@morphemecms/cms 0.0.0-stage → 0.1.0

package/worker/not-found.js

@@ -0,0 +1,97 @@
+// The addresses visitors came to that do not exist (the site's 404 page), for "Videresendelser" in the
+// editor (packages/editor/src/notFound.ts, Redirects.tsx), where the site's owner can send them on to a page.
+// Kept in Workers KV (the binding NOT_FOUND in wrangler.jsonc), one key per address: how many times,
+// when first and last, and where the visitor came from. No IP address, no cookie: nothing about the
+// visitor, so it needs no consent. An address not seen for 90 days drops out by itself.
+// Without the binding (a preview of a branch) nothing is kept and the editor says so.
+//   GET    /api/not-found  the addresses, most visits first
+//   DELETE /api/not-found  { paths: [...] } takes them off the list (sent on, or not worth it)
+// Only someone who can save the site (write access to the repository on GitHub) can read or change it.
+import { mayEdit } from './session.js';
+
+const PREFIX = '404:';
+const KEEP = 90 * 24 * 60 * 60;
+// A page: no file ending in the last part (not a picture, a script or /wp-login.php).
+const PAGE = /(^|\/)[^./]*$/;
+// What is not a page of the site, and what robots try on every site.
+const SKIP = /^\/(editor|oauth|api|cdn-cgi|\.well-known|wp-admin|wp-includes|wp-json)(\/|$)/i;
+const ROBOT = /bot|crawl|spider|slurp|headless|python|curl|wget|scan|http/i;
+
+/** Whether a 404 is a visitor's, worth keeping: a browser opening a page, on the public site. */
+export function isVisit(request, url) {
+  const agent = request.headers.get('user-agent') ?? '';
+  return (
+    request.method === 'GET' &&
+    url.pathname.length <= 300 &&
+    PAGE.test(url.pathname) &&
+    !SKIP.test(url.pathname) &&
+    agent.includes('Mozilla') &&
+    !ROBOT.test(agent.replace(/^Mozilla\/[\d.]+ /, '')) &&
+    (request.headers.get('accept') ?? '').includes('text/html')
+  );
+}
+
+/** Counts a visit to an address that does not exist. Never fails the request (KV may say no). */
+export async function recordNotFound(request, url, env) {
+  if (!env.NOT_FOUND) return;
+  try {
+    const key = PREFIX + addressOf(url.pathname);
+    const { metadata: was } = await env.NOT_FOUND.getWithMetadata(key);
+    const now = new Date().toISOString();
+    const metadata = { n: (was?.n ?? 0) + 1, first: was?.first ?? now, last: now, from: cameFrom(request, url) || was?.from || '' };
+    await env.NOT_FOUND.put(key, '', { metadata, expirationTtl: KEEP });
+  } catch {}
+}
+
+// The address as the editor's redirects have it: decoded (/æble/, not /%C3%A6ble/), and with the slash
+// at the end, for /kontakt is sent on by the redirect from /kontakt/ (packages/editor/worker/index.js withSlash).
+function addressOf(pathname) {
+  let path = pathname;
+  try {
+    path = decodeURIComponent(pathname);
+  } catch {}
+  return path.endsWith('/') ? path : `${path}/`;
+}
+
+// Where the visitor came from: a page of the site by its address (a link on it is broken), another
+// site by its name (google.com); browsers send no more than that for another site.
+function cameFrom(request, url) {
+  try {
+    const from = new URL(request.headers.get('referer') ?? '');
+    if (from.host === url.host) return from.pathname.slice(0, 200);
+    return from.hostname.replace(/^www\./, '').slice(0, 200);
+  } catch {
+    return '';
+  }
+}
+
+export async function handleNotFound(request, env) {
+  if (!(await mayEdit(request))) return json({ error: 'forbidden' }, 403);
+  if (!env.NOT_FOUND) return json({ error: 'unavailable' }, 503);
+  if (request.method === 'GET') return json({ entries: await entries(env.NOT_FOUND) });
+  if (request.method === 'DELETE') {
+    const body = await request.json().catch(() => ({}));
+    const paths = Array.isArray(body.paths) ? body.paths.filter((p) => typeof p === 'string').slice(0, 100) : [];
+    await Promise.all(paths.map((p) => env.NOT_FOUND.delete(PREFIX + p)));
+    return json({ deleted: paths.length });
+  }
+  return json({ error: 'method' }, 405);
+}
+
+async function entries(kv) {
+  const all = [];
+  let cursor;
+  // At most 5000 addresses; more would be robots.
+  for (let i = 0; i < 5; i++) {
+    const page = await kv.list({ prefix: PREFIX, cursor });
+    for (const { name, metadata } of page.keys)
+      if (metadata)
+        all.push({ path: name.slice(PREFIX.length), count: metadata.n, first: metadata.first, last: metadata.last, from: metadata.from });
+    if (page.list_complete) break;
+    cursor = page.cursor;
+  }
+  return all.sort((a, b) => b.count - a.count || b.last.localeCompare(a.last));
+}
+
+export const json = (data, status = 200) =>
+  new Response(JSON.stringify(data), { status, headers: { 'content-type': 'application/json', 'cache-control': 'no-store' } });

package/worker/oauth.js

@@ -0,0 +1,95 @@
+// GitHub sign-in for the editor at /editor/ (packages/editor/src/github.ts). See docs/editor.md.
+//   /oauth/auth      the editor goes here; we send the browser on to GitHub
+//   /oauth/callback  GitHub sends the browser back here; we swap the code for a token, keep it in a
+//                    cookie only the Worker can read (packages/editor/worker/session.js) and go back to /editor/
+// A redirect rather than a popup, so it also works in the editor installed as an app on a phone.
+// Needs the Worker secrets GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET from a GitHub App whose
+// callback URL is https://<hostname>/oauth/callback (installed on this repo only; see docs/editor.md).
+// Who may edit is decided by GitHub: only people with write access to the repository can save.
+import { sessionCookie } from './session.js';
+
+const STATE_COOKIE = 'cms_oauth_state';
+// The editor asks for "repo"; anything outside this list is dropped.
+const SCOPES = new Set(['repo', 'public_repo', 'user', 'read:user', 'user:email']);
+
+export async function handleOAuth(request, env) {
+  const url = new URL(request.url);
+  if (url.pathname === '/oauth/auth') return authorize(url, env);
+  if (url.pathname === '/oauth/callback') return callback(request, url, env);
+  return null;
+}
+
+function authorize(url, env) {
+  if (!env.GITHUB_CLIENT_ID || !env.GITHUB_CLIENT_SECRET) {
+    return finish({ error: 'GitHub-login er ikke sat op endnu (mangler GITHUB_CLIENT_ID/SECRET).' });
+  }
+  if ((url.searchParams.get('provider') ?? 'github') !== 'github') return finish({ error: 'Ukendt login.' });
+  const scope =
+    (url.searchParams.get('scope') ?? '')
+      .split(/[\s,]+/)
+      .filter((s) => SCOPES.has(s))
+      .join(',') || 'repo';
+  const state = crypto.randomUUID();
+  const github = new URL('https://github.com/login/oauth/authorize');
+  github.search = new URLSearchParams({
+    client_id: env.GITHUB_CLIENT_ID,
+    redirect_uri: `${url.origin}/oauth/callback`,
+    scope,
+    state,
+  });
+  return new Response(null, {
+    status: 302,
+    headers: {
+      location: github.href,
+      'set-cookie': `${STATE_COOKIE}=${state}; Path=/oauth/; Max-Age=600; HttpOnly; Secure; SameSite=Lax`,
+      'cache-control': 'no-store',
+    },
+  });
+}
+
+async function callback(request, url, env) {
+  const code = url.searchParams.get('code');
+  const state = url.searchParams.get('state');
+  const cookie = request.headers.get('cookie') ?? '';
+  const expected = cookie.match(new RegExp(`(?:^|;\\s*)${STATE_COOKIE}=([^;]+)`))?.[1];
+  if (!code || !state || state !== expected) {
+    return finish({ error: 'Login mislykkedes (ugyldig eller udløbet forespørgsel). Prøv igen.' });
+  }
+
+  const res = await fetch('https://github.com/login/oauth/access_token', {
+    method: 'POST',
+    headers: { accept: 'application/json', 'content-type': 'application/json', 'user-agent': 'morpheme-cms' },
+    body: JSON.stringify({
+      client_id: env.GITHUB_CLIENT_ID,
+      client_secret: env.GITHUB_CLIENT_SECRET,
+      code,
+      redirect_uri: `${url.origin}/oauth/callback`,
+    }),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.access_token) {
+    return finish({ error: `Login mislykkedes: ${data.error_description ?? data.error ?? res.status}` });
+  }
+  return finish({ token: data.access_token });
+}
+
+// The page GitHub's sign-in ends on: with a token, it keeps it for the Worker (the cookie) and opens the
+// editor (from this page, so the cookie, SameSite=Strict, goes with what the editor asks); with an error, it
+// shows it with a way back.
+function finish({ token, error }) {
+  const body = error
+    ? `<p>${escapeHtml(error)}</p><p><a href="/editor/">Tilbage til editoren</a></p>`
+    : `<p>Logger ind…</p><script>location.replace('/editor/');</script>`;
+  const html = `<!doctype html><html lang="da"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noindex"><title>Login</title></head>
+<body style="font-family: system-ui, sans-serif; padding: 2rem">${body}</body></html>`;
+  const headers = new Headers({
+    'content-type': 'text/html; charset=utf-8',
+    'cache-control': 'no-store',
+    'set-cookie': `${STATE_COOKIE}=; Path=/oauth/; Max-Age=0; HttpOnly; Secure; SameSite=Lax`,
+  });
+  if (token) headers.append('set-cookie', sessionCookie(token));
+  return new Response(html, { status: error ? 400 : 200, headers });
+}
+
+const escapeHtml = (s) =>
+  String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);

package/worker/publish.js

@@ -0,0 +1,52 @@
+// Publishes the pages and blog posts that are Planlagt once their time has come (packages/editor/lib/status.mjs): each hour (the
+// cron in wrangler.jsonc, minute 7) the Worker reads the list the build made of them (/_scheduled.json,
+// packages/editor/scripts/scheduled-list.mjs), and if a time has come, it makes those files Udgivet (their `status` and `publishAt`
+// lines go) in one commit on main (*Udgiv planlagt: blogindlæg "…"*), which builds the site. Nothing is asked of
+// GitHub in an hour with nothing to publish. Needs the Worker secret GITHUB_PUBLISH_TOKEN: a GitHub token with
+// Contents: Read and write on the repository (docs/editor.md, Opsætning; packages/editor/worker/github.js).
+import { commitFiles, readFiles } from './github.js';
+import { isDue, nameOf, published, scheduleOf } from '../lib/scheduled.mjs';
+
+/** The address of the build's list; on the site it gives nothing (packages/editor/worker/index.js). */
+export const SCHEDULED_LIST = '/_scheduled.json';
+
+export async function publishScheduled(env, now = Date.now()) {
+  const due = (await listOf(env)).filter((e) => isDue(e.publishAt, now));
+  if (!due.length) return [];
+  if (!env.GITHUB_PUBLISH_TOKEN) {
+    console.error('Planlagte sider og indlæg kan ikke udgives: Workeren mangler hemmeligheden GITHUB_PUBLISH_TOKEN.');
+    return [];
+  }
+  // The files as they are now (one may have been published or changed since the build).
+  const { head, texts } = await readFiles(
+    env,
+    due.map((e) => e.path),
+  );
+  const changes = due
+    .map((e, i) => ({ path: e.path, text: texts[i] }))
+    .filter(({ text }) => {
+      const file = scheduleOf(text ?? '');
+      return file.status === 'scheduled' && isDue(file.publishAt, now);
+    });
+  if (!changes.length) return [];
+  const names = changes.map((c) => nameOf(c.path));
+  await commitFiles(
+    env,
+    head,
+    `Udgiv planlagt: ${names.join(', ')}`,
+    changes.map((c) => ({ path: c.path, text: published(c.text) })),
+  );
+  console.log(`Udgivet: ${names.join(', ')}`);
+  return names;
+}
+
+// The build's list; none (a build before the list, or a preview) is nothing to publish.
+async function listOf(env) {
+  try {
+    const res = await env.ASSETS.fetch(new Request(`https://assets.local${SCHEDULED_LIST}`));
+    const list = res.ok ? await res.json() : [];
+    return Array.isArray(list) ? list : [];
+  } catch {
+    return [];
+  }
+}

package/worker/push.js

@@ -0,0 +1,270 @@
+// The editor's notifications on the phone or computer also when the editor is closed: Web Push from the Worker
+// (packages/editor/src/notifications.ts, packages/editor/pages/editor/sw.js). A device where "På telefonen" is on under "Konto" ›
+// "Notifikationer" signs up here with the browser's push subscription, the types it has turned off and the editor's
+// language; the Worker sends to the browser's push service (Google's, Mozilla's, Apple's), which wakes the editor's
+// service worker, which shows it. Kept in Workers KV (the binding PUSH in wrangler.jsonc):
+//   vapid          the Worker's own key pair for the push services (VAPID, RFC 8292), made the first time it is needed;
+//                  a device signed up with another key signs up again when the editor opens
+//   device:<id>    a device: its subscription, the types turned off and the language
+//   wait:<id>      the device's last save, until the site is built with it: the commit and the two texts to send
+//   waiting        until when there may be a wait (so the cron each minute asks KV once, and lists only then)
+// What is sent:
+// - "Hjemmesiden er opdateret med dine ændringer" (type `site`) to the device that saved, when the site has been built
+//   with the save (each minute, waitForBuilds: the cron in wrangler.jsonc), or that it was not, after ten minutes;
+//   the texts are the editor's, in its language. An editor on screen says it itself and takes the wait back.
+// - an app's notification from its part of the Worker (`notify` in the tools it is given, packages/editor/worker/index.js) to each
+//   device with the type on, in the device's language (the app's texts.ts).
+// The payload is encrypted for the device (RFC 8291, aes128gcm); a device the push service no longer knows is removed.
+//   GET    /api/push        { key }: the Worker's public key, for the browser's subscription
+//   PUT    /api/push        { subscription, off, locale }: signs a device up, or updates its choices
+//   DELETE /api/push        { endpoint }: signs it off ("På telefonen" off, "Log ud")
+//   PUT    /api/push/wait   { endpoint, commit, text, failText, to? }: sends `text` when the site is built with `commit`
+//   DELETE /api/push/wait   { endpoint }: takes it back (the editor said it itself)
+// Only someone who can save the site (write access to the repository on GitHub) can use them. Without the binding (a
+// preview of a branch) nothing is kept or sent, and the editor's notifications come only while it is open.
+import { config } from '@site/config';
+import { contact } from '@site/worker';
+import { json } from './not-found.js';
+import { mayEdit } from './session.js';
+
+const VAPID = 'vapid';
+const DEVICE = 'device:';
+const WAIT = 'wait:';
+const WAITING = 'waiting';
+// How long the editor waits for a save to be on the site (packages/editor/src/deploy.ts GIVE_UP).
+const GIVE_UP = 10 * 60_000;
+// A device not seen (the editor not opened on it) for half a year drops out by itself.
+const KEEP = 180 * 24 * 60 * 60;
+// How long a push service keeps a notification for a device that is off.
+const TTL = 24 * 60 * 60;
+
+const encoder = new TextEncoder();
+
+function b64url(bytes) {
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+function fromB64url(text) {
+  const binary = atob(text.replace(/-/g, '+').replace(/_/g, '/'));
+  return Uint8Array.from(binary, (c) => c.charCodeAt(0));
+}
+
+const concat = (...parts) => {
+  const all = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let at = 0;
+  for (const p of parts) all.set(p, (at += p.length) - p.length);
+  return all;
+};
+
+/** A device's id: a hash of its endpoint, so the endpoint is not a key. */
+async function idOf(endpoint) {
+  const hash = new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(endpoint)));
+  return b64url(hash.slice(0, 16));
+}
+
+/** The Worker's key pair as a JWK with the private part, made and kept the first time. */
+async function vapidOf(kv) {
+  const kept = await kv.get(VAPID, 'json');
+  if (kept) return kept;
+  const pair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
+  const jwk = await crypto.subtle.exportKey('jwk', pair.privateKey);
+  await kv.put(VAPID, JSON.stringify(jwk));
+  return jwk;
+}
+
+/** The public key as the browser takes it (an uncompressed point, base64url). */
+const publicKeyOf = (jwk) => b64url(concat(new Uint8Array([4]), fromB64url(jwk.x), fromB64url(jwk.y)));
+
+/** The header that says the push comes from this site (VAPID, RFC 8292). */
+async function vapidHeader(jwk, endpoint) {
+  const key = await crypto.subtle.importKey('jwk', jwk, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']);
+  const part = (o) => b64url(encoder.encode(JSON.stringify(o)));
+  const claims = { aud: new URL(endpoint).origin, exp: Math.floor(Date.now() / 1000) + 12 * 60 * 60, sub: `https://${config.domain}` };
+  const unsigned = `${part({ typ: 'JWT', alg: 'ES256' })}.${part(claims)}`;
+  const signature = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, key, encoder.encode(unsigned));
+  return `vapid t=${unsigned}.${b64url(new Uint8Array(signature))}, k=${publicKeyOf(jwk)}`;
+}
+
+async function hkdf(salt, ikm, info, bytes) {
+  const key = await crypto.subtle.importKey('raw', ikm, 'HKDF', false, ['deriveBits']);
+  return new Uint8Array(await crypto.subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, key, bytes * 8));
+}
+
+/** The payload encrypted for the device (RFC 8291, the content coding aes128gcm of RFC 8188, one record).
+ * `salt` and `pair` are for the tests only. */
+export async function encrypt(payload, { p256dh, auth }, { salt = crypto.getRandomValues(new Uint8Array(16)), pair } = {}) {
+  const device = fromB64url(p256dh);
+  const own = pair ?? (await crypto.subtle.generateKey({ name: 'ECDH', namedCurve: 'P-256' }, true, ['deriveBits']));
+  const ownPublic = new Uint8Array(await crypto.subtle.exportKey('raw', own.publicKey));
+  const deviceKey = await crypto.subtle.importKey('raw', device, { name: 'ECDH', namedCurve: 'P-256' }, false, []);
+  const shared = new Uint8Array(await crypto.subtle.deriveBits({ name: 'ECDH', public: deviceKey }, own.privateKey, 256));
+  const ikm = await hkdf(fromB64url(auth), shared, concat(encoder.encode('WebPush: info\0'), device, ownPublic), 32);
+  const cek = await hkdf(salt, ikm, encoder.encode('Content-Encoding: aes128gcm\0'), 16);
+  const nonce = await hkdf(salt, ikm, encoder.encode('Content-Encoding: nonce\0'), 12);
+  const key = await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, ['encrypt']);
+  // The last (and only) record ends with 2.
+  const plain = concat(encoder.encode(payload), new Uint8Array([2]));
+  const sealed = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce }, key, plain));
+  const size = new Uint8Array(4);
+  new DataView(size.buffer).setUint32(0, 4096);
+  return concat(salt, size, new Uint8Array([ownPublic.length]), ownPublic, sealed);
+}
+
+/** Sends a notification ({ title, body, to, tag, error }) to a device; removes the device when its push service no
+ * longer knows it. */
+async function send(env, id, device, message) {
+  const { endpoint, keys } = device.subscription;
+  try {
+    const jwk = await vapidOf(env.PUSH);
+    const res = await fetch(endpoint, {
+      method: 'POST',
+      headers: {
+        authorization: await vapidHeader(jwk, endpoint),
+        'content-encoding': 'aes128gcm',
+        'content-type': 'application/octet-stream',
+        ttl: String(TTL),
+        urgency: 'normal',
+      },
+      body: await encrypt(JSON.stringify({ title: contact.name, ...message }), keys),
+    });
+    if (res.status === 404 || res.status === 410) await env.PUSH.delete(DEVICE + id);
+    else if (!res.ok) console.error(`Notifikationen kunne ikke sendes: ${res.status} ${(await res.text()).slice(0, 200)}`);
+  } catch (e) {
+    console.error(`Notifikationen kunne ikke sendes: ${e?.message ?? e}`);
+  }
+}
+
+/** The devices signed up, by their ids. */
+async function devices(kv) {
+  const all = [];
+  let cursor;
+  for (let i = 0; i < 5; i++) {
+    const page = await kv.list({ prefix: DEVICE, cursor });
+    all.push(...page.keys.map((k) => k.name.slice(DEVICE.length)));
+    if (page.list_complete) break;
+    cursor = page.cursor;
+  }
+  const kept = await Promise.all(all.map((id) => kv.get(DEVICE + id, 'json')));
+  return all.map((id, i) => ({ id, device: kept[i] })).filter((d) => d.device?.subscription);
+}
+
+/** Sends an app's notification ({ type, id, text, error, to }, its type as `<app>/<type>`) to each device with the type
+ * on, its text in the device's language (`texts`: the app's texts.ts). */
+export async function notifyAll(env, { type, id, text, error, to }, texts = {}) {
+  if (!env.PUSH) return;
+  for (const { id: device, device: d } of await devices(env.PUSH)) {
+    if (d.off?.includes(type)) continue;
+    await send(env, device, d, { body: texts[d.locale]?.[text] ?? text, error: !!error, to, tag: `${type}:${id}` });
+  }
+}
+
+/** What the site was last built from (/editor/version.json, packages/editor/pages/editor/version.json.js). */
+async function builtOf(env) {
+  try {
+    const res = await env.ASSETS.fetch(new Request('https://assets.local/editor/version.json'));
+    return res.ok ? await res.json() : {};
+  } catch {
+    return {};
+  }
+}
+
+/** Whether the build's commit has `commit` in it (it may be built from a later one): asked of GitHub with the Worker's
+ * own token (GITHUB_PUBLISH_TOKEN); without it, only the commit itself counts. */
+async function includes(env, build, commit) {
+  if (build === commit) return true;
+  if (!env.GITHUB_PUBLISH_TOKEN) return false;
+  const { owner, name } = config.repo;
+  const res = await fetch(`https://api.github.com/repos/${owner}/${name}/compare/${commit}...${build}`, {
+    headers: { authorization: `Bearer ${env.GITHUB_PUBLISH_TOKEN}`, accept: 'application/vnd.github+json', 'user-agent': `${name}-worker` },
+  });
+  if (!res.ok) return false;
+  const { status } = await res.json().catch(() => ({}));
+  return status === 'ahead' || status === 'identical';
+}
+
+/** Each minute: tells each device waiting for its save whether the site has been built with it (see above). */
+export async function waitForBuilds(env, now = Date.now()) {
+  if (!env.PUSH) return;
+  const until = Number(await env.PUSH.get(WAITING));
+  if (!until || now > until) return;
+  const { keys } = await env.PUSH.list({ prefix: WAIT });
+  if (!keys.length) return;
+  const built = await builtOf(env);
+  const builtAt = Date.parse(built.builtAt ?? '');
+  for (const { name, metadata: wait } of keys) {
+    if (!wait) continue;
+    const at = Date.parse(wait.at);
+    // A build made before the save cannot have it.
+    const online = !!built.commit && builtAt >= at && (await includes(env, built.commit, wait.commit).catch(() => false));
+    const late = now - at > GIVE_UP;
+    if (!online && !late) continue;
+    await env.PUSH.delete(name);
+    const device = await env.PUSH.get(DEVICE + wait.device, 'json');
+    // Without any version file (a build from before it existed) there is nothing to tell, as in the editor.
+    if (!device?.subscription || device.off?.includes('site') || (!online && !built.commit)) continue;
+    await send(env, wait.device, device, { body: online ? wait.text : wait.failText, error: !online, to: wait.to, tag: 'site' });
+  }
+}
+
+const text = (value, max = 300) => (typeof value === 'string' ? value.slice(0, max) : '');
+const isRoute = (to) => typeof to === 'string' && /^[\w\-/æøåÆØÅ]{1,200}$/.test(to);
+
+// The browsers' push services (Chrome's, Firefox's, Safari's, Edge's): the Worker sends to no other address.
+const PUSH_SERVICE =
+  /^https:\/\/(fcm\.googleapis\.com|android\.googleapis\.com|updates\.push\.services\.mozilla\.com|[\w-]+(\.[\w-]+)*\.push\.apple\.com|[\w-]+(\.[\w-]+)*\.notify\.windows\.com)\//;
+
+function subscriptionOf(value) {
+  const { endpoint, keys } = value ?? {};
+  if (typeof endpoint !== 'string' || !PUSH_SERVICE.test(endpoint) || endpoint.length > 1000) return null;
+  if (typeof keys?.p256dh !== 'string' || typeof keys?.auth !== 'string') return null;
+  return { endpoint, keys: { p256dh: keys.p256dh, auth: keys.auth } };
+}
+
+/** The addresses /api/push and /api/push/wait (see above). */
+export async function handlePush(request, env) {
+  if (!(await mayEdit(request))) return json({ error: 'forbidden' }, 403);
+  if (!env.PUSH) return json({ error: 'unavailable' }, 503);
+  const wait = new URL(request.url).pathname.replace(/\/$/, '') === '/api/push/wait';
+  if (request.method === 'GET' && !wait) return json({ key: publicKeyOf(await vapidOf(env.PUSH)) });
+  const body = await request.json().catch(() => ({}));
+  const endpoint = body.endpoint ?? body.subscription?.endpoint;
+  if (typeof endpoint !== 'string' || !endpoint) return json({ error: 'endpoint' }, 400);
+  const id = await idOf(endpoint);
+
+  if (wait && request.method === 'PUT') {
+    if (typeof body.commit !== 'string' || !/^[0-9a-f]{40}$/.test(body.commit)) return json({ error: 'commit' }, 400);
+    const at = new Date().toISOString();
+    const metadata = { commit: body.commit, device: id, text: text(body.text), failText: text(body.failText), at };
+    if (isRoute(body.to)) metadata.to = body.to;
+    // The value is empty: all of it is in the metadata, which the list each minute gives with the key.
+    await env.PUSH.put(WAIT + id, '', { metadata, expirationTtl: (2 * GIVE_UP) / 1000 });
+    await env.PUSH.put(WAITING, String(Date.now() + GIVE_UP + 2 * 60_000));
+    return json({ ok: true });
+  }
+  if (wait && request.method === 'DELETE') {
+    await env.PUSH.delete(WAIT + id);
+    return json({ ok: true });
+  }
+  if (wait) return json({ error: 'method' }, 405);
+
+  if (request.method === 'PUT') {
+    const subscription = subscriptionOf(body.subscription);
+    if (!subscription) return json({ error: 'subscription' }, 400);
+    const off = Array.isArray(body.off)
+      ? body.off
+          .filter((t) => typeof t === 'string')
+          .slice(0, 100)
+          .map((t) => text(t, 100))
+      : [];
+    const device = { subscription, off, locale: text(body.locale, 20), at: new Date().toISOString() };
+    await env.PUSH.put(DEVICE + id, JSON.stringify(device), { expirationTtl: KEEP });
+    return json({ ok: true });
+  }
+  if (request.method === 'DELETE') {
+    await Promise.all([env.PUSH.delete(DEVICE + id), env.PUSH.delete(WAIT + id)]);
+    return json({ ok: true });
+  }
+  return json({ error: 'method' }, 405);
+}

package/worker/r2-status.js

@@ -0,0 +1,50 @@
+// Whether R2 caching (packages/editor/worker/files.js, the binding FILES) can be turned on, for "Indstillinger" › "Avanceret" in the
+// editor (packages/editor/src/Advanced.tsx): the switch writes the bucket into the Worker's settings (wrangler.jsonc),
+// and a deploy with a bucket Cloudflare does not have fails, so it can only be turned on when Cloudflare says the bucket
+// is there (R2 turned on for the account, and the bucket made). Asked of Cloudflare's API with the Worker's own key, a
+// token that may only read R2 (the secret CLOUDFLARE_R2_TOKEN, and CLOUDFLARE_ACCOUNT_ID; docs/editor.md, Opsætning).
+//   GET /api/r2?bucket=<name>[&jurisdiction=<eu|fedramp>]  { bound, bucket }: whether this Worker has FILES now (the site is built with it), and the
+//     bucket at Cloudflare: "ready" (there), "no-bucket", "no-r2" (R2 not turned on), "no-key" (the Worker has no key),
+//     "refused" (Cloudflare said no to the key) or "failed". A bucket kept within a jurisdiction is only found in it.
+// Only someone who can save the site (write access to the repository on GitHub) can ask.
+import { json } from './not-found.js';
+import { mayEdit } from './session.js';
+
+// Cloudflare's codes for a bucket that is not there and for an account without R2.
+const NO_BUCKET = 10006;
+const NO_R2 = 10042;
+// R2's rule for a bucket's name.
+const NAME = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
+// The jurisdictions R2 can keep a bucket within.
+const JURISDICTION = /^(eu|fedramp)$/;
+
+export async function handleR2(request, env) {
+  if (!(await mayEdit(request))) return json({ error: 'forbidden' }, 403);
+  if (request.method !== 'GET') return json({ error: 'method' }, 405);
+  const params = new URL(request.url).searchParams;
+  const name = params.get('bucket') ?? '';
+  const jurisdiction = params.get('jurisdiction');
+  if (!NAME.test(name)) return json({ error: 'bucket' }, 400);
+  if (jurisdiction !== null && !JURISDICTION.test(jurisdiction)) return json({ error: 'jurisdiction' }, 400);
+  return json({ bound: !!env.FILES, bucket: await bucketAt(env, name, jurisdiction) });
+}
+
+async function bucketAt(env, name, jurisdiction) {
+  const account = env.CLOUDFLARE_ACCOUNT_ID?.trim();
+  const token = env.CLOUDFLARE_R2_TOKEN?.trim();
+  if (!account || !token) return 'no-key';
+  try {
+    const res = await fetch(`https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(account)}/r2/buckets/${name}`, {
+      headers: { authorization: `Bearer ${token}`, ...(jurisdiction ? { 'cf-r2-jurisdiction': jurisdiction } : {}) },
+    });
+    const body = await res.json().catch(() => ({}));
+    if (res.ok && body.success) return 'ready';
+    const codes = (body.errors ?? []).map((e) => e.code);
+    if (codes.includes(NO_R2)) return 'no-r2';
+    if (codes.includes(NO_BUCKET)) return 'no-bucket';
+    if (res.status === 401 || res.status === 403) return 'refused';
+    return 'failed';
+  } catch {
+    return 'failed';
+  }
+}

package/worker/session.js

@@ -0,0 +1,58 @@
+// The editor's GitHub sign-in, kept by the Worker: the token is in a cookie only the Worker can read (HttpOnly, on the
+// editor's own address, sent only with what the editor asks the Worker, /api/), never in the browser's storage, so no
+// script can take it away. Set by the sign-in (packages/editor/worker/oauth.js), cleared by "Log ud" (/api/github/logout,
+// packages/editor/worker/editor-github.js) and on the old address (packages/editor/worker/editor-host.js). See docs/editor.md.
+import { config } from '@site/config';
+
+const COOKIE = 'editor_session';
+// Until "Log ud": as long as a browser keeps a cookie (400 days).
+const KEEP = 400 * 24 * 60 * 60;
+
+/** The header that keeps the token in the browser. */
+export const sessionCookie = (token) => `${COOKIE}=${token}; Path=/api/; Max-Age=${KEEP}; HttpOnly; Secure; SameSite=Strict`;
+
+/** The header that removes it. */
+export const noSession = () => `${COOKIE}=; Path=/api/; Max-Age=0; HttpOnly; Secure; SameSite=Strict`;
+
+/** The token of the request's sign-in, or null. Only a request from the editor's own page counts: SameSite=Strict
+ * still sends the cookie from a page on another address of the same domain (example.dk to editor.…). */
+export function sessionToken(request) {
+  const url = new URL(request.url);
+  const site = request.headers.get('sec-fetch-site');
+  const origin = request.headers.get('origin');
+  if (site ? site !== 'same-origin' : origin && origin !== url.origin) return null;
+  return request.headers.get('cookie')?.match(new RegExp(`(?:^|;\\s*)${COOKIE}=([^;]+)`))?.[1] ?? null;
+}
+
+// What GitHub said each token may do in the repository (by a hash of the token), for ten minutes, so not every request
+// asks.
+const known = new Map();
+const keyOf = async (token) => [...new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(token)))].join('.');
+
+/** What the request's sign-in may do in the site's repository: read it and save to it (`push`), as GitHub says; null
+ * without a sign-in or when GitHub no longer knows it. `ask`: fetch for GitHub (packages/editor/worker/files.js counts its requests). */
+export async function access(request, ask = fetch) {
+  const token = sessionToken(request);
+  if (!token) return null;
+  const id = await keyOf(token);
+  const was = known.get(id);
+  if (was && was.until > Date.now()) return { token, read: was.read, push: was.push };
+  const res = await ask(`https://api.github.com/repos/${config.repo.owner}/${config.repo.name}`, {
+    headers: { authorization: `Bearer ${token}`, accept: 'application/vnd.github+json', 'user-agent': `${config.repo.name}-worker` },
+  });
+  // 401: the token is no good (signed out); otherwise GitHub does not show the repository to it (404), or failed.
+  if (res.status === 401) return null;
+  if (!res.ok) return { token, read: false, push: false };
+  const { permissions = {} } = await res.json().catch(() => ({}));
+  const may = { read: permissions.pull === true, push: permissions.push === true };
+  known.set(id, { ...may, until: Date.now() + 10 * 60_000 });
+  return { token, ...may };
+}
+
+/** Whether the request comes from someone who can save the site (also an app's own addresses, /api/<app>/, given to it by packages/editor/worker/index.js). */
+export const mayEdit = async (request) => (await access(request))?.push === true;
+
+/** Forgets what GitHub said about a token (it was revoked at "Log ud"). */
+export async function forget(token) {
+  known.delete(await keyOf(token));
+}