@morphemecms/cms 0.1.0 → 0.2.0-next-20261104150211

package/worker/r2-status.js

@@ -1,50 +1,50 @@
-// Whether R2 caching (packages/editor/worker/files.js, the binding FILES) can be turned on, for "Indstillinger" › "Avanceret" in the
-// editor (packages/editor/src/Advanced.tsx): the switch writes the bucket into the Worker's settings (wrangler.jsonc),
-// and a deploy with a bucket Cloudflare does not have fails, so it can only be turned on when Cloudflare says the bucket
-// is there (R2 turned on for the account, and the bucket made). Asked of Cloudflare's API with the Worker's own key, a
-// token that may only read R2 (the secret CLOUDFLARE_R2_TOKEN, and CLOUDFLARE_ACCOUNT_ID; docs/editor.md, Opsætning).
-//   GET /api/r2?bucket=<name>[&jurisdiction=<eu|fedramp>]  { bound, bucket }: whether this Worker has FILES now (the site is built with it), and the
-//     bucket at Cloudflare: "ready" (there), "no-bucket", "no-r2" (R2 not turned on), "no-key" (the Worker has no key),
-//     "refused" (Cloudflare said no to the key) or "failed". A bucket kept within a jurisdiction is only found in it.
-// Only someone who can save the site (write access to the repository on GitHub) can ask.
-import { json } from './not-found.js';
-import { mayEdit } from './session.js';
-
-// Cloudflare's codes for a bucket that is not there and for an account without R2.
-const NO_BUCKET = 10006;
-const NO_R2 = 10042;
-// R2's rule for a bucket's name.
-const NAME = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
-// The jurisdictions R2 can keep a bucket within.
-const JURISDICTION = /^(eu|fedramp)$/;
-
-export async function handleR2(request, env) {
-  if (!(await mayEdit(request))) return json({ error: 'forbidden' }, 403);
-  if (request.method !== 'GET') return json({ error: 'method' }, 405);
-  const params = new URL(request.url).searchParams;
-  const name = params.get('bucket') ?? '';
-  const jurisdiction = params.get('jurisdiction');
-  if (!NAME.test(name)) return json({ error: 'bucket' }, 400);
-  if (jurisdiction !== null && !JURISDICTION.test(jurisdiction)) return json({ error: 'jurisdiction' }, 400);
-  return json({ bound: !!env.FILES, bucket: await bucketAt(env, name, jurisdiction) });
-}
-
-async function bucketAt(env, name, jurisdiction) {
-  const account = env.CLOUDFLARE_ACCOUNT_ID?.trim();
-  const token = env.CLOUDFLARE_R2_TOKEN?.trim();
-  if (!account || !token) return 'no-key';
-  try {
-    const res = await fetch(`https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(account)}/r2/buckets/${name}`, {
-      headers: { authorization: `Bearer ${token}`, ...(jurisdiction ? { 'cf-r2-jurisdiction': jurisdiction } : {}) },
-    });
-    const body = await res.json().catch(() => ({}));
-    if (res.ok && body.success) return 'ready';
-    const codes = (body.errors ?? []).map((e) => e.code);
-    if (codes.includes(NO_R2)) return 'no-r2';
-    if (codes.includes(NO_BUCKET)) return 'no-bucket';
-    if (res.status === 401 || res.status === 403) return 'refused';
-    return 'failed';
-  } catch {
-    return 'failed';
-  }
-}
+// Whether R2 caching (packages/editor/worker/files.js, the binding FILES) can be turned on, for "Indstillinger" › "Avanceret" in the
+// editor (packages/editor/src/Advanced.tsx): the switch writes the bucket into the Worker's settings (wrangler.jsonc),
+// and a deploy with a bucket Cloudflare does not have fails, so it can only be turned on when Cloudflare says the bucket
+// is there (R2 turned on for the account, and the bucket made). Asked of Cloudflare's API with the Worker's own key, a
+// token that may only read R2 (the secret CLOUDFLARE_R2_TOKEN, and CLOUDFLARE_ACCOUNT_ID; docs/editor.md, Opsætning).
+//   GET /api/r2?bucket=<name>[&jurisdiction=<eu|fedramp>]  { bound, bucket }: whether this Worker has FILES now (the site is built with it), and the
+//     bucket at Cloudflare: "ready" (there), "no-bucket", "no-r2" (R2 not turned on), "no-key" (the Worker has no key),
+//     "refused" (Cloudflare said no to the key) or "failed". A bucket kept within a jurisdiction is only found in it.
+// Only someone who can save the site (write access to the repository on GitHub) can ask.
+import { json } from './not-found.js';
+import { mayEdit } from './session.js';
+
+// Cloudflare's codes for a bucket that is not there and for an account without R2.
+const NO_BUCKET = 10006;
+const NO_R2 = 10042;
+// R2's rule for a bucket's name.
+const NAME = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
+// The jurisdictions R2 can keep a bucket within.
+const JURISDICTION = /^(eu|fedramp)$/;
+
+export async function handleR2(request, env) {
+  if (!(await mayEdit(request))) return json({ error: 'forbidden' }, 403);
+  if (request.method !== 'GET') return json({ error: 'method' }, 405);
+  const params = new URL(request.url).searchParams;
+  const name = params.get('bucket') ?? '';
+  const jurisdiction = params.get('jurisdiction');
+  if (!NAME.test(name)) return json({ error: 'bucket' }, 400);
+  if (jurisdiction !== null && !JURISDICTION.test(jurisdiction)) return json({ error: 'jurisdiction' }, 400);
+  return json({ bound: !!env.FILES, bucket: await bucketAt(env, name, jurisdiction) });
+}
+
+async function bucketAt(env, name, jurisdiction) {
+  const account = env.CLOUDFLARE_ACCOUNT_ID?.trim();
+  const token = env.CLOUDFLARE_R2_TOKEN?.trim();
+  if (!account || !token) return 'no-key';
+  try {
+    const res = await fetch(`https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(account)}/r2/buckets/${name}`, {
+      headers: { authorization: `Bearer ${token}`, ...(jurisdiction ? { 'cf-r2-jurisdiction': jurisdiction } : {}) },
+    });
+    const body = await res.json().catch(() => ({}));
+    if (res.ok && body.success) return 'ready';
+    const codes = (body.errors ?? []).map((e) => e.code);
+    if (codes.includes(NO_R2)) return 'no-r2';
+    if (codes.includes(NO_BUCKET)) return 'no-bucket';
+    if (res.status === 401 || res.status === 403) return 'refused';
+    return 'failed';
+  } catch {
+    return 'failed';
+  }
+}

package/worker/session.js

@@ -1,58 +1,58 @@
-// The editor's GitHub sign-in, kept by the Worker: the token is in a cookie only the Worker can read (HttpOnly, on the
-// editor's own address, sent only with what the editor asks the Worker, /api/), never in the browser's storage, so no
-// script can take it away. Set by the sign-in (packages/editor/worker/oauth.js), cleared by "Log ud" (/api/github/logout,
-// packages/editor/worker/editor-github.js) and on the old address (packages/editor/worker/editor-host.js). See docs/editor.md.
-import { config } from '@site/config';
-
-const COOKIE = 'editor_session';
-// Until "Log ud": as long as a browser keeps a cookie (400 days).
-const KEEP = 400 * 24 * 60 * 60;
-
-/** The header that keeps the token in the browser. */
-export const sessionCookie = (token) => `${COOKIE}=${token}; Path=/api/; Max-Age=${KEEP}; HttpOnly; Secure; SameSite=Strict`;
-
-/** The header that removes it. */
-export const noSession = () => `${COOKIE}=; Path=/api/; Max-Age=0; HttpOnly; Secure; SameSite=Strict`;
-
-/** The token of the request's sign-in, or null. Only a request from the editor's own page counts: SameSite=Strict
- * still sends the cookie from a page on another address of the same domain (example.dk to editor.…). */
-export function sessionToken(request) {
-  const url = new URL(request.url);
-  const site = request.headers.get('sec-fetch-site');
-  const origin = request.headers.get('origin');
-  if (site ? site !== 'same-origin' : origin && origin !== url.origin) return null;
-  return request.headers.get('cookie')?.match(new RegExp(`(?:^|;\\s*)${COOKIE}=([^;]+)`))?.[1] ?? null;
-}
-
-// What GitHub said each token may do in the repository (by a hash of the token), for ten minutes, so not every request
-// asks.
-const known = new Map();
-const keyOf = async (token) => [...new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(token)))].join('.');
-
-/** What the request's sign-in may do in the site's repository: read it and save to it (`push`), as GitHub says; null
- * without a sign-in or when GitHub no longer knows it. `ask`: fetch for GitHub (packages/editor/worker/files.js counts its requests). */
-export async function access(request, ask = fetch) {
-  const token = sessionToken(request);
-  if (!token) return null;
-  const id = await keyOf(token);
-  const was = known.get(id);
-  if (was && was.until > Date.now()) return { token, read: was.read, push: was.push };
-  const res = await ask(`https://api.github.com/repos/${config.repo.owner}/${config.repo.name}`, {
-    headers: { authorization: `Bearer ${token}`, accept: 'application/vnd.github+json', 'user-agent': `${config.repo.name}-worker` },
-  });
-  // 401: the token is no good (signed out); otherwise GitHub does not show the repository to it (404), or failed.
-  if (res.status === 401) return null;
-  if (!res.ok) return { token, read: false, push: false };
-  const { permissions = {} } = await res.json().catch(() => ({}));
-  const may = { read: permissions.pull === true, push: permissions.push === true };
-  known.set(id, { ...may, until: Date.now() + 10 * 60_000 });
-  return { token, ...may };
-}
-
-/** Whether the request comes from someone who can save the site (also an app's own addresses, /api/<app>/, given to it by packages/editor/worker/index.js). */
-export const mayEdit = async (request) => (await access(request))?.push === true;
-
-/** Forgets what GitHub said about a token (it was revoked at "Log ud"). */
-export async function forget(token) {
-  known.delete(await keyOf(token));
-}
+// The editor's GitHub sign-in, kept by the Worker: the token is in a cookie only the Worker can read (HttpOnly, on the
+// editor's own address, sent only with what the editor asks the Worker, /api/), never in the browser's storage, so no
+// script can take it away. Set by the sign-in (packages/editor/worker/oauth.js), cleared by "Log ud" (/api/github/logout,
+// packages/editor/worker/editor-github.js) and on the old address (packages/editor/worker/editor-host.js). See docs/editor.md.
+import { config } from '@site/config';
+
+const COOKIE = 'editor_session';
+// Until "Log ud": as long as a browser keeps a cookie (400 days).
+const KEEP = 400 * 24 * 60 * 60;
+
+/** The header that keeps the token in the browser. */
+export const sessionCookie = (token) => `${COOKIE}=${token}; Path=/api/; Max-Age=${KEEP}; HttpOnly; Secure; SameSite=Strict`;
+
+/** The header that removes it. */
+export const noSession = () => `${COOKIE}=; Path=/api/; Max-Age=0; HttpOnly; Secure; SameSite=Strict`;
+
+/** The token of the request's sign-in, or null. Only a request from the editor's own page counts: SameSite=Strict
+ * still sends the cookie from a page on another address of the same domain (example.dk to editor.…). */
+export function sessionToken(request) {
+  const url = new URL(request.url);
+  const site = request.headers.get('sec-fetch-site');
+  const origin = request.headers.get('origin');
+  if (site ? site !== 'same-origin' : origin && origin !== url.origin) return null;
+  return request.headers.get('cookie')?.match(new RegExp(`(?:^|;\\s*)${COOKIE}=([^;]+)`))?.[1] ?? null;
+}
+
+// What GitHub said each token may do in the repository (by a hash of the token), for ten minutes, so not every request
+// asks.
+const known = new Map();
+const keyOf = async (token) => [...new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(token)))].join('.');
+
+/** What the request's sign-in may do in the site's repository: read it and save to it (`push`), as GitHub says; null
+ * without a sign-in or when GitHub no longer knows it. `ask`: fetch for GitHub (packages/editor/worker/files.js counts its requests). */
+export async function access(request, ask = fetch) {
+  const token = sessionToken(request);
+  if (!token) return null;
+  const id = await keyOf(token);
+  const was = known.get(id);
+  if (was && was.until > Date.now()) return { token, read: was.read, push: was.push };
+  const res = await ask(`https://api.github.com/repos/${config.repo.owner}/${config.repo.name}`, {
+    headers: { authorization: `Bearer ${token}`, accept: 'application/vnd.github+json', 'user-agent': `${config.repo.name}-worker` },
+  });
+  // 401: the token is no good (signed out); otherwise GitHub does not show the repository to it (404), or failed.
+  if (res.status === 401) return null;
+  if (!res.ok) return { token, read: false, push: false };
+  const { permissions = {} } = await res.json().catch(() => ({}));
+  const may = { read: permissions.pull === true, push: permissions.push === true };
+  known.set(id, { ...may, until: Date.now() + 10 * 60_000 });
+  return { token, ...may };
+}
+
+/** Whether the request comes from someone who can save the site (also an app's own addresses, /api/<app>/, given to it by packages/editor/worker/index.js). */
+export const mayEdit = async (request) => (await access(request))?.push === true;
+
+/** Forgets what GitHub said about a token (it was revoked at "Log ud"). */
+export async function forget(token) {
+  known.delete(await keyOf(token));
+}

package/worker/store.js

@@ -0,0 +1,46 @@
+// What the editor asks of the store, through the Worker (the store's key never leaves it): the catalog and the files in it.
+// Exposes handleStore(request, env, ctx, ask) and STORE_URL; used by packages/editor/worker/index.js (/api/store/*).
+// Depends on packages/editor/worker/session.js (sign-in and access) and packages/editor/lib/contracts.mjs (APP_API, THEME_API).
+//   GET /api/store/catalog       the store's catalog for this site's contracts; { connected: false } without MORPHEME_STORE_KEY
+//   GET /api/store/files/<oid>   a file of the store by its git id, streamed through with its content-type and cache-control
+import { APP_API, THEME_API } from '../lib/contracts.mjs';
+import { access, sessionToken } from './session.js';
+import { json } from './not-found.js';
+
+export const STORE_URL = 'https://morpheme-appstore.larsadolfsen.workers.dev';
+
+const OID = /^[0-9a-f]{40}$/;
+
+/** @param {Request} request @param {Record<string, any>} env @param {unknown} _ctx @param {typeof fetch} [ask] fetch, for the store and GitHub */
+export async function handleStore(request, env, _ctx, ask = fetch) {
+  if (!sessionToken(request)) return json({ error: 'signed out' }, 401);
+  const may = await access(request, ask);
+  if (!may) return json({ error: 'signed out' }, 401);
+  if (!may.read) return json({ error: 'forbidden' }, 403);
+  if (request.method !== 'GET') return json({ error: 'method' }, 405);
+  const route = new URL(request.url).pathname.slice('/api/store/'.length);
+  const isCatalog = route === 'catalog';
+  const oid = route.startsWith('files/') ? route.slice('files/'.length) : null;
+  if (!isCatalog && !(oid !== null && OID.test(oid))) return json({ error: 'not found' }, 404);
+  if (!env.MORPHEME_STORE_KEY) return isCatalog ? json({ connected: false }) : json({ error: 'not found' }, 404);
+
+  const base = env.MORPHEME_STORE_URL ?? STORE_URL;
+  const url = isCatalog ? `${base}/store/catalog?app=${APP_API}&theme=${THEME_API}` : `${base}/store/files/${oid}`;
+  let res;
+  try {
+    res = await ask(url, { headers: { authorization: `Bearer ${env.MORPHEME_STORE_KEY}` } });
+  } catch {
+    return json({ error: 'store failed' }, 502);
+  }
+  if (res.status === 401 || res.status === 403) return json({ error: 'store refused' }, 502);
+  if (!isCatalog && res.status === 404) return json({ error: 'not found' }, 404);
+  if (res.status !== 200) return json({ error: 'store failed' }, 502);
+  if (isCatalog) {
+    const catalog = await res.json().catch(() => null);
+    return catalog === null ? json({ error: 'store failed' }, 502) : json(catalog);
+  }
+  const headers = { 'content-type': res.headers.get('content-type') ?? 'application/octet-stream' };
+  const cache = res.headers.get('cache-control');
+  if (cache) headers['cache-control'] = cache;
+  return new Response(res.body, { status: 200, headers });
+}