@json-to-office/jto 0.33.2 → 0.35.0

package/dist/render-server.js

@@ -16,13 +16,111 @@ import {
   DEFAULT_VISUAL_DPI,
   MIN_VISUAL_DPI,
   MAX_VISUAL_DPI,
-  MAX_RASTERIZE_BATCH_SLIDES
+  MAX_RASTERIZE_BATCH_SLIDES,
+  MAX_RASTERIZE_FONTS,
+  MAX_RASTERIZE_FONT_BYTES
 } from "@json-to-office/shared";
 import {
   createLibreOfficePptxRasterizer,
   createLibreOfficePptxBatchRasterizer
 } from "@json-to-office/jto-cli";
 
+// src/server/config/index.ts
+import dotenv from "dotenv";
+dotenv.config();
+function positiveInteger(value, fallback) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function parseAuthMode(value, nodeEnv) {
+  if (value === "auto" || value === "required" || value === "disabled") {
+    return value;
+  }
+  return nodeEnv === "production" ? "required" : "auto";
+}
+function parseOutboundSourceMode(value, nodeEnv) {
+  if (value === "development" || value === "safe") return value;
+  return nodeEnv === "production" ? "safe" : "development";
+}
+function normalizeNodeEnv(value) {
+  return value === "development" || value === "test" ? value : "production";
+}
+function parseEnv(env) {
+  const nodeEnv = normalizeNodeEnv(env.NODE_ENV || "development");
+  return {
+    NODE_ENV: nodeEnv,
+    // No PORT here: the listener is opened by the dev server from the CLI
+    // config (`-p` > `server.port` > `PORT` env > format default), so a second
+    // copy of it in this module would be silently ignored.
+    CORS_ORIGIN: env.CORS_ORIGIN || "*",
+    API_KEY: env.API_KEY,
+    API_KEY_HEADER: env.API_KEY_HEADER || "x-api-key",
+    API_AUTH_MODE: parseAuthMode(env.API_AUTH_MODE, nodeEnv),
+    RATE_LIMIT_WINDOW_MS: positiveInteger(env.RATE_LIMIT_WINDOW_MS, 9e5),
+    RATE_LIMIT_MAX: positiveInteger(
+      env.RATE_LIMIT_MAX,
+      nodeEnv === "production" ? 100 : 1e3
+    ),
+    TRUST_PROXY_HEADERS: env.TRUST_PROXY_HEADERS === "true",
+    MAX_FILE_SIZE: positiveInteger(env.MAX_FILE_SIZE, 10 * 1024 * 1024),
+    MAX_REQUEST_BODY_SIZE: positiveInteger(
+      env.MAX_REQUEST_BODY_SIZE,
+      32 * 1024 * 1024
+    ),
+    MAX_CONCURRENT_REQUESTS: positiveInteger(
+      env.MAX_CONCURRENT_REQUESTS,
+      nodeEnv === "production" ? 8 : 64
+    ),
+    OUTBOUND_SOURCE_MODE: parseOutboundSourceMode(
+      env.OUTBOUND_SOURCE_MODE,
+      nodeEnv
+    ),
+    OUTBOUND_HOST_ALLOWLIST: (env.OUTBOUND_HOST_ALLOWLIST || "").split(",").map((host) => host.trim().toLowerCase()).filter(Boolean),
+    LIBREOFFICE_PATH: env.LIBREOFFICE_PATH,
+    LIBREOFFICE_TIMEOUT_MS: env.LIBREOFFICE_TIMEOUT_MS ? positiveInteger(env.LIBREOFFICE_TIMEOUT_MS, 3e4) : 3e4,
+    LOG_LEVEL: env.LOG_LEVEL || "info",
+    CACHE_ENABLED: env.CACHE_ENABLED !== "false",
+    CACHE_MAX_SIZE_MB: positiveInteger(env.CACHE_MAX_SIZE_MB, 100),
+    CACHE_TTL_SECONDS: positiveInteger(env.CACHE_TTL_SECONDS, 3600),
+    CACHE_MAX_ITEMS: positiveInteger(env.CACHE_MAX_ITEMS, 1e3)
+  };
+}
+var parsedEnv = parseEnv(process.env);
+var config = {
+  ...parsedEnv,
+  isDevelopment: parsedEnv.NODE_ENV === "development",
+  isProduction: parsedEnv.NODE_ENV === "production",
+  isTest: parsedEnv.NODE_ENV === "test",
+  features: {
+    apiKey: parsedEnv.API_AUTH_MODE !== "disabled",
+    cache: parsedEnv.CACHE_ENABLED
+  },
+  cors: {
+    origin: parsedEnv.CORS_ORIGIN === "*" ? parsedEnv.CORS_ORIGIN : parsedEnv.CORS_ORIGIN.split(",").map((o) => o.trim()),
+    credentials: true
+  },
+  rateLimit: {
+    windowMs: parsedEnv.RATE_LIMIT_WINDOW_MS,
+    max: parsedEnv.RATE_LIMIT_MAX,
+    trustProxy: parsedEnv.TRUST_PROXY_HEADERS
+  },
+  requestLimits: {
+    maxBodySize: parsedEnv.MAX_REQUEST_BODY_SIZE,
+    maxConcurrent: parsedEnv.MAX_CONCURRENT_REQUESTS,
+    maxFileSize: parsedEnv.MAX_FILE_SIZE
+  },
+  outboundSources: {
+    mode: parsedEnv.OUTBOUND_SOURCE_MODE,
+    allowedHosts: parsedEnv.OUTBOUND_HOST_ALLOWLIST
+  },
+  cache: {
+    enabled: parsedEnv.CACHE_ENABLED,
+    maxSizeMB: parsedEnv.CACHE_MAX_SIZE_MB,
+    ttlSeconds: parsedEnv.CACHE_TTL_SECONDS,
+    maxItems: parsedEnv.CACHE_MAX_ITEMS
+  }
+};
+
 // src/server/lib/typebox-validator.ts
 import { Value } from "@sinclair/typebox/value";
 import { HTTPException } from "hono/http-exception";
@@ -386,13 +484,39 @@ function assertSafeRendererPayload(value, policy) {
 }
 
 // src/server/rasterize-route.ts
+var BASE64_PATTERN = "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$";
+var RasterizeFontFaceSchema = Type.Object(
+  {
+    family: Type.String({ minLength: 1, maxLength: 128 }),
+    weight: Type.Integer({ minimum: 1, maximum: 1e3 }),
+    italic: Type.Boolean(),
+    data: Type.String({
+      minLength: 1,
+      maxLength: 4 * 1024 * 1024,
+      pattern: BASE64_PATTERN
+    }),
+    format: Type.Optional(
+      Type.Union([
+        Type.Literal("ttf"),
+        Type.Literal("otf"),
+        Type.Literal("woff"),
+        Type.Literal("woff2")
+      ])
+    )
+  },
+  { additionalProperties: false }
+);
+var FontsSchema = Type.Optional(
+  Type.Array(RasterizeFontFaceSchema, { maxItems: MAX_RASTERIZE_FONTS })
+);
 var RasterizeRequestSchema = Type.Object(
   {
     presentation: Type.Object({}, { additionalProperties: true }),
     dpi: Type.Optional(
       Type.Number({ minimum: MIN_VISUAL_DPI, maximum: MAX_VISUAL_DPI })
     ),
-    baseDir: Type.Optional(Type.String())
+    baseDir: Type.Optional(Type.String()),
+    fonts: FontsSchema
   },
   { additionalProperties: false }
 );
@@ -410,7 +534,13 @@ var RasterizeBatchRequestSchema = Type.Object(
       ),
       { minItems: 1, maxItems: MAX_RASTERIZE_BATCH_SLIDES }
     ),
-    baseDir: Type.Optional(Type.String())
+    baseDir: Type.Optional(Type.String()),
+    // Request-level, shared by every slide, exactly like `baseDir`. NOT
+    // inside the per-slide object above, whose `additionalProperties: false`
+    // must keep rejecting per-slide fonts: a uniform slide shape is what
+    // lets batch dedupe and the disk-cache key stay identical to the
+    // single-slide path.
+    fonts: FontsSchema
   },
   { additionalProperties: false }
 );
@@ -465,6 +595,18 @@ function assertPixelBudget(slides) {
     });
   }
 }
+function assertFontBudget(fonts) {
+  if (!fonts?.length) return;
+  const bytes = fonts.reduce(
+    (sum, f) => sum + Math.ceil(f.data.length * 0.75),
+    0
+  );
+  if (bytes > MAX_RASTERIZE_FONT_BYTES) {
+    throw new HTTPException2(400, {
+      message: "Requested font payload is too large"
+    });
+  }
+}
 function resolveSafeBaseDir(baseDir) {
   if (baseDir === void 0) return void 0;
   const resolved = path.resolve(baseDir);
@@ -492,13 +634,23 @@ function toHttpException(error) {
     message: "Internal server error during rasterization"
   });
 }
+var MAX_RASTERIZE_BODY_CEILING = 64 * 1024 * 1024;
+function resolveMaxBodyBytes(explicit) {
+  const fromEnv = Number.parseInt(
+    process.env.MAX_RASTERIZE_BODY_SIZE ?? "",
+    10
+  );
+  const configured = explicit ?? (Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : config.requestLimits.maxBodySize);
+  return Math.min(configured, MAX_RASTERIZE_BODY_CEILING);
+}
 function registerRasterizeRoute(router, options = {}) {
   const getRasterizer = options.getRasterizer ?? getSharedRasterizer;
   const getBatchRasterizer = options.getBatchRasterizer ?? getSharedBatchRasterizer;
+  const maxBodyBytes = resolveMaxBodyBytes(options.maxBodyBytes);
   const shared = [
     ...options.preMiddleware ?? [],
     bodyLimit({
-      maxSize: 32 * 1024 * 1024,
+      maxSize: maxBodyBytes,
       onError: () => {
         throw new HTTPException2(413, { message: "Request body too large" });
       }
@@ -518,10 +670,11 @@ function registerRasterizeRoute(router, options = {}) {
     ...shared,
     tbValidator(RasterizeRequestSchema),
     async (c) => {
-      const { presentation, dpi, baseDir } = getValidated(c, "json");
+      const { presentation, dpi, baseDir, fonts } = getValidated(c, "json");
       const safeBaseDir = resolveSafeBaseDir(baseDir);
       const effectiveDpi = clampVisualDpi(dpi ?? DEFAULT_VISUAL_DPI);
       assertPixelBudget([{ presentation, dpi: effectiveDpi }]);
+      assertFontBudget(fonts);
       const result = await guard(async () => {
         if (options.sourcePolicy) {
           assertSafeOutboundSources(
@@ -533,7 +686,12 @@ function registerRasterizeRoute(router, options = {}) {
         return getRasterizer()({
           presentation,
           dpi: effectiveDpi,
-          baseDir: safeBaseDir
+          baseDir: safeBaseDir,
+          // Conditional so a fontless request reaches the engine with no
+          // `fonts` key at all — an `undefined` would still be an absent
+          // digest, but keeping the object identical to the pre-change shape
+          // makes the cache-key equivalence obvious.
+          ...fonts?.length && { fonts }
         });
       });
       return c.json(result);
@@ -544,13 +702,14 @@ function registerRasterizeRoute(router, options = {}) {
     ...shared,
     tbValidator(RasterizeBatchRequestSchema),
     async (c) => {
-      const { slides, baseDir } = getValidated(c, "json");
+      const { slides, baseDir, fonts } = getValidated(c, "json");
       const safeBaseDir = resolveSafeBaseDir(baseDir);
       const effectiveSlides = slides.map((slide) => ({
         presentation: slide.presentation,
         dpi: clampVisualDpi(slide.dpi ?? DEFAULT_VISUAL_DPI)
       }));
       assertPixelBudget(effectiveSlides);
+      assertFontBudget(fonts);
       const result = await guard(async () => {
         if (options.sourcePolicy) {
           slides.forEach(
@@ -563,7 +722,8 @@ function registerRasterizeRoute(router, options = {}) {
         }
         return getBatchRasterizer()({
           slides: effectiveSlides,
-          baseDir: safeBaseDir
+          baseDir: safeBaseDir,
+          ...fonts?.length && { fonts }
         });
       });
       return c.json({
@@ -673,104 +833,6 @@ function concurrencyLimiter(options) {
 
 // src/server/middleware/hono/auth.ts
 import { createHash, timingSafeEqual } from "crypto";
-
-// src/server/config/index.ts
-import dotenv from "dotenv";
-dotenv.config();
-function positiveInteger(value, fallback) {
-  const parsed = Number.parseInt(value ?? "", 10);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
-}
-function parseAuthMode(value, nodeEnv) {
-  if (value === "auto" || value === "required" || value === "disabled") {
-    return value;
-  }
-  return nodeEnv === "production" ? "required" : "auto";
-}
-function parseOutboundSourceMode(value, nodeEnv) {
-  if (value === "development" || value === "safe") return value;
-  return nodeEnv === "production" ? "safe" : "development";
-}
-function normalizeNodeEnv(value) {
-  return value === "development" || value === "test" ? value : "production";
-}
-function parseEnv(env) {
-  const nodeEnv = normalizeNodeEnv(env.NODE_ENV || "development");
-  return {
-    NODE_ENV: nodeEnv,
-    // No PORT here: the listener is opened by the dev server from the CLI
-    // config (`-p` > `server.port` > `PORT` env > format default), so a second
-    // copy of it in this module would be silently ignored.
-    CORS_ORIGIN: env.CORS_ORIGIN || "*",
-    API_KEY: env.API_KEY,
-    API_KEY_HEADER: env.API_KEY_HEADER || "x-api-key",
-    API_AUTH_MODE: parseAuthMode(env.API_AUTH_MODE, nodeEnv),
-    RATE_LIMIT_WINDOW_MS: positiveInteger(env.RATE_LIMIT_WINDOW_MS, 9e5),
-    RATE_LIMIT_MAX: positiveInteger(
-      env.RATE_LIMIT_MAX,
-      nodeEnv === "production" ? 100 : 1e3
-    ),
-    TRUST_PROXY_HEADERS: env.TRUST_PROXY_HEADERS === "true",
-    MAX_FILE_SIZE: positiveInteger(env.MAX_FILE_SIZE, 10 * 1024 * 1024),
-    MAX_REQUEST_BODY_SIZE: positiveInteger(
-      env.MAX_REQUEST_BODY_SIZE,
-      32 * 1024 * 1024
-    ),
-    MAX_CONCURRENT_REQUESTS: positiveInteger(
-      env.MAX_CONCURRENT_REQUESTS,
-      nodeEnv === "production" ? 8 : 64
-    ),
-    OUTBOUND_SOURCE_MODE: parseOutboundSourceMode(
-      env.OUTBOUND_SOURCE_MODE,
-      nodeEnv
-    ),
-    OUTBOUND_HOST_ALLOWLIST: (env.OUTBOUND_HOST_ALLOWLIST || "").split(",").map((host) => host.trim().toLowerCase()).filter(Boolean),
-    LIBREOFFICE_PATH: env.LIBREOFFICE_PATH,
-    LIBREOFFICE_TIMEOUT_MS: env.LIBREOFFICE_TIMEOUT_MS ? positiveInteger(env.LIBREOFFICE_TIMEOUT_MS, 3e4) : 3e4,
-    LOG_LEVEL: env.LOG_LEVEL || "info",
-    CACHE_ENABLED: env.CACHE_ENABLED !== "false",
-    CACHE_MAX_SIZE_MB: positiveInteger(env.CACHE_MAX_SIZE_MB, 100),
-    CACHE_TTL_SECONDS: positiveInteger(env.CACHE_TTL_SECONDS, 3600),
-    CACHE_MAX_ITEMS: positiveInteger(env.CACHE_MAX_ITEMS, 1e3)
-  };
-}
-var parsedEnv = parseEnv(process.env);
-var config = {
-  ...parsedEnv,
-  isDevelopment: parsedEnv.NODE_ENV === "development",
-  isProduction: parsedEnv.NODE_ENV === "production",
-  isTest: parsedEnv.NODE_ENV === "test",
-  features: {
-    apiKey: parsedEnv.API_AUTH_MODE !== "disabled",
-    cache: parsedEnv.CACHE_ENABLED
-  },
-  cors: {
-    origin: parsedEnv.CORS_ORIGIN === "*" ? parsedEnv.CORS_ORIGIN : parsedEnv.CORS_ORIGIN.split(",").map((o) => o.trim()),
-    credentials: true
-  },
-  rateLimit: {
-    windowMs: parsedEnv.RATE_LIMIT_WINDOW_MS,
-    max: parsedEnv.RATE_LIMIT_MAX,
-    trustProxy: parsedEnv.TRUST_PROXY_HEADERS
-  },
-  requestLimits: {
-    maxBodySize: parsedEnv.MAX_REQUEST_BODY_SIZE,
-    maxConcurrent: parsedEnv.MAX_CONCURRENT_REQUESTS,
-    maxFileSize: parsedEnv.MAX_FILE_SIZE
-  },
-  outboundSources: {
-    mode: parsedEnv.OUTBOUND_SOURCE_MODE,
-    allowedHosts: parsedEnv.OUTBOUND_HOST_ALLOWLIST
-  },
-  cache: {
-    enabled: parsedEnv.CACHE_ENABLED,
-    maxSizeMB: parsedEnv.CACHE_MAX_SIZE_MB,
-    ttlSeconds: parsedEnv.CACHE_TTL_SECONDS,
-    maxItems: parsedEnv.CACHE_MAX_ITEMS
-  }
-};
-
-// src/server/middleware/hono/auth.ts
 function keysEqual(received, expected) {
   const receivedDigest = createHash("sha256").update(received).digest();
   const expectedDigest = createHash("sha256").update(expected).digest();