@leadertechie/personal-site-kit 0.1.0-alpha.6 → 0.1.0-alpha.8

package/src/api/handlers/about-me.ts

@@ -66,24 +66,34 @@ export async function handleAboutMe(env?: any): Promise<Response> {
     }
     console.log('handleAboutMe: r2 created, fetching data');
 
-    const [profileObj, astResult] = await Promise.all([
+    const [profileObj, rendered] = await Promise.all([
       r2.getObject('profile.json'),
-      r2.getWithAST('about-me.md')
+      r2.getRendered('about-me.md')
     ]);
 
-    console.log('handleAboutMe: profileObj =', !!profileObj, 'astResult =', !!astResult);
-
-    if (!profileObj || !astResult) {
-      throw new Error('Content not found in R2');
+    if (!rendered) {
+      return new Response(JSON.stringify({ error: 'About-me content not found. Please run seed.' }), {
+        status: 404,
+        headers: { 'Content-Type': 'application/json' },
+      });
     }
 
-    const profile = await profileObj.json() as Profile;
+    let profile: Profile = {
+      name: 'Your Name',
+      title: 'Professional',
+      experience: 'Experienced',
+      profileImageUrl: ''
+    };
+
+    if (profileObj) {
+      profile = await profileObj.json() as Profile;
+    }
     console.log('handleAboutMe: profile loaded:', profile.name);
 
     const responseData: AboutMeApiResponse = {
       profile,
-      contentNodes: astResult.contentNodes,
-      processedMarkdown: ''
+      contentNodes: [],
+      processedMarkdown: rendered.content
     };
 
     return new Response(JSON.stringify(responseData), {

package/src/api/handlers/auth-handler.ts

@@ -10,18 +10,25 @@ import {
   MAX_ATTEMPTS
 } from './auth';
 
-function createSessionCookie(token: string, secure: boolean): string {
+function createSessionCookie(token: string, origin: string): string {
   const expires = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toUTCString();
-  const SameSite = secure ? 'Strict' : 'Lax';
-  return `session=${token}; HttpOnly; Secure; SameSite=${SameSite}; Path=/; Expires=${expires}`;
+  const isSecure = origin.startsWith('https://');
+  const hostname = new URL(origin).hostname;
+  const SameSite = isSecure ? 'Strict' : 'Lax';
+  
+  let cookie = `session=${token}; HttpOnly; SameSite=${SameSite}; Path=/; Expires=${expires}`;
+  if (isSecure) {
+    cookie += '; Secure';
+  }
+  cookie += `; Domain=${hostname}`;
+  return cookie;
 }
 
 export async function handleAuth(request: Request, env: any, subpath: string): Promise<Response> {
   const method = request.method;
   const clientIP = getClientIP(request);
   const path = subpath.replace(/^\//, '').split('/')[0];
-  const url = new URL(request.url);
-  const isSecure = url.protocol === 'https:';
+  const origin = request.headers.get('Origin') || new URL(request.url).origin;
 
   // Check rate limit for login attempts
   const rateCheck = await checkRateLimit(env, clientIP);
@@ -40,11 +47,11 @@ export async function handleAuth(request: Request, env: any, subpath: string): P
 
   switch (path) {
     case 'setup':
-      return handleSetup(request, env, clientIP, isSecure);
+      return handleSetup(request, env, clientIP, origin);
     case 'status':
       return handleStatus(env);
     case 'login':
-      return handleLogin(request, env, clientIP, isSecure);
+      return handleLogin(request, env, clientIP, origin);
     case 'logout':
       return handleLogout(request, env);
     default:
@@ -52,19 +59,22 @@ export async function handleAuth(request: Request, env: any, subpath: string): P
   }
 }
 
-async function handleSetup(request: Request, env: any, clientIP: string, isSecure: boolean): Promise<Response> {
+async function handleSetup(request: Request, env: any, clientIP: string, origin: string): Promise<Response> {
+  console.log('handleSetup: starting setup, env.KV exists:', !!env.KV);
   if (request.method !== 'POST') {
     return createErrorResponse('Method not allowed', 405);
   }
 
-  const existing = await getAuthStore(env);
-  if (existing) {
-    return createErrorResponse('Admin already configured. Use /auth/login to login.', 400);
-  }
-
   try {
+    const existing = await getAuthStore(env);
+    console.log('handleSetup: existing store check:', !!existing);
+    if (existing) {
+      return createErrorResponse('Admin already configured. Use /auth/login to login.', 400);
+    }
+
     const body = await request.json();
     const { username, password } = body;
+    console.log('handleSetup: body parsed, username:', username);
 
     if (!username || !password) {
       return createErrorResponse('Username and password required', 400);
@@ -74,18 +84,23 @@ async function handleSetup(request: Request, env: any, clientIP: string, isSecur
       return createErrorResponse('Username must be 3+ chars, password must be 8+ chars', 400);
     }
 
+    console.log('handleSetup: calling setupAuth');
     await setupAuth(env, username, password);
+    console.log('handleSetup: setupAuth successful');
     await clearRateLimit(env, clientIP);
 
     const token = crypto.randomUUID();
+    console.log('handleSetup: session token generated');
     await env.KV.put(`session:${token}`, JSON.stringify({
       createdAt: Date.now(),
       expiresAt: Date.now() + (7 * 24 * 60 * 60 * 1000)
     }), { expirationTtl: 7 * 24 * 60 * 60 });
+    console.log('handleSetup: session stored in KV');
 
     const headers: Record<string, string> = {
       'Content-Type': 'application/json',
-      'Set-Cookie': createSessionCookie(token, isSecure)
+      'Set-Cookie': createSessionCookie(token, origin),
+      'X-Session-Token': token
     };
 
     return new Response(JSON.stringify({ 
@@ -96,7 +111,8 @@ async function handleSetup(request: Request, env: any, clientIP: string, isSecur
       headers
     });
   } catch (e) {
-    return createErrorResponse('Invalid request body', 400);
+    console.error('handleSetup: error occurred:', e);
+    return createErrorResponse('Internal server error: ' + (e as Error).message, 500);
   }
 }
 
@@ -109,7 +125,7 @@ async function handleStatus(env: any): Promise<Response> {
   });
 }
 
-async function handleLogin(request: Request, env: any, clientIP: string, isSecure: boolean): Promise<Response> {
+async function handleLogin(request: Request, env: any, clientIP: string, origin: string): Promise<Response> {
   if (request.method !== 'POST') {
     return createErrorResponse('Method not allowed', 405);
   }
@@ -138,7 +154,8 @@ async function handleLogin(request: Request, env: any, clientIP: string, isSecur
 
       const headers: Record<string, string> = {
         'Content-Type': 'application/json',
-        'Set-Cookie': createSessionCookie(token, isSecure)
+        'Set-Cookie': createSessionCookie(token, origin),
+        'X-Session-Token': token
       };
 
       return new Response(JSON.stringify({ 
@@ -162,6 +179,7 @@ async function handleLogout(request: Request, env: any): Promise<Response> {
     return createErrorResponse('Method not allowed', 405);
   }
 
+  const origin = request.headers.get('Origin') || new URL(request.url).origin;
   const cookieHeader = request.headers.get('Cookie');
   const sessionToken = cookieHeader?.split(';')
     .find(c => c.trim().startsWith('session='))
@@ -171,11 +189,16 @@ async function handleLogout(request: Request, env: any): Promise<Response> {
     await env.KV.delete(`session:${sessionToken}`);
   }
 
+  const hostname = new URL(origin).hostname;
+  const isSecure = origin.startsWith('https://');
+  const SameSite = isSecure ? 'Strict' : 'Lax';
+  const logoutCookie = `session=; HttpOnly; SameSite=${SameSite}; Path=/; Max-Age=0; Domain=${hostname}${isSecure ? '; Secure' : ''}`;
+
   return new Response(JSON.stringify({ success: true, message: 'Logged out' }), {
     status: 200,
     headers: {
       'Content-Type': 'application/json',
-      'Set-Cookie': 'session=; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=0'
+      'Set-Cookie': logoutCookie
     }
   });
 }

package/src/api/handlers/content.ts

@@ -48,7 +48,7 @@ export async function handleContent(request: Request, env: any, subpath: string)
     return createErrorResponse('Admin not configured. Use POST /auth/setup to configure.', 401);
   }
 
-  const sessionToken = getSessionToken(request);
+  const sessionToken = getSessionToken(request) || request.headers.get('X-Session-Token');
   let isAuthenticated = false;
   
   if (sessionToken) {

package/src/api/handlers/home.ts

@@ -46,8 +46,8 @@ export async function handleHome(env?: any): Promise<Response> {
 
     const r2 = getLoader(env);
     const [astResult, renderedResult] = await Promise.all([
-      r2.getWithAST('home.md'),
-      r2.getRendered('home.md')
+      r2.getWithAST('pages/home.md'),
+      r2.getRendered('pages/home.md')
     ]);
 
     if (!astResult || !renderedResult) {

package/src/api/website-api.ts

@@ -21,25 +21,32 @@ export class WebsiteAPI {
   private addCORSHeaders(response: Response): Response {
     response.headers.set('Access-Control-Allow-Origin', '*' );
     response.headers.set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS' );
-    response.headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+    response.headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Session-Token');
     return response;
   }
 
-  private addAdminCORSHeaders(response: Response): Response {
-    response.headers.set('Access-Control-Allow-Origin', 'same-origin');
+  private addAdminCORSHeaders(response: Response, origin: string): Response {
+    const allowOrigin = origin && (origin.includes('localhost') || origin.includes('127.0.0.1')) 
+      ? origin 
+      : 'same-origin';
+    response.headers.set('Access-Control-Allow-Origin', allowOrigin);
     response.headers.set('Access-Control-Allow-Credentials', 'true');
     response.headers.set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-    response.headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+    response.headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Session-Token');
     return response;
   }
 
-  private handleCORS(): Response {
+  private handleCORS(origin: string): Response {
+    const allowOrigin = origin && (origin.includes('localhost') || origin.includes('127.0.0.1')) 
+      ? origin 
+      : '*';
     return new Response(null, {
       status: 200,
       headers: {
-        'Access-Control-Allow-Origin': '*' ,
+        'Access-Control-Allow-Origin': allowOrigin ,
         'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS' ,
-        'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+        'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Session-Token',
+        'Access-Control-Allow-Credentials': 'true',
         'Access-Control-Max-Age': '86400',
       },
     });
@@ -47,9 +54,10 @@ export class WebsiteAPI {
 
   public async fetch(request: Request, env: any): Promise<Response> {
     const url = new URL(request.url);
+    const origin = request.headers.get('Origin') || url.origin;
 
     if (request.method === 'OPTIONS') {
-      return this.handleCORS();
+      return this.handleCORS(origin);
     }
 
     const pathname = url.pathname;
@@ -68,7 +76,13 @@ export class WebsiteAPI {
       // Check for content route first (content/*)
       if (route === 'content' || route.startsWith('content/')) {
         const subpath = route.replace(/^content\/?/, '');
-        return this.addAdminCORSHeaders(await handleContent(request, env, subpath));
+        return this.addAdminCORSHeaders(await handleContent(request, env, subpath), origin);
+      }
+
+      // Check for auth route (auth/*)
+      if (route === 'auth' || route.startsWith('auth/')) {
+        const subpath = route.replace(/^auth\/?/, '');
+        return this.addAdminCORSHeaders(await handleAuth(request, env, subpath || '/'), origin);
       }
 
       switch (route) {
@@ -83,18 +97,16 @@ export class WebsiteAPI {
             ?.split('=')[1];
           const session = sessionToken ? await env.KV.get(`session:${sessionToken}`, 'json') : null;
           if (!session || session.expiresAt < Date.now()) {
-            return this.addAdminCORSHeaders(createErrorResponse('Unauthorized', 401));
+            return this.addAdminCORSHeaders(createErrorResponse('Unauthorized', 401), origin);
           }
           clearContentCache();
-          return this.addAdminCORSHeaders(new Response(JSON.stringify({ success: true, message: 'Cache cleared' }), { status: 200 }));
+          return this.addAdminCORSHeaders(new Response(JSON.stringify({ success: true, message: 'Cache cleared' }), { status: 200 }), origin);
         case 'aboutme':
           return this.addCORSHeaders(await handleAboutMe(env));
         case 'logo':
           return this.addCORSHeaders(await handleLogo(env));
         case 'static':
           return this.addCORSHeaders(await handleStaticDetails(env));
-        case 'auth':
-          return this.addAdminCORSHeaders(await handleAuth(request, env, '/auth'));
         case 'blogs':
           return this.addCORSHeaders(await handleBlogs(env));
         case 'blogs/latest':

package/src/prerender/__tests__/page-content.test.ts

@@ -7,25 +7,15 @@ describe('generatePageContent', () => {
     { link: '/about-me', text: 'About' }
   ];
   const mockFooterLinks = [
-    { text: 'Link', href: '#' }
+    { text: 'Link', link: '#' }
   ];
   const mockEnv = {
-    CONTENT_BUCKET: {
-      get: vi.fn().mockResolvedValue({
-        json: () => Promise.resolve({ name: 'User', title: 'Professional', experience: 'some' })
-      }),
-      list: vi.fn().mockResolvedValue({ objects: [] })
-    },
     apiUrl: 'https://api.example.com',
     baseUrl: 'https://www.example.com'
   };
 
   beforeEach(() => {
     vi.clearAllMocks();
-    global.fetch = vi.fn().mockResolvedValue({
-      ok: true,
-      json: () => Promise.resolve({ siteTitle: 'My Site', copyright: '2026' })
-    });
   });
 
   it('should generate home page content', async () => {

package/src/prerender/data-fetcher.ts

@@ -0,0 +1,93 @@
+import { R2ContentLoader } from "@leadertechie/r2tohtml";
+
+export interface Profile {
+  name: string;
+  title: string;
+  experience: string;
+  profileImageUrl: string;
+}
+
+export interface BlogMeta {
+  slug: string;
+  title: string;
+  summary: string;
+  tags: string[];
+  date: string;
+}
+
+let loader: R2ContentLoader | null = null;
+
+function getLoader(env: any): R2ContentLoader | null {
+  if (!loader) {
+    if (!env?.CONTENT_BUCKET) return null;
+    loader = new R2ContentLoader(
+      { bucket: env.CONTENT_BUCKET, cacheTTL: 5 * 60 * 1000 },
+      { md2html: { imagePathPrefix: "images/", styleOptions: { classPrefix: "md-", addHeadingIds: true } } }
+    );
+  }
+  return loader;
+}
+
+export async function fetchProfile(env: any): Promise<Profile | null> {
+  try {
+    const r2 = getLoader(env);
+    if (!r2) return null;
+    const obj = await r2.getObject("profile.json");
+    if (!obj) return null;
+    return await obj.json() as Profile;
+  } catch { return null; }
+}
+
+export async function fetchAboutMe(env: any): Promise<string> {
+  try {
+    const r2 = getLoader(env);
+    if (!r2) return "";
+    const result = await r2.getRendered("about-me.md");
+    return result?.content || "";
+  } catch { return ""; }
+}
+
+export async function fetchHome(env: any): Promise<string> {
+  try {
+    const r2 = getLoader(env);
+    if (!r2) return "";
+    const result = await r2.getRendered("pages/home.md");
+    return result?.content || "";
+  } catch { return ""; }
+}
+
+export async function fetchLatestBlogSummaries(env: any, count: number = 3): Promise<BlogMeta[]> {
+  try {
+    const r2 = getLoader(env);
+    if (!r2) return [];
+    const list = await r2.list("blogs/");
+    const metas: BlogMeta[] = [];
+    for (const obj of list.objects) {
+      if (obj.key.endsWith(".json")) {
+        try {
+          const metaObj = await r2.getObject(obj.key);
+          if (metaObj) metas.push(await metaObj.json() as BlogMeta);
+        } catch {}
+      }
+    }
+    return metas.sort((a, b) => new Date(b.date).getTime() - new Date(a.date).getTime()).slice(0, count);
+  } catch { return []; }
+}
+
+export async function fetchLatestStorySummaries(env: any, count: number = 3): Promise<BlogMeta[]> {
+  try {
+    const r2 = getLoader(env);
+    if (!r2) return [];
+    const list = await r2.list("stories/");
+    const metas: BlogMeta[] = [];
+    for (const obj of list.objects) {
+      if (obj.key.endsWith(".json")) {
+        try {
+          const metaObj = await r2.getObject(obj.key);
+          if (metaObj) metas.push(await metaObj.json() as BlogMeta);
+        } catch {}
+      }
+    }
+    return metas.sort((a, b) => new Date(b.date).getTime() - new Date(a.date).getTime()).slice(0, count);
+  } catch { return []; }
+}