@meith/web 0.16.0

package/app/auth/resume/route.ts

@@ -0,0 +1,55 @@
+import { redirect } from 'next/navigation'
+import type { NextRequest } from 'next/server'
+
+import { logger } from '@meith/core'
+
+import { configuredSessions } from '@/server/container'
+import { tr } from '@/server/i18n'
+import { requestFingerprint } from '@/server/request-fingerprint'
+import { isSafeLocalPath } from '@/server/safe-path'
+import { isTopLevelNavigation } from '@/server/same-origin'
+import {
+  clearSessionCookies,
+  readRememberToken,
+  setRememberCookie,
+  setSessionCookie,
+} from '@/server/session-cookies'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+function safeNext(raw: string | null): string {
+  return raw !== null && isSafeLocalPath(raw) ? raw : '/'
+}
+
+export async function GET(request: NextRequest): Promise<Response> {
+  const next = safeNext(request.nextUrl.searchParams.get('next'))
+  const token = await readRememberToken()
+
+  if (!token) redirect(next)
+
+  if (!isTopLevelNavigation(request)) {
+    return new Response(await tr('authRoute.resume.topLevel'), {
+      status: 403,
+      headers: { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' },
+    })
+  }
+
+  const sessions = await configuredSessions()
+  const outcome = await sessions.resume(token, await requestFingerprint())
+
+  if (outcome.status === 'ok') {
+    await setSessionCookie(outcome.login.sessionToken, outcome.login.sessionExpiresAt)
+    await setRememberCookie(outcome.login.rememberToken, outcome.login.rememberExpiresAt)
+    redirect(next)
+  }
+
+  if (outcome.status === 'reuse') {
+    logger({ module: 'auth-resume' }).warn(
+      { userId: outcome.userId },
+      'remember-me token reuse detected; family revoked',
+    )
+  }
+  await clearSessionCookies()
+  redirect(next)
+}

package/app/auth/sso/[provider]/callback/route.ts

@@ -0,0 +1,173 @@
+import type { NextRequest } from 'next/server'
+
+import { isAppError, logger, RateLimitedError } from '@meith/core'
+
+import { refused, spendRegisterLimit } from '@/server/antispam'
+import { recordAuthEvent } from '@/server/auth-events'
+import { sendVerificationEmail } from '@/server/auth-mail'
+import { getContainer } from '@/server/container'
+import { getActor } from '@/server/context'
+import {
+  currentCredentialProof,
+  markCurrentSessionCredentialProved,
+} from '@/server/credential-proof'
+import {
+  callbackUrl,
+  federationProvider,
+  federationService,
+  memberManagedSignIns,
+} from '@/server/federation'
+import { getTranslator, tr } from '@/server/i18n'
+import { retainedIpPrefix } from '@/server/request-fingerprint'
+import { isTopLevelNavigation } from '@/server/same-origin'
+import {
+  clearHandshakeCookie,
+  readHandshakeCookie,
+  setSessionCookie,
+} from '@/server/session-cookies'
+import { decodeHandshake } from '@/server/sso-handshake'
+import { ssoOutcomeCode } from '@/view/sso-notices'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+function to(path: string): Response {
+  return new Response(null, {
+    status: 303,
+    headers: { location: path, 'cache-control': 'no-store' },
+  })
+}
+
+function withReason(path: string, reason: string): string {
+  return `${path}${path.includes('?') ? '&' : '?'}sso=${reason}`
+}
+
+export async function GET(
+  request: NextRequest,
+  context: { params: Promise<{ provider: string }> },
+): Promise<Response> {
+  if (!isTopLevelNavigation(request)) {
+    return new Response(await tr('authRoute.sso.completeTopLevel'), {
+      status: 403,
+      headers: {
+        'content-type': 'text/plain; charset=utf-8',
+        'cache-control': 'no-store',
+      },
+    })
+  }
+
+  const { provider: requested } = await context.params
+  const handshake = decodeHandshake(await readHandshakeCookie())
+  await clearHandshakeCookie()
+
+  const home = handshake?.mode === 'sign-in' ? '/login' : '/usercp/security'
+
+  if (handshake === null || handshake.provider !== requested) {
+    return to(withReason(home, 'expired'))
+  }
+
+  const query = request.nextUrl.searchParams
+
+  if (query.get('error') !== null) return to(withReason(home, 'refused'))
+
+  const state = query.get('state')
+  const code = query.get('code')
+
+  if (state === null || state !== handshake.state || code === null) {
+    return to(withReason(home, 'expired'))
+  }
+
+  const provider = await federationProvider(requested)
+  if (provider === null) return to(withReason(home, 'off'))
+
+  const log = logger({ module: 'sso' })
+
+  try {
+    const profile = await provider.exchange({
+      code,
+      redirectUri: await callbackUrl(provider.id),
+      nonce: handshake.nonce,
+      codeVerifier: handshake.codeVerifier,
+    })
+
+    const federation = await federationService()
+
+    if (handshake.mode === 'credential-proof') {
+      const actor = await getActor()
+      if (
+        actor.userId === null ||
+        handshake.userId !== actor.userId ||
+        handshake.sessionId === undefined
+      ) {
+        return to(withReason(home, 'expired'))
+      }
+      const identities = await getContainer().accountStore.identities.listForUser(actor.userId)
+      const identity = identities.find(
+        (candidate) => candidate.provider === provider.id && candidate.subject === profile.subject,
+      )
+      const sessionId = await import('@/server/session-actions').then((module) =>
+        module.currentSessionId(),
+      )
+      if (identity === undefined || sessionId !== handshake.sessionId) {
+        return to(withReason(home, 'mismatch'))
+      }
+      if (!(await markCurrentSessionCredentialProved(actor.userId))) {
+        return to(withReason(home, 'expired'))
+      }
+      return to('/usercp/security?verified=1')
+    }
+
+    if (handshake.mode === 'link') {
+      const actor = await getActor()
+      if (actor.userId === null) return to('/login?next=%2Fusercp%2Fsecurity')
+      if (!(await memberManagedSignIns())) return to(withReason(home, 'off'))
+      const proof = await currentCredentialProof(actor.userId)
+      if (
+        proof === null ||
+        handshake.userId !== actor.userId ||
+        handshake.sessionId !== proof.session.id ||
+        handshake.provedAt !== proof.provedAt.getTime()
+      ) {
+        return to('/usercp/security/verify?next=%2Fusercp%2Fsecurity')
+      }
+
+      await federation.linkToViewer({ userId: actor.userId, provider, profile })
+      await recordAuthEvent({ userId: actor.userId, kind: 'identity_linked' })
+      return to(withReason('/usercp/security', 'linked'))
+    }
+
+    const outcome = await federation.completeSignIn({
+      provider,
+      profile,
+      context: { ipPrefix: await retainedIpPrefix() },
+      beforeProvision: async () => {
+        const limited = await spendRegisterLimit()
+        if (refused(limited)) throw new RateLimitedError(limited.retryAfterSeconds)
+      },
+    })
+
+    if (outcome.status === 'pending') {
+      if (outcome.verificationToken === null) return to(withReason(home, 'approval'))
+
+      try {
+        await sendVerificationEmail({
+          token: outcome.verificationToken,
+          email: outcome.account.email,
+          username: outcome.account.username,
+          t: await getTranslator(),
+        })
+      } catch (err) {
+        log.error({ err }, 'could not send a verification e-mail after a federated sign-up')
+      }
+
+      return to(`/verify/resend?email=${encodeURIComponent(outcome.account.email)}&sent=1`)
+    }
+
+    await setSessionCookie(outcome.login.sessionToken, outcome.login.expiresAt)
+    await recordAuthEvent({ userId: outcome.account.id, kind: 'login' })
+    return to(handshake.next)
+  } catch (err) {
+    log.warn({ err, provider: requested }, 'federated sign-in did not complete')
+    return to(withReason(home, ssoOutcomeCode(isAppError(err) ? err.code : null)))
+  }
+}

package/app/auth/sso/[provider]/go/route.ts

@@ -0,0 +1,57 @@
+import type { NextRequest } from 'next/server'
+
+import { federationProvider } from '@/server/federation'
+import { getTranslator, tr } from '@/server/i18n'
+import { isTopLevelNavigation } from '@/server/same-origin'
+import { readHandshakeCookie } from '@/server/session-cookies'
+import { decodeHandshake } from '@/server/sso-handshake'
+import { handOffPage } from '@/view/sso-hand-off'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+function to(path: string): Response {
+  return new Response(null, {
+    status: 303,
+    headers: { location: path, 'cache-control': 'no-store' },
+  })
+}
+
+export async function GET(
+  request: NextRequest,
+  context: { params: Promise<{ provider: string }> },
+): Promise<Response> {
+  if (!isTopLevelNavigation(request)) {
+    return new Response(await tr('authRoute.sso.startTopLevel'), {
+      status: 403,
+      headers: { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' },
+    })
+  }
+
+  const { provider: requested } = await context.params
+  const handshake = decodeHandshake(await readHandshakeCookie())
+
+  if (handshake === null || handshake.provider !== requested) {
+    return to(handshake?.mode === 'link' ? '/usercp/security?sso=expired' : '/login?sso=expired')
+  }
+
+  const provider = await federationProvider(requested)
+  if (provider === null) {
+    return to(handshake.mode === 'link' ? '/usercp/security?sso=off' : '/login?sso=off')
+  }
+
+  return new Response(
+    handOffPage({
+      label: provider.label,
+      authorizationUrl: handshake.authorizationUrl,
+      t: await getTranslator(),
+    }),
+    {
+      status: 200,
+      headers: {
+        'content-type': 'text/html; charset=utf-8',
+        'cache-control': 'no-store',
+      },
+    },
+  )
+}

package/app/auth/sso/[provider]/route.ts

@@ -0,0 +1,105 @@
+import type { NextRequest } from 'next/server'
+
+import { newHandshake } from '@meith/accounts'
+import { logger } from '@meith/core'
+
+import { getActor } from '@/server/context'
+import { currentCredentialProof } from '@/server/credential-proof'
+import { callbackUrl, federationProvider, memberManagedSignIns } from '@/server/federation'
+import { isSafeLocalPath } from '@/server/safe-path'
+import { crossOriginRefusal, isSameOrigin } from '@/server/same-origin'
+import { setHandshakeCookie } from '@/server/session-cookies'
+import { encodeHandshake, type HandshakeMode } from '@/server/sso-handshake'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+function to(path: string): Response {
+  return new Response(null, {
+    status: 303,
+    headers: { location: path, 'cache-control': 'no-store' },
+  })
+}
+
+export async function POST(
+  request: NextRequest,
+  context: { params: Promise<{ provider: string }> },
+): Promise<Response> {
+  if (!isSameOrigin(request)) return crossOriginRefusal()
+
+  const { provider: requested } = await context.params
+
+  let form: FormData
+  try {
+    form = await request.formData()
+  } catch {
+    return crossOriginRefusal()
+  }
+
+  const requestedMode = form.get('mode')
+  const mode: HandshakeMode =
+    requestedMode === 'link' || requestedMode === 'credential-proof' ? requestedMode : 'sign-in'
+  const nextValue = form.get('next')
+  const next = typeof nextValue === 'string' && isSafeLocalPath(nextValue) ? nextValue : '/'
+
+  const failure = mode === 'link' ? '/usercp/security?sso=failed' : '/login?sso=failed'
+
+  const provider = await federationProvider(requested)
+  if (provider === null) {
+    return to(mode === 'link' ? '/usercp/security?sso=off' : '/login?sso=off')
+  }
+
+  let binding: { userId: number; sessionId: number; provedAt?: number } | undefined
+  if (mode !== 'sign-in') {
+    const actor = await getActor()
+    if (actor.userId === null) return to('/login?next=%2Fusercp%2Fsecurity')
+    if (!(await memberManagedSignIns())) return to('/usercp/security?sso=off')
+
+    if (mode === 'link') {
+      const proof = await currentCredentialProof(actor.userId)
+      if (proof === null) return to('/usercp/security/verify?next=%2Fusercp%2Fsecurity')
+      binding = {
+        userId: actor.userId,
+        sessionId: proof.session.id,
+        provedAt: proof.provedAt.getTime(),
+      }
+    } else {
+      const token = await import('@/server/session-actions').then((module) =>
+        module.currentSessionId(),
+      )
+      if (token === null) return to('/login?next=%2Fusercp%2Fsecurity')
+      binding = { userId: actor.userId, sessionId: token }
+    }
+  }
+
+  const handshake = newHandshake()
+
+  let authorizationUrl: string
+  try {
+    authorizationUrl = await provider.authorizationUrl({
+      redirectUri: await callbackUrl(provider.id),
+      state: handshake.state,
+      nonce: handshake.nonce,
+      codeVerifier: handshake.codeVerifier,
+    })
+  } catch (err) {
+    logger({ module: 'sso' }).error(
+      { err, provider: provider.id },
+      'could not build the authorization request',
+    )
+    return to(failure)
+  }
+
+  await setHandshakeCookie(
+    encodeHandshake({
+      provider: provider.id,
+      mode,
+      next,
+      authorizationUrl,
+      ...handshake,
+      ...binding,
+    }),
+  )
+
+  return to(`/auth/sso/${provider.id}/go`)
+}

package/app/avatar/[id]/route.ts

@@ -0,0 +1,31 @@
+import { drivers } from '@meith/drivers'
+
+import { resolveAvatar } from '@/server/avatars'
+import { getActor } from '@/server/context'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET(
+  _request: Request,
+  context: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  const { id } = await context.params
+  if (!/^[1-9]\d*$/.test(id)) return new Response('Not found', { status: 404 })
+
+  const actor = await getActor()
+  const grant = await resolveAvatar(actor, Number(id))
+  if (grant === null) return new Response('Not found', { status: 404 })
+
+  const bytes = await drivers().files.get(grant.key)
+  if (bytes === undefined) return new Response('Not found', { status: 404 })
+
+  return new Response(bytes as unknown as BodyInit, {
+    headers: {
+      'Content-Type': bytes[0] === 0xff ? 'image/jpeg' : 'image/png',
+      'Content-Length': String(bytes.byteLength),
+      'X-Content-Type-Options': 'nosniff',
+      'Content-Security-Policy': "default-src 'none'; sandbox",
+      'Cache-Control': 'private, max-age=3600',
+    },
+  })
+}

package/app/brand/icon-192.png/route.ts

@@ -0,0 +1,7 @@
+import { renderBrandMark } from '@/server/brand-mark'
+
+export const dynamic = 'force-dynamic'
+
+export function GET(): Promise<Response> {
+  return renderBrandMark(192)
+}

package/app/brand/icon-512.png/route.ts

@@ -0,0 +1,7 @@
+import { renderBrandMark } from '@/server/brand-mark'
+
+export const dynamic = 'force-dynamic'
+
+export function GET(): Promise<Response> {
+  return renderBrandMark(512)
+}

package/app/brand/icon-maskable.png/route.ts

@@ -0,0 +1,7 @@
+import { renderBrandMark } from '@/server/brand-mark'
+
+export const dynamic = 'force-dynamic'
+
+export function GET(): Promise<Response> {
+  return renderBrandMark(512, true)
+}

package/app/demo/stripe/[[...path]]/route.ts

@@ -0,0 +1,27 @@
+import type { NextRequest } from 'next/server'
+
+import { handleFakeStripe } from '@/server/demo-stripe'
+
+export const dynamic = 'force-dynamic'
+
+async function handle(
+  request: NextRequest,
+  params: Promise<{ path?: string[] }>,
+): Promise<Response> {
+  const { path } = await params
+  return handleFakeStripe(request, (path ?? []).join('/'))
+}
+
+export async function GET(
+  request: NextRequest,
+  context: { params: Promise<{ path?: string[] }> },
+): Promise<Response> {
+  return handle(request, context.params)
+}
+
+export async function POST(
+  request: NextRequest,
+  context: { params: Promise<{ path?: string[] }> },
+): Promise<Response> {
+  return handle(request, context.params)
+}

package/app/error.tsx

@@ -0,0 +1,15 @@
+'use client'
+
+import { CrashNotice } from '@/components/shell/crash-notice'
+
+export default function ErrorPage() {
+  return (
+    <main
+      id="board-content"
+      tabIndex={-1}
+      className="flex min-h-dvh items-center justify-center px-6 py-12"
+    >
+      <CrashNotice />
+    </main>
+  )
+}

package/app/feed.xml/route.ts

@@ -0,0 +1,7 @@
+import { boardFeed } from '@/server/feed-routes'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET(): Promise<Response> {
+  return boardFeed('rss', '/feed.xml')
+}

package/app/forumdisplay.php/page.tsx

@@ -0,0 +1,11 @@
+import { serveLegacyUrl } from '@/server/legacy-redirect'
+
+export const dynamic = 'force-dynamic'
+
+export default async function ForumDisplayPage({
+  searchParams,
+}: {
+  searchParams: Promise<Record<string, string | string[] | undefined>>
+}): Promise<never> {
+  return serveLegacyUrl('forumdisplay.php', await searchParams)
+}

package/app/group/[id]/badge/[scheme]/route.ts

@@ -0,0 +1,26 @@
+import { drivers } from '@meith/drivers'
+
+import { badgeKey } from '@/server/group-badge'
+import { imageHeaders, isImageScheme } from '@/server/image-upload'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET(
+  _request: Request,
+  context: { params: Promise<{ id: string; scheme: string }> },
+): Promise<Response> {
+  const { id, scheme } = await context.params
+  if (!/^[1-9]\d*$/.test(id) || !isImageScheme(scheme)) {
+    return new Response('Not found', { status: 404 })
+  }
+
+  const key = await badgeKey(Number(id), scheme)
+  if (key === null) return new Response('Not found', { status: 404 })
+
+  const bytes = await drivers().files.get(key)
+  if (bytes === undefined) return new Response('Not found', { status: 404 })
+
+  return new Response(bytes as unknown as BodyInit, {
+    headers: imageHeaders(key, bytes.byteLength),
+  })
+}

package/app/icon.ts

@@ -0,0 +1,13 @@
+import { buildFaviconSvg, loadBrandInfo } from '@/server/brand-assets'
+
+export const dynamic = 'force-dynamic'
+
+export const contentType = 'image/svg+xml'
+
+export default async function Icon(): Promise<Response> {
+  const info = await loadBrandInfo()
+
+  return new Response(buildFaviconSvg(info), {
+    headers: { 'Content-Type': 'image/svg+xml' },
+  })
+}