@nickmeriano/task 0.1.0

package/src/server.ts

@@ -0,0 +1,311 @@
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http"
+import { watch, existsSync, readFileSync, statSync, type FSWatcher } from "node:fs"
+import { extname, join, normalize } from "node:path"
+import { fileURLToPath } from "node:url"
+import { resolveAuthor } from "./author.js"
+import { findBoards, TaskStore, type BoardRef } from "./store.js"
+import { STATUSES, isStatus, type TaskPatch } from "./types.js"
+
+/** The prebuilt SPA, shipped inside the package next to dist/. */
+const UI_DIR = fileURLToPath(new URL("../ui/dist", import.meta.url))
+
+const MIME: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript",
+  ".css": "text/css",
+  ".svg": "image/svg+xml",
+  ".json": "application/json",
+  ".png": "image/png",
+  ".ico": "image/x-icon",
+  ".woff2": "font/woff2",
+  ".map": "application/json",
+}
+
+function json(res: ServerResponse, status: number, body: unknown): void {
+  const data = JSON.stringify(body)
+  res.writeHead(status, { "Content-Type": "application/json" })
+  res.end(data)
+}
+
+async function readBody(req: IncomingMessage): Promise<Record<string, unknown>> {
+  const chunks: Buffer[] = []
+  for await (const chunk of req) chunks.push(chunk as Buffer)
+  const text = Buffer.concat(chunks).toString("utf8")
+  if (!text) return {}
+  return JSON.parse(text) as Record<string, unknown>
+}
+
+function parsePatch(body: Record<string, unknown>): TaskPatch {
+  const patch: TaskPatch = {}
+  if (typeof body.title === "string") patch.title = body.title
+  if (typeof body.description === "string") patch.description = body.description
+  if (typeof body.status === "string") {
+    if (!isStatus(body.status)) throw new Error(`invalid status: ${body.status}`)
+    patch.status = body.status
+  }
+  if (Array.isArray(body.tags)) patch.tags = body.tags.map(String)
+  if (typeof body.milestone === "string" || body.milestone === null) {
+    patch.milestone = body.milestone === "" ? null : body.milestone
+  }
+  if (typeof body.needsHuman === "boolean") patch.needsHuman = body.needsHuman
+  if (typeof body.position === "number") patch.position = body.position
+  return patch
+}
+
+/**
+ * `task serve` — one plain node:http server for the static UI, the JSON API,
+ * and an SSE stream that pings whenever anything writes to a `.task/` (the UI
+ * itself, another terminal, or an agent running the CLI). The UI refetches on
+ * every ping, so "realtime" is just fs.watch + a debounce — no sockets, no
+ * state to reconcile.
+ *
+ * Serves every board found at or below `serveRoot` (see `findBoards`): API
+ * requests pick one with `?board=<id>`, defaulting to the first. One board is
+ * the common case and behaves exactly as before.
+ */
+export function createTaskServer(serveRoot: string): Server {
+  const clients = new Set<ServerResponse>()
+
+  // Identity is resolved here, server-side, once: the board runs on your own
+  // machine as you, so there is no login — and nothing a browser sends about
+  // who it is can be trusted or is worth trusting. All boards live in the
+  // same checkout, so one resolution covers them all.
+  const author = resolveAuthor(undefined, serveRoot).name
+
+  const changed = new Set<string>()
+  let pending: NodeJS.Timeout | null = null
+  const noteChange = (id: string) => {
+    changed.add(id)
+    if (pending) return
+    pending = setTimeout(() => {
+      pending = null
+      const ids = [...changed]
+      changed.clear()
+      for (const id of ids) {
+        const message = `data: ${JSON.stringify({ type: "change", board: id })}\n\n`
+        for (const client of clients) client.write(message)
+      }
+    }, 80)
+  }
+
+  interface Board {
+    store: TaskStore
+    watcher: FSWatcher
+  }
+  const boards = new Map<string, Board>()
+  let ordered: string[] = []
+
+  const openBoard = (ref: BoardRef): void => {
+    const store = new TaskStore(ref.root)
+    const watcher = watch(store.taskDir, () => noteChange(ref.id))
+    // A deleted board dir can make fs.watch emit; the next rescan cleans up.
+    watcher.on("error", () => {})
+    boards.set(ref.id, { store, watcher })
+  }
+
+  /** Reconcile open boards with what's on disk; cheap enough to run per request. */
+  const syncBoards = (): BoardRef[] => {
+    const found = findBoards(serveRoot)
+    const ids = new Set(found.map((ref) => ref.id))
+    for (const [id, board] of boards) {
+      if (!ids.has(id)) {
+        board.watcher.close()
+        board.store.close()
+        boards.delete(id)
+      }
+    }
+    for (const ref of found) if (!boards.has(ref.id)) openBoard(ref)
+    ordered = found.map((ref) => ref.id)
+    return found
+  }
+
+  syncBoards()
+  if (boards.size === 0) {
+    throw new Error(`no .task directory found at or below ${serveRoot} — run \`task init\` first`)
+  }
+
+  const heartbeat = setInterval(() => {
+    for (const client of clients) client.write(`: ping\n\n`)
+  }, 30_000)
+
+  const server = createServer((req, res) => {
+    try {
+      route(req, res)
+    } catch (error) {
+      json(res, 400, { error: error instanceof Error ? error.message : String(error) })
+    }
+  })
+
+  server.on("close", () => {
+    if (pending) clearTimeout(pending)
+    clearInterval(heartbeat)
+    for (const board of boards.values()) {
+      board.watcher.close()
+      board.store.close()
+    }
+    for (const client of clients) client.end()
+  })
+
+  function route(req: IncomingMessage, res: ServerResponse): void {
+    const url = new URL(req.url ?? "/", "http://localhost")
+    const path = url.pathname
+
+    if (path === "/api/events") {
+      res.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        Connection: "keep-alive",
+      })
+      res.write(`retry: 1000\n\n`)
+      clients.add(res)
+      req.on("close", () => clients.delete(res))
+      return
+    }
+
+    if (path === "/api/boards") {
+      const found = syncBoards()
+      json(res, 200, {
+        boards: found.map((ref) => {
+          const { config } = boards.get(ref.id)!.store
+          return { id: ref.id, name: config.name, prefix: config.prefix }
+        }),
+      })
+      return
+    }
+
+    if (path.startsWith("/api/")) {
+      const id = url.searchParams.get("board") ?? ordered[0]
+      const board = boards.get(id)
+      if (!board) {
+        json(res, 404, { error: `no such board: ${id}` })
+        return
+      }
+      routeApi(board.store, req, res, path)
+      return
+    }
+
+    serveStatic(path, res)
+  }
+
+  function routeApi(
+    store: TaskStore,
+    req: IncomingMessage,
+    res: ServerResponse,
+    path: string,
+  ): void {
+    if (path === "/api/project") {
+      json(res, 200, {
+        name: store.config.name,
+        prefix: store.config.prefix,
+        statuses: STATUSES,
+        author,
+      })
+      return
+    }
+
+    if (path === "/api/tasks" && req.method === "GET") {
+      const counts = store.commentCounts()
+      const tasks = store
+        .list()
+        .map((t) => ({ ...t, commentCount: counts.get(t.number) ?? 0 }))
+      json(res, 200, { tasks })
+      return
+    }
+
+    if (path === "/api/tasks" && req.method === "POST") {
+      void readBody(req)
+        .then((body) => {
+          if (typeof body.title !== "string" || !body.title.trim()) {
+            throw new Error("title is required")
+          }
+          const patch = parsePatch(body)
+          const task = store.create({ title: body.title.trim(), ...patch })
+          json(res, 201, { task })
+        })
+        .catch((error: Error) => json(res, 400, { error: error.message }))
+      return
+    }
+
+    const taskMatch = /^\/api\/tasks\/([^/]+)(\/comments(?:\/(\d+))?)?$/.exec(path)
+    if (taskMatch) {
+      const number = store.parseId(decodeURIComponent(taskMatch[1]))
+      if (taskMatch[3] && req.method === "DELETE") {
+        const commentId = Number(taskMatch[3])
+        const existing = store.comments(number).find((c) => c.id === commentId)
+        if (!existing) {
+          json(res, 404, { error: `no such comment: ${commentId}` })
+          return
+        }
+        // Same identity rule as posting: the server's resolved author is the
+        // only author it trusts, so you can only delete what it says is yours.
+        if (existing.author !== author) {
+          json(res, 403, { error: "only your own comments can be deleted" })
+          return
+        }
+        store.deleteComment(number, commentId)
+        json(res, 200, { ok: true })
+        return
+      }
+      if (taskMatch[2] && !taskMatch[3] && req.method === "POST") {
+        void readBody(req)
+          .then((body) => {
+            if (typeof body.body !== "string" || !body.body.trim()) {
+              throw new Error("body is required")
+            }
+            // `body.author` is ignored on purpose — unauthenticated noise.
+            const comment = store.addComment(number, body.body.trim(), author)
+            json(res, 201, { comment })
+          })
+          .catch((error: Error) => json(res, 400, { error: error.message }))
+        return
+      }
+      if (!taskMatch[2]) {
+        if (req.method === "GET") {
+          const task = store.get(number)
+          if (!task) {
+            json(res, 404, { error: `no such task: ${store.displayId(number)}` })
+            return
+          }
+          json(res, 200, { task, comments: store.comments(number) })
+          return
+        }
+        if (req.method === "PATCH") {
+          void readBody(req)
+            .then((body) => {
+              const task = store.update(number, parsePatch(body))
+              json(res, 200, { task })
+            })
+            .catch((error: Error) => json(res, 400, { error: error.message }))
+          return
+        }
+        if (req.method === "DELETE") {
+          store.delete(number)
+          json(res, 200, { ok: true })
+          return
+        }
+      }
+    }
+
+    json(res, 404, { error: "not found" })
+  }
+
+  function serveStatic(path: string, res: ServerResponse): void {
+    const safe = normalize(path).replace(/^(\.\.[/\\])+/, "")
+    let file = join(UI_DIR, safe)
+    if (!existsSync(file) || statSync(file).isDirectory()) {
+      file = join(UI_DIR, "index.html") // SPA fallback
+    }
+    if (!existsSync(file)) {
+      res.writeHead(404, { "Content-Type": "text/plain" })
+      res.end("UI build not found — run the package build (vite build ui).")
+      return
+    }
+    res.writeHead(200, {
+      "Content-Type": MIME[extname(file)] ?? "application/octet-stream",
+      "Cache-Control": "no-cache",
+    })
+    res.end(readFileSync(file))
+  }
+
+  return server
+}