@jsbot-tellus/core 2.3.0 → 2.5.0

package/src/core/web/event-feed.ts

@@ -0,0 +1,163 @@
+import type { SnowLumaEvent } from '@snowluma/sdk'
+
+export type FeedEventType = 'message' | 'notice' | 'request' | 'meta' | 'other'
+
+export interface FeedEvent {
+    id: number
+    time: number
+    type: FeedEventType
+    summary: string
+    event: SnowLumaEvent
+}
+
+export interface FeedFilter {
+    type?: FeedEventType | undefined
+    limit?: number | undefined
+}
+
+function recordOf(event: SnowLumaEvent): Record<string, unknown> {
+    return event as unknown as Record<string, unknown>
+}
+
+function eventTypeOf(event: SnowLumaEvent): FeedEventType {
+    const postType = recordOf(event).post_type
+
+    switch (postType) {
+        case 'message':
+            return 'message'
+        case 'notice':
+            return 'notice'
+        case 'request':
+            return 'request'
+        case 'meta_event':
+            return 'meta'
+        default:
+            return 'other'
+    }
+}
+
+function readString(
+    value: Record<string, unknown>,
+    key: string
+): string | undefined {
+    const item = value[key]
+
+    return typeof item === 'string' ? item : undefined
+}
+
+function readNumber(
+    value: Record<string, unknown>,
+    key: string
+): number | undefined {
+    const item = value[key]
+
+    return typeof item === 'number' ? item : undefined
+}
+
+function truncate(value: string, max = 200): string {
+    return value.length > max ? `${value.slice(0, max)}…` : value
+}
+
+function summarize(event: SnowLumaEvent): string {
+    const value = recordOf(event)
+    const type = eventTypeOf(event)
+
+    if (type === 'message') {
+        const sender = value.sender
+
+        if (typeof sender === 'object' && sender !== null) {
+            const senderRecord = sender as Record<string, unknown>
+            const name =
+                readString(senderRecord, 'card') ??
+                readString(senderRecord, 'nickname') ??
+                String(readNumber(value, 'user_id') ?? 'unknown')
+            const raw = readString(value, 'raw_message') ?? ''
+
+            return truncate(`${name}: ${raw}`)
+        }
+
+        return truncate(readString(value, 'raw_message') ?? 'message')
+    }
+
+    if (type === 'notice') {
+        return truncate(
+            `notice ${readString(value, 'notice_type') ?? 'unknown'}`
+        )
+    }
+
+    if (type === 'request') {
+        return truncate(
+            `request ${readString(value, 'request_type') ?? 'unknown'}`
+        )
+    }
+
+    if (type === 'meta') {
+        return truncate(
+            `meta ${readString(value, 'meta_event_type') ?? 'unknown'}`
+        )
+    }
+
+    return truncate(`event ${String(value.post_type ?? 'unknown')}`)
+}
+
+export class EventFeed {
+    private readonly entries: FeedEvent[] = []
+    private readonly listeners = new Set<(entry: FeedEvent) => void>()
+    private nextId = 1
+
+    constructor(private readonly capacity = 200) {}
+
+    get size(): number {
+        return this.entries.length
+    }
+
+    add(event: SnowLumaEvent): void {
+        const entry: FeedEvent = {
+            id: this.nextId,
+            time: Date.now(),
+            type: eventTypeOf(event),
+            summary: summarize(event),
+            event,
+        }
+
+        this.nextId += 1
+        this.entries.push(entry)
+
+        if (this.entries.length > this.capacity) {
+            this.entries.splice(0, this.entries.length - this.capacity)
+        }
+
+        for (const listener of this.listeners) {
+            try {
+                listener(entry)
+            } catch {
+                // Event consumers must never break dispatch.
+            }
+        }
+    }
+
+    list(filter: FeedFilter = {}): FeedEvent[] {
+        const matched = this.entries.filter(
+            (entry) => filter.type === undefined || entry.type === filter.type
+        )
+        const limit = filter.limit
+
+        if (limit === undefined || limit < 0 || limit >= matched.length) {
+            return matched
+        }
+
+        return matched.slice(-limit)
+    }
+
+    clear(): void {
+        this.entries.length = 0
+    }
+
+    subscribe(listener: (entry: FeedEvent) => void): () => void {
+        this.listeners.add(listener)
+
+        return () => {
+            this.listeners.delete(listener)
+        }
+    }
+}

package/src/core/web/http.ts

@@ -0,0 +1,340 @@
+import type { IncomingMessage, ServerResponse } from 'node:http'
+
+export const CSRF_HEADER = 'x-requested-with'
+export const CSRF_VALUE = 'jsbot-webui'
+
+export interface CookieOptions {
+    maxAgeSeconds?: number | undefined
+    secure?: boolean | undefined
+}
+
+interface SendHeaders {
+    [key: string]: string | undefined
+}
+
+export class HttpError extends Error {
+    readonly status: number
+    readonly details: unknown
+
+    constructor(status: number, message: string, details?: unknown) {
+        super(message)
+        this.name = 'HttpError'
+        this.status = status
+        this.details = details
+    }
+}
+
+export function isRecord(value: unknown): value is Record<string, unknown> {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+export async function readJsonBody(
+    req: IncomingMessage,
+    limitBytes = 1_048_576
+): Promise<unknown> {
+    const chunks: Buffer[] = []
+    let size = 0
+
+    for await (const chunk of req) {
+        const buffer = chunk as Buffer
+
+        size += buffer.length
+
+        if (size > limitBytes) {
+            throw new HttpError(413, 'request body too large')
+        }
+
+        chunks.push(buffer)
+    }
+
+    const text = Buffer.concat(chunks).toString('utf8').trim()
+
+    if (text.length === 0) return {}
+
+    try {
+        return JSON.parse(text) as unknown
+    } catch {
+        throw new HttpError(400, 'request body must be valid JSON')
+    }
+}
+
+export interface URLSearchParamsLike {
+    get(name: string): string | null
+}
+
+export function sendData(
+    res: ServerResponse,
+    status: number,
+    data: unknown,
+    headers: SendHeaders = {}
+): void {
+    sendJson(res, status, { data }, headers)
+}
+
+export function sendJson(
+    res: ServerResponse,
+    status: number,
+    data: unknown,
+    headers: SendHeaders = {}
+): void {
+    res.writeHead(status, {
+        'content-type': 'application/json; charset=utf-8',
+        'cache-control': 'no-store',
+        ...headers,
+    })
+    res.end(safeStringify(data))
+}
+
+export function sendError(
+    res: ServerResponse,
+    status: number,
+    message: string,
+    details?: unknown,
+    headers: SendHeaders = {}
+): void {
+    sendJson(
+        res,
+        status,
+        { error: details === undefined ? { message } : { message, details } },
+        headers
+    )
+}
+
+function detailsOf(error: unknown): unknown {
+    if (error instanceof HttpError) return error.details
+
+    return undefined
+}
+
+export function respondWithError(res: ServerResponse, error: unknown): void {
+    if (error instanceof HttpError) {
+        if (!res.headersSent) {
+            sendError(res, error.status, error.message, detailsOf(error))
+            return
+        }
+    } else if (!res.headersSent) {
+        sendError(res, 500, 'internal server error')
+        return
+    }
+
+    try {
+        res.end()
+    } catch {
+        // Socket already destroyed.
+    }
+}
+
+export function parseCookies(
+    header: string | undefined
+): Record<string, string> {
+    const result: Record<string, string> = {}
+
+    if (!header) return result
+
+    for (const part of header.split(';')) {
+        const separator = part.indexOf('=')
+
+        if (separator <= 0) continue
+
+        const key = part.slice(0, separator).trim()
+        const value = part.slice(separator + 1).trim()
+
+        if (key.length === 0) continue
+
+        try {
+            result[key] = decodeURIComponent(value)
+        } catch {
+            result[key] = value
+        }
+    }
+
+    return result
+}
+
+export function serializeCookie(
+    name: string,
+    value: string | null,
+    options: CookieOptions = {}
+): string {
+    const parts = [`${name}=`]
+
+    if (value === null) {
+        parts.push('; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT')
+    } else {
+        parts.push(value)
+
+        if (options.maxAgeSeconds !== undefined) {
+            parts.push(
+                `; Max-Age=${Math.max(Math.trunc(options.maxAgeSeconds), 0)}`
+            )
+        }
+    }
+
+    parts.push('; Path=/; HttpOnly; SameSite=Strict')
+
+    if (options.secure === true) parts.push('; Secure')
+
+    return parts.join('')
+}
+
+export function clearCookie(name: string): string {
+    return serializeCookie(name, null)
+}
+
+function forwardedHost(
+    req: IncomingMessage,
+    trustProxy: boolean
+): string | undefined {
+    if (!trustProxy) return undefined
+
+    const value = req.headers['x-forwarded-host']
+
+    if (typeof value !== 'string' || value.length === 0) return undefined
+
+    return value.split(',')[0]?.trim()
+}
+
+export function clientIp(req: IncomingMessage, trustProxy: boolean): string {
+    if (trustProxy) {
+        const forwarded = req.headers['x-forwarded-for']
+
+        if (typeof forwarded === 'string' && forwarded.length > 0) {
+            const first = forwarded.split(',')[0]?.trim()
+
+            if (first) return first
+        }
+    }
+
+    const address = req.socket.remoteAddress ?? 'unknown'
+
+    return address.startsWith('::ffff:') ? address.slice(7) : address
+}
+
+export function isLoopbackHost(host: string): boolean {
+    try {
+        const url = new URL(`http://${host}`)
+
+        return (
+            url.hostname === '127.0.0.1' ||
+            url.hostname === '[::1]' ||
+            url.hostname === '::1' ||
+            url.hostname === 'localhost'
+        )
+    } catch {
+        return false
+    }
+}
+
+export function sameOrigin(req: IncomingMessage, trustProxy: boolean): boolean {
+    const origin = req.headers.origin
+
+    if (typeof origin !== 'string') return true
+
+    if (origin.length === 0 || origin === 'null') return false
+
+    try {
+        const originUrl = new URL(origin)
+        const host = forwardedHost(req, trustProxy) ?? req.headers.host
+
+        if (host === undefined) return false
+
+        return originUrl.host.toLowerCase() === host.trim().toLowerCase()
+    } catch {
+        return false
+    }
+}
+
+export function assertSameOrigin(
+    req: IncomingMessage,
+    trustProxy: boolean
+): void {
+    if (sameOrigin(req, trustProxy)) return
+
+    throw new HttpError(403, 'cross-origin request rejected')
+}
+
+export function csrfHeader(req: IncomingMessage): string | undefined {
+    const value = req.headers[CSRF_HEADER]
+
+    return typeof value === 'string' ? value : undefined
+}
+
+export function assertCsrf(req: IncomingMessage): void {
+    const value = csrfHeader(req)
+
+    if (value?.toLowerCase() === CSRF_VALUE) return
+
+    throw new HttpError(403, `missing ${CSRF_HEADER}: ${CSRF_VALUE} header`)
+}
+
+export function safeStringify(value: unknown): string {
+    const seen = new WeakSet<object>()
+
+    return JSON.stringify(value, (_key, item: unknown) => {
+        if (typeof item === 'bigint') return item.toString()
+
+        if (typeof item !== 'object' || item === null) return item
+
+        if (seen.has(item)) return '[Circular]'
+
+        seen.add(item)
+
+        return item
+    })
+}
+
+const MIME_TYPES: Record<string, string> = {
+    '.css': 'text/css; charset=utf-8',
+    '.gif': 'image/gif',
+    '.html': 'text/html; charset=utf-8',
+    '.ico': 'image/x-icon',
+    '.jpeg': 'image/jpeg',
+    '.jpg': 'image/jpeg',
+    '.js': 'text/javascript; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.map': 'application/json',
+    '.mjs': 'text/javascript; charset=utf-8',
+    '.png': 'image/png',
+    '.svg': 'image/svg+xml',
+    '.txt': 'text/plain; charset=utf-8',
+    '.webp': 'image/webp',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+}
+
+export function mimeType(filePath: string): string {
+    const separator = filePath.lastIndexOf('.')
+
+    if (separator < 0) return 'application/octet-stream'
+
+    return (
+        MIME_TYPES[filePath.slice(separator).toLowerCase()] ??
+        'application/octet-stream'
+    )
+}
+
+export function isImmutableAsset(pathname: string): boolean {
+    return pathname.startsWith('/assets/')
+}
+
+export function withTimeout<T>(
+    promise: Promise<T>,
+    timeoutMs: number
+): Promise<T> {
+    return new Promise<T>((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error(`timeout after ${timeoutMs}ms`))
+        }, timeoutMs)
+
+        promise.then(
+            (value) => {
+                clearTimeout(timer)
+                resolve(value)
+            },
+            (error) => {
+                clearTimeout(timer)
+                reject(error)
+            }
+        )
+    })
+}

package/src/core/web/index.ts

@@ -0,0 +1,25 @@
+export type { FeedEvent, FeedEventType, FeedFilter } from './event-feed.js'
+export { EventFeed } from './event-feed.js'
+export type { AuthSession } from './auth.js'
+export { AuthManager } from './auth.js'
+export type { MaskedConfig } from './config-store.js'
+export {
+    ConfigStore,
+    ConfigStoreError,
+    maskConfig,
+    mergeSecrets,
+} from './config-store.js'
+export type {
+    ConfigApplyResult,
+    ConfigDocument,
+    ConfigValidationIssue,
+    ConfigValidationResult,
+    WebUiAddress,
+    WebUiDeps,
+    WebUiPaths,
+    WebUiRuntime,
+    WebUiServerOptions,
+} from './types.js'
+export type { WebUiConfig } from '../config/schema.js'
+export { WebUiServer } from './server.js'
+export { CSRF_HEADER, CSRF_VALUE, HttpError } from './http.js'