@lownoise-studio/rendershield 0.1.4 → 0.3.0

package/src/core/generateWorker.ts

@@ -1,80 +1,87 @@
-import { RenderShieldConfig } from "../types.js";
-
-function jsStringArray(arr: string[]): string {
-  return `[${arr.map((s) => JSON.stringify(s)).join(", ")}]`;
-}
-
-export function generateWorkerJs(cfg: RenderShieldConfig): string {
-  const patterns = cfg.worker.botUserAgentPatterns.map((p) => p.toLowerCase());
-  const rewriteBases = cfg.worker.rewriteRouteBases;
-
-  return `/**
- * RenderShield Worker (generated)
- * Serves prerendered /index.html to bots on selected route bases.
- */
-
-const BOT_SUBSTRINGS = ${jsStringArray(patterns)};
-const REWRITE_BASES = ${jsStringArray(rewriteBases)};
-
-function isBot(ua) {
-  const s = (ua || "").toLowerCase();
-  return BOT_SUBSTRINGS.some((sub) => s.includes(sub));
-}
-
-function shouldRewrite(pathname) {
-  return REWRITE_BASES.some((base) => pathname.startsWith(base));
-}
-
-function toIndexHtml(pathname) {
-  let p = pathname;
-  if (!p.endsWith("/")) p += "/";
-  return p + "index.html";
-}
-
-export default {
-  async fetch(request, env, ctx) {
-    const url = new URL(request.url);
-    const ua = request.headers.get("User-Agent") || "";
-    const bot = isBot(ua);
-
-    const isGetLike = request.method === "GET" || request.method === "HEAD";
-    const rewrite = bot && isGetLike && shouldRewrite(url.pathname);
-
-    try {
-      if (!rewrite) return fetch(request);
-
-      const origin = ${JSON.stringify(cfg.worker.lovableOrigin)};
-      const finalPath = toIndexHtml(url.pathname);
-      const originUrl = origin + finalPath + url.search;
-
-      const headers = new Headers();
-      headers.set("Accept", "text/html");
-      headers.set("User-Agent", ua);
-
-      const resp = await fetch(originUrl, { method: "GET", headers });
-
-      if (!resp.ok) {
-        const fallbackUrl = origin + url.pathname + url.search;
-        const fb = await fetch(fallbackUrl, { method: "GET", headers });
-        const out = new Response(fb.body, fb);
-        ${cfg.worker.debugHeaders ? `out.headers.set("X-Bot-Detected", "true");
-        out.headers.set("X-Prerender-Fallback", "true");
-        out.headers.set("X-Requested-Path", url.pathname);` : ""}
-        return out;
-      }
-
-      const out = new Response(resp.body, resp);
-      ${cfg.worker.debugHeaders ? `out.headers.set("X-Bot-Detected", "true");
-      out.headers.set("X-Prerender", "true");
-      out.headers.set("X-Final-Path", finalPath);` : ""}
-      return out;
-    } catch (err) {
-      return new Response("Worker error: " + (err && err.message ? err.message : String(err)), {
-        status: 500,
-        headers: { "Content-Type": "text/plain; charset=utf-8" }
-      });
-    }
-  }
-};
-`;
-}
+import { RenderShieldConfig } from "../types.js";
+
+function jsStringArray(arr: string[]): string {
+  return `[${arr.map((s) => JSON.stringify(s)).join(", ")}]`;
+}
+
+export function generateWorkerJs(cfg: RenderShieldConfig): string {
+  const patterns = cfg.worker.botUserAgentPatterns.map((p) => p.toLowerCase());
+  const rewriteBases = cfg.worker.rewriteRouteBases;
+
+  return `/**
+ * RenderShield Worker (generated)
+ * Serves prerendered /index.html to bots on selected route bases.
+ */
+
+const BOT_SUBSTRINGS = ${jsStringArray(patterns)};
+const REWRITE_BASES = ${jsStringArray(rewriteBases)};
+
+function isBot(ua) {
+  const s = (ua || "").toLowerCase();
+  return BOT_SUBSTRINGS.some((sub) => s.includes(sub));
+}
+
+function shouldRewrite(pathname) {
+  return REWRITE_BASES.some((base) => pathname.startsWith(base));
+}
+
+function toIndexHtml(pathname) {
+  let p = pathname;
+  if (!p.endsWith("/")) p += "/";
+  return p + "index.html";
+}
+
+export default {
+  async fetch(request, env, ctx) {
+    const url = new URL(request.url);
+    const ua = request.headers.get("User-Agent") || "";
+    const bot = isBot(ua);
+
+    const isGetLike = request.method === "GET" || request.method === "HEAD";
+    const rewrite = bot && isGetLike && shouldRewrite(url.pathname);
+
+    try {
+      if (!rewrite) {
+        const passResp = await fetch(request);
+        const out = new Response(passResp.body, passResp);
+        out.headers.set("x-rendershield", "pass-through");
+        return out;
+      }
+
+      const origin = ${JSON.stringify(cfg.worker.lovableOrigin)};
+      const finalPath = toIndexHtml(url.pathname);
+      const originUrl = origin + finalPath + url.search;
+
+      const headers = new Headers();
+      headers.set("Accept", "text/html");
+      headers.set("User-Agent", ua);
+
+      const resp = await fetch(originUrl, { method: "GET", headers });
+
+      if (!resp.ok) {
+        const fallbackUrl = origin + url.pathname + url.search;
+        const fb = await fetch(fallbackUrl, { method: "GET", headers });
+        const out = new Response(fb.body, fb);
+        out.headers.set("x-rendershield", "bot-fallback");
+        ${cfg.worker.debugHeaders ? `out.headers.set("X-Bot-Detected", "true");
+        out.headers.set("X-Prerender-Fallback", "true");
+        out.headers.set("X-Requested-Path", url.pathname);` : ""}
+        return out;
+      }
+
+      const out = new Response(resp.body, resp);
+      out.headers.set("x-rendershield", "bot-hit");
+      ${cfg.worker.debugHeaders ? `out.headers.set("X-Bot-Detected", "true");
+      out.headers.set("X-Prerender", "true");
+      out.headers.set("X-Final-Path", finalPath);` : ""}
+      return out;
+    } catch (err) {
+      return new Response("Worker error: " + (err && err.message ? err.message : String(err)), {
+        status: 500,
+        headers: { "Content-Type": "text/plain; charset=utf-8" }
+      });
+    }
+  }
+};
+`;
+}

package/src/core/loadConfig.ts

@@ -1,74 +1,142 @@
-import fs from "fs-extra";
-import path from "node:path";
-import { RenderShieldConfig } from "../types.js";
-
-const CONFIG_NAME = "rendershield.config.json";
-
-type BoolFlag = { enabled: boolean };
-
-function isObject(v: unknown): v is Record<string, unknown> {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-
-function coerceBoolFlag(
-  parsed: any,
-  key: "sitemap" | "robots" | "worker",
-  defaultEnabled: boolean
-): BoolFlag {
-  // If missing, provide defaults (keeps older configs from exploding)
-  if (parsed?.[key] == null) return { enabled: defaultEnabled };
-
-  // If present, validate shape
-  const v = parsed[key];
-  if (!isObject(v)) {
-    throw new Error(`${key} must be an object like { "enabled": true }`);
-  }
-  if (typeof (v as any).enabled !== "boolean") {
-    throw new Error(`${key}.enabled must be a boolean`);
-  }
-  return { enabled: (v as any).enabled };
-}
-
-export async function loadConfig(
-  cwd = process.cwd()
-): Promise<RenderShieldConfig> {
-  const p = path.join(cwd, CONFIG_NAME);
-  const exists = await fs.pathExists(p);
-  if (!exists) {
-    throw new Error(`Missing ${CONFIG_NAME}. Run: rendershield init`);
-  }
-
-  const raw = await fs.readFile(p, "utf8");
-  let parsed: any;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error(`${CONFIG_NAME} is not valid JSON`);
-  }
-
-  // Minimal validation (v0)
-  if (parsed?.version !== 1) throw new Error(`Config version must be 1`);
-  if (!parsed?.site?.canonicalBase)
-    throw new Error(`site.canonicalBase is required`);
-  if (!parsed?.site?.siteName) throw new Error(`site.siteName is required`);
-  if (!parsed?.site?.defaultOgImage)
-    throw new Error(`site.defaultOgImage is required`);
-  if (!parsed?.site?.authorName)
-    throw new Error(`site.authorName is required`);
-  if (!parsed?.content?.markdown?.baseDir)
-    throw new Error(`content.markdown.baseDir is required`);
-  if (
-    !Array.isArray(parsed?.content?.markdown?.collections) ||
-    parsed.content.markdown.collections.length === 0
-  ) {
-    throw new Error(`content.markdown.collections must be a non-empty array`);
-  }
-  if (!parsed?.output?.outDir) throw new Error(`output.outDir is required`);
-
-  // Validate + default these optional sections to prevent TypeErrors later
-  parsed.sitemap = coerceBoolFlag(parsed, "sitemap", true);
-  parsed.robots = coerceBoolFlag(parsed, "robots", true);
-  parsed.worker = coerceBoolFlag(parsed, "worker", true);
-
-  return parsed as RenderShieldConfig;
-}
+import fs from "fs-extra";
+import path from "node:path";
+import { RenderShieldConfig } from "../types.js";
+
+const CONFIG_NAME = "rendershield.config.json";
+
+type BoolFlag = { enabled: boolean };
+
+function isObject(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+function coerceBoolFlag(
+  parsed: any,
+  key: "sitemap" | "robots" | "worker",
+  defaultEnabled: boolean
+): BoolFlag {
+  // If missing, provide defaults (keeps older configs from exploding)
+  if (parsed?.[key] == null) return { enabled: defaultEnabled };
+
+  // If present, validate shape
+  const v = parsed[key];
+  if (!isObject(v)) {
+    throw new Error(`${key} must be an object like { "enabled": true }`);
+  }
+  if (typeof (v as any).enabled !== "boolean") {
+    throw new Error(`${key}.enabled must be a boolean`);
+  }
+  return { enabled: (v as any).enabled };
+}
+
+/**
+ * Worker config policy: strict mode.
+ * When worker.enabled is true, all of lovableOrigin, rewriteRouteBases, and
+ * botUserAgentPatterns are required and must be non-empty. No defaults are
+ * supplied — build fails with a crisp error.
+ * lovableOrigin: must be http: or https: only (no file:, javascript:, protocol-relative).
+ * botUserAgentPatterns: substring match only (not regex); empty strings rejected to avoid overmatching.
+ */
+function validateWorkerWhenEnabled(parsed: any): void {
+  if (!parsed.worker?.lovableOrigin || typeof parsed.worker.lovableOrigin !== "string") {
+    throw new Error(
+      `worker.lovableOrigin is required when worker.enabled is true. Example: "https://your-site.lovable.app"`
+    );
+  }
+  let url: URL;
+  try {
+    url = new URL(parsed.worker.lovableOrigin);
+  } catch {
+    throw new Error(
+      `worker.lovableOrigin must be a valid URL. Got: "${parsed.worker.lovableOrigin}"`
+    );
+  }
+  const scheme = url.protocol.toLowerCase();
+  if (scheme !== "http:" && scheme !== "https:") {
+    throw new Error(
+      `worker.lovableOrigin must use http or https. Got: "${url.protocol}"`
+    );
+  }
+  if (
+    !Array.isArray(parsed.worker?.rewriteRouteBases) ||
+    parsed.worker.rewriteRouteBases.length === 0
+  ) {
+    throw new Error(
+      `worker.rewriteRouteBases must be a non-empty array when worker.enabled is true. Example: ["/blog/"]`
+    );
+  }
+  if (
+    !Array.isArray(parsed.worker?.botUserAgentPatterns) ||
+    parsed.worker.botUserAgentPatterns.length === 0
+  ) {
+    throw new Error(
+      `worker.botUserAgentPatterns must be a non-empty array when worker.enabled is true. Example: ["googlebot", "bingbot"]`
+    );
+  }
+  // Substring match only; empty string would match every User-Agent
+  for (let i = 0; i < parsed.worker.botUserAgentPatterns.length; i++) {
+    const p = parsed.worker.botUserAgentPatterns[i];
+    if (typeof p !== "string" || p.trim() === "") {
+      throw new Error(
+        `worker.botUserAgentPatterns[${i}] must be a non-empty string (substring match). Empty or invalid entry would overmatch.`
+      );
+    }
+  }
+}
+
+export async function loadConfig(
+  cwd = process.cwd()
+): Promise<RenderShieldConfig> {
+  const p = path.join(cwd, CONFIG_NAME);
+  const exists = await fs.pathExists(p);
+  if (!exists) {
+    throw new Error(`Missing ${CONFIG_NAME}. Run: rendershield init`);
+  }
+
+  const raw = await fs.readFile(p, "utf8");
+  let parsed: any;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`${CONFIG_NAME} is not valid JSON`);
+  }
+
+  // Minimal validation (v0)
+  if (parsed?.version !== 1) throw new Error(`Config version must be 1`);
+  if (!parsed?.site?.canonicalBase)
+    throw new Error(`site.canonicalBase is required`);
+  if (!parsed?.site?.siteName) throw new Error(`site.siteName is required`);
+  if (!parsed?.site?.defaultOgImage)
+    throw new Error(`site.defaultOgImage is required`);
+  if (!parsed?.site?.authorName)
+    throw new Error(`site.authorName is required`);
+  if (!parsed?.content?.markdown?.baseDir)
+    throw new Error(`content.markdown.baseDir is required`);
+  if (
+    !Array.isArray(parsed?.content?.markdown?.collections) ||
+    parsed.content.markdown.collections.length === 0
+  ) {
+    throw new Error(`content.markdown.collections must be a non-empty array`);
+  }
+  if (!parsed?.output?.outDir) throw new Error(`output.outDir is required`);
+
+  // Validate + default these optional sections to prevent TypeErrors later
+  parsed.sitemap = coerceBoolFlag(parsed, "sitemap", true);
+  parsed.robots = coerceBoolFlag(parsed, "robots", true);
+  const workerFlag = coerceBoolFlag(parsed, "worker", true);
+  parsed.worker = workerFlag;
+
+  if (parsed.worker.enabled) {
+    validateWorkerWhenEnabled(parsed);
+  } else {
+    parsed.worker = {
+      enabled: false,
+      lovableOrigin: "",
+      rewriteRouteBases: [],
+      botUserAgentPatterns: [],
+      debugHeaders: false,
+    };
+  }
+
+  return parsed as RenderShieldConfig;
+}