@meith/web 0.16.0

package/src/server/cookies.ts

@@ -0,0 +1,139 @@
+export const SESSION_COOKIE = '__Host-fs_session'
+export const REMEMBER_COOKIE = '__Host-fs_remember'
+export const DEV_SESSION_COOKIE = 'fs_session'
+export const DEV_REMEMBER_COOKIE = 'fs_remember'
+
+/**
+ * Counts one reader once, and carries nothing else.
+ *
+ * An opaque random value, first-party, readable by nobody but this board. It
+ * exists because "37 guests reading" is not derivable from a stateless request:
+ * without something that comes back, every page view is a stranger. It is never
+ * an identity — no code path turns it into an actor, and `locateSession()`
+ * refuses a row with no user — so the worst it can say about the person holding
+ * it is that they were here.
+ */
+export const GUEST_COOKIE = '__Host-fs_guest'
+export const DEV_GUEST_COOKIE = 'fs_guest'
+
+/** Long enough that a reader is one guest across a visit, short enough to expire. */
+export const GUEST_COOKIE_DAYS = 1
+
+export const ADMIN_COOKIE = 'fs_admin'
+export const ADMIN_COOKIE_PATH = '/admin'
+
+export const SSO_COOKIE = '__Host-fs_sso'
+export const DEV_SSO_COOKIE = 'fs_sso'
+
+export const PASSKEY_COOKIE = '__Host-fs_passkey'
+export const DEV_PASSKEY_COOKIE = 'fs_passkey'
+
+export const SECOND_FACTOR_COOKIE = '__Host-fs_2fa'
+export const DEV_SECOND_FACTOR_COOKIE = 'fs_2fa'
+
+/** Long enough to read a consent screen, short enough that a stale one is gone. */
+export const HANDSHAKE_MINUTES = 10
+
+export function sessionCookieName(secure: boolean): string {
+  return secure ? SESSION_COOKIE : DEV_SESSION_COOKIE
+}
+
+export function rememberCookieName(secure: boolean): string {
+  return secure ? REMEMBER_COOKIE : DEV_REMEMBER_COOKIE
+}
+
+export function guestCookieName(secure: boolean): string {
+  return secure ? GUEST_COOKIE : DEV_GUEST_COOKIE
+}
+
+export interface CookieAttrs {
+  readonly httpOnly: boolean
+  readonly secure: boolean
+  readonly sameSite: 'lax' | 'strict' | 'none'
+  readonly path: string
+  readonly expires?: Date
+  readonly maxAge?: number
+}
+
+function base(secure: boolean): Omit<CookieAttrs, 'expires'> {
+  return { httpOnly: true, secure, sameSite: 'lax', path: '/' }
+}
+
+export function sessionCookie(expires: Date, secure: boolean): CookieAttrs {
+  return { ...base(secure), expires }
+}
+
+export function rememberCookie(expires: Date, secure: boolean): CookieAttrs {
+  return { ...base(secure), expires }
+}
+
+export function guestCookie(expires: Date, secure: boolean): CookieAttrs {
+  return { ...base(secure), expires }
+}
+
+export function adminCookie(expires: Date, secure: boolean): CookieAttrs {
+  return {
+    httpOnly: true,
+    secure,
+    sameSite: 'strict',
+    path: ADMIN_COOKIE_PATH,
+    expires,
+  }
+}
+
+export function clearedAdminCookie(secure: boolean): CookieAttrs {
+  return {
+    httpOnly: true,
+    secure,
+    sameSite: 'strict',
+    path: ADMIN_COOKIE_PATH,
+    expires: new Date(0),
+    maxAge: 0,
+  }
+}
+
+export function clearedCookie(secure: boolean): CookieAttrs {
+  return { ...base(secure), expires: new Date(0), maxAge: 0 }
+}
+
+export function ssoCookieName(secure: boolean): string {
+  return secure ? SSO_COOKIE : DEV_SSO_COOKIE
+}
+
+export function passkeyCookieName(secure: boolean): string {
+  return secure ? PASSKEY_COOKIE : DEV_PASSKEY_COOKIE
+}
+
+export function secondFactorCookieName(secure: boolean): string {
+  return secure ? SECOND_FACTOR_COOKIE : DEV_SECOND_FACTOR_COOKIE
+}
+
+/**
+ * A sign-in that has proved its password and nothing else. Strict, because
+ * every step that finishes it starts on this board — and short, because it
+ * stands in for a password already given.
+ */
+export function secondFactorCookie(expires: Date, secure: boolean): CookieAttrs {
+  return { httpOnly: true, secure, sameSite: 'strict', path: '/', expires }
+}
+
+/**
+ * Lax, not Strict: the identity provider sends the member back with a top-level
+ * GET, and a Strict cookie is not attached to a navigation that started on
+ * another site — the handshake would arrive with nothing to check the state
+ * against and every sign-in would fail.
+ */
+export function ssoCookie(secure: boolean): CookieAttrs {
+  return { ...base(secure), maxAge: HANDSHAKE_MINUTES * 60 }
+}
+
+/** Strict: nothing in the passkey exchange ever leaves this board. */
+export function passkeyCookie(secure: boolean): CookieAttrs {
+  return {
+    httpOnly: true,
+    secure,
+    sameSite: 'strict',
+    path: '/',
+    maxAge: HANDSHAKE_MINUTES * 60,
+  }
+}

package/src/server/credential-proof-actions.ts

@@ -0,0 +1,42 @@
+'use server'
+
+import { redirect } from 'next/navigation'
+
+import { verifyPassword } from '@meith/accounts'
+
+import type { FormState } from './auth-form-state'
+import { getContainer } from './container'
+import { getActor } from './context'
+import { markCurrentSessionCredentialProved } from './credential-proof'
+import { text } from './form-values'
+import { tr } from './i18n'
+import { isSafeLocalPath } from './safe-path'
+import { twoFactorService } from './two-factor'
+
+export async function proveCredentialAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const actor = await getActor()
+  if (actor.userId === null) return { error: await tr('credentialProof.signIn') }
+
+  const method = text(form, 'method')
+  let proved = false
+
+  if (method === 'password') {
+    const account = await getContainer().accountStore.accounts.findById(actor.userId)
+    proved = await verifyPassword(text(form, 'password'), account?.passwordHash)
+  } else if (method === 'code') {
+    const service = twoFactorService()
+    const outcome =
+      service === null
+        ? null
+        : await service.verify({ userId: actor.userId, code: text(form, 'code') })
+    proved = outcome?.status === 'ok'
+  }
+
+  if (!proved) return { error: await tr('credentialProof.incorrect') }
+  if (!(await markCurrentSessionCredentialProved(actor.userId))) {
+    return { error: await tr('credentialProof.expired') }
+  }
+
+  const next = text(form, 'next')
+  redirect(isSafeLocalPath(next) ? next : '/usercp/security?verified=1')
+}

package/src/server/credential-proof.ts

@@ -0,0 +1,35 @@
+import 'server-only'
+
+import { hasFreshCredentialProof, hashToken, type SessionRecord } from '@meith/accounts'
+
+import { getContainer } from './container'
+import { readSessionToken } from './session-cookies'
+
+export interface CurrentCredentialProof {
+  readonly session: SessionRecord
+  readonly provedAt: Date
+}
+
+export async function currentCredentialProof(
+  userId: number,
+  now = new Date(),
+): Promise<CurrentCredentialProof | null> {
+  const session = await currentSessionRecord()
+  if (session === null || !hasFreshCredentialProof(session, userId, now)) return null
+  return { session, provedAt: session.credentialProvedAt! }
+}
+
+export async function markCurrentSessionCredentialProved(
+  userId: number,
+  at = new Date(),
+): Promise<boolean> {
+  const session = await currentSessionRecord()
+  if (session === null || session.userId !== userId) return false
+  return getContainer().accountStore.sessions.markCredentialProved(session.id, userId, at)
+}
+
+async function currentSessionRecord(): Promise<SessionRecord | null> {
+  const token = await readSessionToken()
+  if (token === undefined || token === '') return null
+  return getContainer().accountStore.sessions.findByTokenHash(await hashToken(token))
+}

package/src/server/current-location.ts

@@ -0,0 +1,19 @@
+import 'server-only'
+
+import { headers } from 'next/headers'
+import { cache } from 'react'
+
+import { PATH_HEADER, QUERY_HEADER } from './location-header'
+
+export const currentLocation = cache(async (): Promise<string> => {
+  try {
+    const jar = await headers()
+    const path = jar.get(PATH_HEADER)
+    if (typeof path !== 'string' || !path.startsWith('/')) return ''
+
+    const query = jar.get(QUERY_HEADER)
+    return typeof query === 'string' && query.startsWith('?') ? `${path}${query}` : path
+  } catch {
+    return ''
+  }
+})

package/src/server/demo-stripe.ts

@@ -0,0 +1,104 @@
+import 'server-only'
+
+import { env, logger, readPluginEnv } from '@meith/core'
+import {
+  FAKE_STRIPE_MOUNT,
+  type FakeStripeRequest,
+  type FakeStripeResponse,
+  fakeStripe,
+} from '@meith/demo'
+import { signStripePayload } from '@meith/plugin-dues'
+import { resolvePluginSettings } from '@meith/plugin-kit'
+
+import { boardUrl } from './board-url'
+import { activeDefinitions } from './plugin-host'
+import { dispatchPluginRoute } from './plugin-routes'
+import { getSettingOverrides } from './settings'
+
+const DUES = 'dues'
+
+const SETTLED = new Set(['granted', 'already-settled', 'paid-but-grant-refused'])
+
+interface Global {
+  __meithFakeStripe?: Map<string, ReturnType<typeof fakeStripe>>
+}
+
+function instance(publicBase: string): ReturnType<typeof fakeStripe> {
+  const store = (globalThis as Global).__meithFakeStripe ?? new Map()
+  ;(globalThis as Global).__meithFakeStripe = store
+
+  const existing = store.get(publicBase)
+  if (existing !== undefined) return existing
+
+  const made = fakeStripe({ publicBase })
+  store.set(publicBase, made)
+  return made
+}
+
+export async function handleFakeStripe(request: Request, path: string): Promise<Response> {
+  if (!env.DEMO_MODE) return new Response('Not found', { status: 404 })
+
+  const url = new URL(request.url)
+  const call: FakeStripeRequest = {
+    method: request.method,
+    path: path === '' ? '/' : `/${path}`,
+    body: request.method === 'POST' ? await request.text() : '',
+    query: url.searchParams,
+  }
+
+  const outcome = instance(`${await boardUrl()}${FAKE_STRIPE_MOUNT}`).handle(call)
+  if (outcome.event !== null) await deliver(outcome.event)
+  return respond(outcome.response)
+}
+
+function respond(response: FakeStripeResponse): Response {
+  if (response.kind === 'redirect') {
+    return new Response(null, { status: 303, headers: { location: response.to } })
+  }
+
+  const contentType =
+    response.kind === 'json' ? 'application/json; charset=utf-8' : 'text/html; charset=utf-8'
+  const body = response.kind === 'json' ? JSON.stringify(response.body) : response.body
+
+  return new Response(body, {
+    status: response.status,
+    headers: { 'content-type': contentType, 'cache-control': 'no-store' },
+  })
+}
+
+async function deliver(event: unknown): Promise<void> {
+  const definition = activeDefinitions().find((candidate) => candidate.key === DUES)
+  if (definition === undefined) return
+
+  const settings = resolvePluginSettings(definition, await getSettingOverrides(), readPluginEnv)
+  const secret = String(settings.stripe_webhook_secret ?? '')
+  if (secret === '') {
+    logger().warn('the demo Stripe has no webhook secret to sign with')
+    return
+  }
+
+  const body = JSON.stringify(event)
+  const signature = signStripePayload(body, secret, Math.floor(Date.now() / 1000))
+  const board = await boardUrl()
+
+  const response = await dispatchPluginRoute(
+    new Request(`${board}/api/plugins/${DUES}/hook/stripe`, {
+      method: 'POST',
+      body,
+      headers: { 'content-type': 'application/json', 'stripe-signature': signature },
+    }),
+    DUES,
+    ['hook', 'stripe'],
+  )
+
+  const outcome = response.ok
+    ? String(((await response.json()) as { outcome?: unknown }).outcome ?? 'unknown')
+    : 'rejected'
+
+  if (!SETTLED.has(outcome)) {
+    logger().warn(
+      { status: response.status, outcome },
+      'the demo Stripe delivered a webhook the board did not act on',
+    )
+  }
+}

package/src/server/demo-uploads.ts

@@ -0,0 +1,28 @@
+import 'server-only'
+
+import { rm } from 'node:fs/promises'
+
+import { env, logger } from '@meith/core'
+
+/**
+ * Everything a visitor uploaded, thrown away with the board that referenced it.
+ *
+ * Only local storage is cleared. A demo pointed at an object store is not a
+ * configuration this project asks anyone to run, and quietly issuing bulk
+ * deletes against a bucket somebody else's board might share is a worse failure
+ * than leaving files behind.
+ *
+ * Kept apart from the rest of the demo helpers because the container calls this
+ * one, and the others call the container.
+ */
+export async function clearUploadedFiles(): Promise<void> {
+  if (env.FILESTORE_DRIVER !== 'local') {
+    logger({ module: 'demo' }).warn(
+      { driver: env.FILESTORE_DRIVER },
+      'demo reset left uploads in place: only the local file store is cleared',
+    )
+    return
+  }
+
+  await rm(env.UPLOADS_DIR, { recursive: true, force: true })
+}

package/src/server/demo.ts

@@ -0,0 +1,80 @@
+import 'server-only'
+
+import { env, logger } from '@meith/core'
+import { getDb } from '@meith/db'
+import {
+  assertDemoAccountIsChangeable,
+  type DemoBanner,
+  demoBanner,
+  type FrozenField,
+  nextDemoResetAt,
+} from '@meith/demo'
+
+import { getContainer } from './container'
+
+/**
+ * Refuses a change to a published demo login's password or email.
+ *
+ * Checked by user id, resolved to a username here, because the demo package
+ * cannot know the ids — they are handed out by Postgres at seed time and differ
+ * every reset. The username is the stable thing.
+ */
+export async function assertDemoAccountChangeable(
+  userId: number,
+  what: FrozenField,
+): Promise<void> {
+  if (!env.DEMO_MODE) return
+
+  const account = await getContainer().accountStore.accounts.findById(userId)
+  if (account === null) return
+
+  assertDemoAccountIsChangeable(account.username, what)
+}
+
+/**
+ * The administrator's own edit screen can rename a member, and renaming
+ * `admin` is the same lockout as changing its password by a longer route — the
+ * banner would go on naming a login that no longer exists. Only refused when
+ * the value actually differs, so an admin can still open the demo login's
+ * account screen and change its groups.
+ */
+export async function assertDemoIdentityUnchanged(
+  userId: number,
+  submitted: { readonly username: string; readonly email: string },
+): Promise<void> {
+  if (!env.DEMO_MODE) return
+
+  const account = await getContainer().accountStore.accounts.findById(userId)
+  if (account === null) return
+
+  if (submitted.username.trim().toLowerCase() !== account.usernameLower) {
+    assertDemoAccountIsChangeable(account.username, 'username')
+  }
+  if (submitted.email.trim().toLowerCase() !== account.emailLower) {
+    assertDemoAccountIsChangeable(account.username, 'email')
+  }
+}
+
+/**
+ * The banner's content, or `null` on any board that is not a demo.
+ *
+ * Failure here is deliberately quiet. The banner is an aid, and a board that
+ * refuses to render because it could not work out when it next resets is worse
+ * than a board that renders without the countdown.
+ */
+export async function demoBannerModel(): Promise<DemoBanner | null> {
+  if (!env.DEMO_MODE) return null
+
+  try {
+    return demoBanner({
+      nextResetAt: await nextDemoResetAt(getDb()),
+      now: new Date(),
+    })
+  } catch (error) {
+    logger({ module: 'demo' }).warn(
+      { err: String(error) },
+      'could not read the next demo reset time',
+    )
+    return demoBanner({ nextResetAt: null, now: new Date() })
+  }
+}

package/src/server/discovery.ts

@@ -0,0 +1,104 @@
+import { msg } from '@meith/i18n'
+import 'server-only'
+
+import type { Actor } from '@meith/authorization'
+import { contentScopeFrom, ForbiddenError } from '@meith/core'
+import {
+  type DiscoveryPage,
+  type DiscoveryScope,
+  getDb,
+  PostgresDiscoveryRepository,
+} from '@meith/db'
+
+import { getContainer } from './container'
+
+export const DISCOVER_PAGE = 20
+
+export const DISCOVERY_VIEWS = ['new', 'today', 'mine', 'participated', 'unanswered'] as const
+export type DiscoveryView = (typeof DISCOVERY_VIEWS)[number]
+
+export function isDiscoveryView(value: string): value is DiscoveryView {
+  return (DISCOVERY_VIEWS as readonly string[]).includes(value)
+}
+
+export function discoveryRepository(): PostgresDiscoveryRepository | null {
+  return getContainer().dataSource === 'postgres' ? new PostgresDiscoveryRepository(getDb()) : null
+}
+
+export async function discoveryScopeFor(actor: Actor): Promise<DiscoveryScope> {
+  const { authorizer } = getContainer()
+  const staff = actor.global.isAdministrator === true || actor.global.isSuperModerator === true
+
+  return {
+    ...(await authorizer.threadAudience(actor)),
+    content: contentScopeFrom({ seesUnapproved: staff, seesDeleted: staff }),
+  }
+}
+
+export async function runDiscovery(input: {
+  readonly actor: Actor
+  readonly view: DiscoveryView
+  readonly now: Date
+  readonly timeZone: string
+  readonly after: DiscoveryPage['nextCursor']
+}): Promise<DiscoveryPage> {
+  const repo = discoveryRepository()
+  if (repo === null) throw new ForbiddenError(msg('error.app.board-thread-index'))
+
+  const scope = await discoveryScopeFor(input.actor)
+  const query = { limit: DISCOVER_PAGE, after: input.after }
+
+  switch (input.view) {
+    case 'today':
+      return repo.activeSince(startOfDay(input.now, input.timeZone), query, scope)
+    case 'unanswered':
+      return repo.unanswered(query, scope)
+    case 'mine':
+      if (input.actor.userId === null) throw new ForbiddenError(msg('error.app.sign-see-threads'))
+      return repo.startedBy(input.actor.userId, query, scope)
+    case 'participated':
+      if (input.actor.userId === null) throw new ForbiddenError(msg('error.app.sign-see-threads'))
+      return repo.participatedIn(input.actor.userId, query, scope)
+    // biome-ignore lint/complexity/noUselessSwitchCase: naming the view keeps the switch exhaustive against the DiscoveryView union
+    case 'new':
+    default:
+      return repo.activeSince(new Date(input.now.getTime() - 86_400_000), query, scope)
+  }
+}
+
+export function startOfDay(now: Date, timeZone: string): Date {
+  try {
+    const parts = new Intl.DateTimeFormat('en-CA', {
+      timeZone,
+      year: 'numeric',
+      month: '2-digit',
+      day: '2-digit',
+    }).formatToParts(now)
+
+    const get = (type: string): string => parts.find((part) => part.type === type)?.value ?? '01'
+
+    const local = new Date(`${get('year')}-${get('month')}-${get('day')}T00:00:00Z`)
+    const offset = local.getTime() - zonedInstant(local, timeZone)
+    return new Date(local.getTime() + offset)
+  } catch {
+    return new Date(now.getTime() - 86_400_000)
+  }
+}
+
+function zonedInstant(date: Date, timeZone: string): number {
+  const parts = new Intl.DateTimeFormat('en-US', {
+    timeZone,
+    hour12: false,
+    year: 'numeric',
+    month: '2-digit',
+    day: '2-digit',
+    hour: '2-digit',
+    minute: '2-digit',
+    second: '2-digit',
+  }).formatToParts(date)
+
+  const get = (type: string): string => parts.find((part) => part.type === type)?.value ?? '00'
+  return Date.parse(
+    `${get('year')}-${get('month')}-${get('day')}T${get('hour') === '24' ? '00' : get('hour')}:${get('minute')}:${get('second')}Z`,
+  )
+}

package/src/server/embeds.ts

@@ -0,0 +1,113 @@
+import 'server-only'
+
+import { env } from '@meith/core'
+import { escapeAttribute, escapeHtml, safeImageUrl, safeUrl, unescapeHtml } from '@meith/markdown'
+
+interface Provider {
+  readonly name: string
+  readonly match: (url: URL) => boolean
+  readonly oembedUrl: (url: URL) => string
+}
+
+const PROVIDERS: readonly Provider[] = [
+  {
+    name: 'YouTube',
+    match: (url) =>
+      ['www.youtube.com', 'youtube.com', 'youtu.be'].includes(url.hostname) && url.pathname !== '/',
+    oembedUrl: (url) =>
+      `https://www.youtube.com/oembed?format=json&url=${encodeURIComponent(url.href)}`,
+  },
+  {
+    name: 'Vimeo',
+    match: (url) => ['www.vimeo.com', 'vimeo.com'].includes(url.hostname) && url.pathname !== '/',
+    oembedUrl: (url) => `https://vimeo.com/api/oembed.json?url=${encodeURIComponent(url.href)}`,
+  },
+]
+
+const MAX_EMBEDS_PER_POST = 3
+const FETCH_TIMEOUT_MS = 2_000
+
+interface OEmbedResponse {
+  readonly title?: unknown
+  readonly author_name?: unknown
+  readonly thumbnail_url?: unknown
+}
+
+const LONE_LINK =
+  /<p><a href="([^"]*)" rel="nofollow ugc noopener noreferrer"(?: title="[^"]*")?>[^<]*<\/a><\/p>/g
+
+async function fetchOEmbed(provider: Provider, url: URL): Promise<OEmbedResponse | null> {
+  try {
+    const response = await fetch(provider.oembedUrl(url), {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      headers: { accept: 'application/json' },
+    })
+    if (!response.ok) return null
+    if (!(response.headers.get('content-type') ?? '').includes('application/json')) return null
+    return (await response.json()) as OEmbedResponse
+  } catch {
+    return null
+  }
+}
+
+function renderCard(provider: Provider, href: string, data: OEmbedResponse): string | null {
+  const link = safeUrl(href)
+  if (link === null) return null
+
+  const title = typeof data.title === 'string' && data.title !== '' ? data.title : provider.name
+  const author = typeof data.author_name === 'string' ? data.author_name : null
+  const thumbnail = typeof data.thumbnail_url === 'string' ? safeImageUrl(data.thumbnail_url) : null
+
+  const image =
+    thumbnail === null
+      ? ''
+      : `<img src="${escapeAttribute(thumbnail)}" alt="" loading="lazy" class="md-embed-thumb">`
+  const byline = author === null ? '' : `<span class="md-embed-author">${escapeHtml(author)}</span>`
+  const linkAttr = escapeAttribute(link)
+
+  return (
+    `<figure class="md-embed" data-provider="${escapeAttribute(provider.name.toLowerCase())}">` +
+    `<a href="${linkAttr}" rel="nofollow ugc noopener noreferrer">${image}</a>` +
+    `<figcaption>` +
+    `<a href="${linkAttr}" rel="nofollow ugc noopener noreferrer" class="md-embed-title">${escapeHtml(title)}</a>` +
+    `${byline}<span class="md-embed-provider">${escapeHtml(provider.name)}</span>` +
+    `</figcaption></figure>`
+  )
+}
+
+export async function unfurlEmbeds(html: string): Promise<string> {
+  if (!env.REMOTE_IMAGES || !html.includes('<a href=')) return html
+
+  const matches = [...html.matchAll(LONE_LINK)].slice(0, MAX_EMBEDS_PER_POST)
+  if (matches.length === 0) return html
+
+  const replacements = new Map<string, string>()
+
+  for (const match of matches) {
+    const whole = match[0]
+    if (replacements.has(whole)) continue
+
+    const href = unescapeHtml(match[1] ?? '')
+    let url: URL
+    try {
+      url = new URL(href)
+    } catch {
+      continue
+    }
+    if (url.protocol !== 'https:') continue
+
+    const provider = PROVIDERS.find((candidate) => candidate.match(url))
+    if (provider === undefined) continue
+
+    const data = await fetchOEmbed(provider, url)
+    if (data === null) continue
+
+    const card = renderCard(provider, href, data)
+    if (card === null) continue
+
+    replacements.set(whole, `${whole}${card}`)
+  }
+
+  if (replacements.size === 0) return html
+  return html.replace(LONE_LINK, (whole) => replacements.get(whole) ?? whole)
+}