !== input.installationId ||
-      payload.machineFingerprint !== input.machineFingerprint ||
-      payload.routingMode !== input.routingMode
-    ) {
-      return reject(normalizedDomain, "License binding rejected by jchat service.")
-    }
-
-    setRuntimeStatus("valid")
-    void recordAudit("check_success", { domain: normalizedDomain }, input.auditPath)
-    return { status: "valid", token: body.token }
-  } catch {
-    return useLocalFallback("License service unreachable.")
-  }
-}

package/src/domain.test.ts

@@ -1,45 +0,0 @@
-import { describe, expect, test } from "bun:test"
-import {
-  isAllowedConfiguredDomain,
-  isPublicDomain,
-  normalizeDomain,
-  resolveActivationDomain
-} from "./domain"
-
-describe("instance domain", () => {
-  test("normalizes and classifies public, local, and configured domains", () => {
-    expect(normalizeDomain("HTTPS://WWW.Example.com.:8080")).toEqual({
-      host: "example.com",
-      isLocalhost: false
-    })
-    expect(normalizeDomain("localhost:3000")).toEqual({
-      host: "localhost",
-      isLocalhost: true
-    })
-    expect(isPublicDomain("example.com")).toBe(true)
-    expect(isPublicDomain("localhost")).toBe(false)
-    expect(isPublicDomain("192.0.2.10")).toBe(false)
-    expect(isPublicDomain("chat.local")).toBe(false)
-    expect(isPublicDomain("chat.test")).toBe(false)
-    expect(isAllowedConfiguredDomain("chat.example.com")).toBe(true)
-    expect(isAllowedConfiguredDomain("localhost:3000")).toBe(true)
-    expect(isAllowedConfiguredDomain("chat.test")).toBe(false)
-    expect(isAllowedConfiguredDomain("")).toBe(false)
-  })
-
-  test("resolves current-host and parent-domain activation scopes", () => {
-    expect(resolveActivationDomain("demo.example.com", "extended", "path")).toBe("demo.example.com")
-    expect(resolveActivationDomain("chat.example.com", "standard", "subdomain")).toBe(
-      "chat.example.com"
-    )
-    expect(resolveActivationDomain("chat.example.com", "extended", "subdomain")).toBe(
-      "chat.example.com"
-    )
-    expect(
-      resolveActivationDomain("chat.example.com", "extended", "subdomain", "parent-domain")
-    ).toBe("example.com")
-    expect(
-      resolveActivationDomain("chat.example.co.uk", "extended", "subdomain", "parent-domain")
-    ).toBe("example.co.uk")
-  })
-})

package/src/domain.ts

@@ -1,75 +0,0 @@
-import net from "node:net"
-
-export type Plan = "standard" | "extended"
-export type RoutingMode = "path" | "subdomain"
-export type DomainScope = "current-host" | "parent-domain"
-
-const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "::1"])
-const RESERVED_SUFFIXES = [".local", ".test", ".invalid", ".example"]
-
-export type NormalizedDomain = {
-  host: string
-  isLocalhost: boolean
-}
-
-/** Normalize the host used for instance binding; ports and www are not significant. */
-export function normalizeDomain(value: string): NormalizedDomain {
-  const raw = value.trim()
-  if (!raw) throw new Error("Instance domain is required")
-
-  const url = new URL(raw.includes("://") ? raw : `https://${raw}`)
-  const hostname = url.hostname.toLowerCase().replace(/\.$/, "")
-  const host = hostname === "www.localhost" ? "localhost" : hostname.replace(/^www\./, "")
-  if (!host || host.includes("@") || /\s/.test(host)) {
-    throw new Error("Invalid instance domain")
-  }
-  return { host, isLocalhost: LOCAL_HOSTS.has(host) }
-}
-
-export function isPublicDomain(value: string): boolean {
-  const { host, isLocalhost } = normalizeDomain(value)
-  return (
-    !isLocalhost &&
-    net.isIP(host) === 0 &&
-    host.includes(".") &&
-    !RESERVED_SUFFIXES.some((suffix) => host.endsWith(suffix))
-  )
-}
-
-export function isAllowedConfiguredDomain(value: string): boolean {
-  try {
-    const normalized = normalizeDomain(value)
-    return normalized.isLocalhost || isPublicDomain(value)
-  } catch {
-    return false
-  }
-}
-
-function getRootDomain(value: string): string | null {
-  const { host, isLocalhost } = normalizeDomain(value)
-  if (isLocalhost || net.isIP(host) !== 0) return null
-
-  const parts = host.split(".")
-  if (parts.length <= 2) return host
-
-  const secondLevelTlds = new Set(["co", "com", "org", "net", "gov", "edu", "ac", "sch"])
-  const topLevel = parts.at(-1) ?? ""
-  const secondLevel = parts.at(-2) ?? ""
-  if (secondLevelTlds.has(secondLevel) && topLevel.length === 2 && parts.length >= 3) {
-    return parts.slice(-3).join(".")
-  }
-  return parts.slice(-2).join(".")
-}
-
-export function resolveActivationDomain(
-  host: string,
-  plan: Plan,
-  routingMode: RoutingMode,
-  domainScope: DomainScope = "current-host"
-): string {
-  const normalizedHost = normalizeDomain(host).host
-  if (routingMode === "subdomain" && plan === "extended" && domainScope === "parent-domain") {
-    return getRootDomain(normalizedHost) ?? normalizedHost
-  }
-  return normalizedHost
-}

package/src/env.test.ts

@@ -1,146 +0,0 @@
-import { describe, expect, it } from "bun:test"
-import { ServerConfigSchema } from "./env"
-
-const BASE = {
-  JCHAT_PORT: "3000",
-  JCHAT_COOKIE_SECRET: "secret",
-  JCHAT_DATABASE_URL: "postgresql://user:pass@localhost:5432/jchat",
-  JCHAT_REDIS_DATABASE_URL: "redis://default:pass@localhost:6379",
-  JCHAT_STORAGE_TYPE: "LOCAL",
-  JCHAT_BOT_NAME: "Bot",
-  JCHAT_BOT_EMAIL: "bot@jchat.com",
-  JCHAT_ADDON_ENCRYPTION_KEY: "1234567890123456",
-  JCHAT_DOMAIN: "localhost"
-}
-
-describe("ServerConfigSchema", () => {
-  it("parses the base environment and coerces the port", () => {
-    const result = ServerConfigSchema.safeParse(BASE)
-
-    expect(result.success).toBe(true)
-    if (result.success) expect(result.data.JCHAT_PORT).toBe(3000)
-  })
-
-  it("defaults the omitted port to 3000", () => {
-    const { JCHAT_PORT: _, ...environment } = BASE
-    const result = ServerConfigSchema.safeParse(environment)
-
-    expect(result.success).toBe(true)
-    if (result.success) expect(result.data.JCHAT_PORT).toBe(3000)
-  })
-
-  it("rejects malformed, out-of-range, and reserved ports", () => {
-    for (const port of ["abc", "0", "65536", "80", "443"]) {
-      expect(ServerConfigSchema.safeParse({ ...BASE, JCHAT_PORT: port }).success).toBe(false)
-    }
-  })
-
-  it("validates PostgreSQL and Redis connection URLs", () => {
-    const cases: Array<[Record<string, string>, boolean]> = [
-      [{ JCHAT_DATABASE_URL: "mysql://user:pass@localhost:3306/db" }, false],
-      [{ JCHAT_DATABASE_URL: "postgresql://no-port" }, false],
-      [{ JCHAT_REDIS_DATABASE_URL: "rediss://default:pass@localhost:6380" }, true],
-      [{ JCHAT_REDIS_DATABASE_URL: "http://localhost:6379" }, false],
-      [{ JCHAT_REDIS_DATABASE_URL: "redis://default:pass@localhost" }, false]
-    ]
-
-    for (const [override, expected] of cases) {
-      expect(ServerConfigSchema.safeParse({ ...BASE, ...override }).success).toBe(expected)
-    }
-  })
-
-  it("accepts only a full main-domain public site origin", () => {
-    const cases: Array<[string, boolean]> = [
-      ["https://example.com", true],
-      ["example.com", false],
-      ["https://www.example.com", false]
-    ]
-
-    for (const [siteUrl, expected] of cases) {
-      expect(ServerConfigSchema.safeParse({ ...BASE, JCHAT_SITE_URL: siteUrl }).success).toBe(
-        expected
-      )
-    }
-  })
-
-  it("allows a missing domain during initial installation", () => {
-    const { JCHAT_DOMAIN: _, ...environment } = BASE
-    const result = ServerConfigSchema.safeParse(environment)
-
-    expect(result.success).toBe(true)
-    if (result.success) expect(result.data.JCHAT_DOMAIN).toBeUndefined()
-  })
-
-  it("accepts root and nested domains in supported routing modes", () => {
-    const cases = [
-      { JCHAT_DOMAIN: "example.com" },
-      { JCHAT_DOMAIN: "chat.example.com", JCHAT_ROUTING_MODE: "path" },
-      { JCHAT_DOMAIN: "chat.example.com", JCHAT_ROUTING_MODE: "subdomain" }
-    ]
-
-    for (const override of cases) {
-      expect(ServerConfigSchema.safeParse({ ...BASE, ...override }).success).toBe(true)
-    }
-  })
-
-  it("requires provider-specific storage settings", () => {
-    const providers = [
-      {
-        type: "MINIO",
-        config: {
-          JCHAT_MINIO_ENDPOINT: "http://localhost:9000",
-          JCHAT_MINIO_BUCKET_NAME: "bucket",
-          JCHAT_MINIO_ACCESS_KEY_ID: "key",
-          JCHAT_MINIO_SECRET_ACCESS_KEY: "secret",
-          JCHAT_MINIO_PUBLIC_URL: "https://files.example.com"
-        }
-      },
-      {
-        type: "AWS_S3",
-        config: {
-          JCHAT_AWS_REGION: "us-east-1",
-          JCHAT_AWS_BUCKET_NAME: "bucket",
-          JCHAT_AWS_ACCESS_KEY_ID: "key",
-          JCHAT_AWS_SECRET_ACCESS_KEY: "secret"
-        }
-      },
-      {
-        type: "CLOUDFLARE_R2",
-        config: {
-          JCHAT_CLOUDFLARE_ACCOUNT_ID: "account",
-          JCHAT_CLOUDFLARE_BUCKET_NAME: "bucket",
-          JCHAT_CLOUDFLARE_ACCESS_KEY_ID: "key",
-          JCHAT_CLOUDFLARE_SECRET_ACCESS_KEY: "secret",
-          JCHAT_CLOUDFLARE_PUBLIC_URL: "https://cdn.example.com"
-        }
-      },
-      {
-        type: "GCS",
-        config: {
-          JCHAT_GCS_PROJECT_ID: "project",
-          JCHAT_GCS_BUCKET_NAME: "bucket",
-          JCHAT_GCS_CLIENT_EMAIL: "service@example.iam.gserviceaccount.com",
-          JCHAT_GCS_PRIVATE_KEY: "-----BEGIN RSA PRIVATE KEY-----"
-        }
-      }
-    ] as const
-
-    for (const provider of providers) {
-      expect(
-        ServerConfigSchema.safeParse({
-          ...BASE,
-          JCHAT_STORAGE_TYPE: provider.type
-        }).success
-      ).toBe(false)
-      expect(
-        ServerConfigSchema.safeParse({
-          ...BASE,
-          JCHAT_STORAGE_TYPE: provider.type,
-          ...provider.config
-        }).success
-      ).toBe(true)
-    }
-
-    expect(ServerConfigSchema.safeParse({ ...BASE, JCHAT_STORAGE_TYPE: "FTP" }).success).toBe(false)
-  })
-})