@nkzw/codiff-service 1.9.0

package/db.ts

@@ -0,0 +1,45 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { and, eq, gte, sql } from 'drizzle-orm';
+import { drizzle, type DrizzleD1Database } from 'drizzle-orm/d1';
+import schema from './schema.ts';
+
+export type Database = DrizzleD1Database<typeof schema>;
+export type D1Binding = Parameters<typeof drizzle>[0];
+export type DatabaseBatchStatement = Parameters<Database['batch']>[0][number];
+
+const databaseBatchSize = 500;
+const store = new AsyncLocalStorage<Database>();
+
+export const createDb = (binding: D1Binding): Database => drizzle(binding, { schema });
+
+export const withDatabase = <Value>(binding: D1Binding, callback: () => Value): Value =>
+  store.run(createDb(binding), callback);
+
+export const runDatabaseBatches = async (
+  database: Database,
+  statements: ReadonlyArray<DatabaseBatchStatement>,
+) => {
+  for (let index = 0; index < statements.length; index += databaseBatchSize) {
+    const chunk = statements.slice(index, index + databaseBatchSize);
+    const first = chunk[0];
+    if (first) {
+      await database.batch([first, ...chunk.slice(1)]);
+    }
+  }
+};
+
+const getDb = (): Database => {
+  const database = store.getStore();
+  if (!database) {
+    throw new Error('Codiff sharing database is unavailable.');
+  }
+  return database;
+};
+
+export const db = new Proxy({} as Database, {
+  get(_target, property, receiver) {
+    return Reflect.get(getDb(), property, receiver);
+  },
+});
+
+export { and, eq, gte, sql };

package/dist/api.mjs

@@ -0,0 +1,403 @@
+import { plan, shareDailyUsage, uploadIntent, user, walkthrough } from "./schema.mjs";
+import { db, eq, sql, withDatabase } from "./db.mjs";
+import { createUploadIntentSecret, hashUploadIntentSecret, verifyUploadIntentSecret } from "./upload-intent.mjs";
+import { parsePlanShareUpload } from "@nkzw/codiff-core/share";
+import { z } from "zod";
+//#region api.ts
+const boundedString = (maximum) => z.string().max(maximum);
+const nonEmptyString = (maximum) => z.string().min(1).max(maximum);
+const reviewAuthorSchema = z.object({
+	avatarUrl: boundedString(2048).optional(),
+	login: nonEmptyString(200),
+	name: nonEmptyString(200).optional()
+}).passthrough();
+const reviewCommentSchema = z.object({
+	anchor: z.enum(["file", "line"]).optional(),
+	author: reviewAuthorSchema,
+	body: boundedString(128 * 1024),
+	filePath: nonEmptyString(4096),
+	id: nonEmptyString(256),
+	isThreadResolved: z.boolean().optional(),
+	lineNumber: z.number().int().positive().optional(),
+	sectionId: nonEmptyString(4096).optional(),
+	side: z.enum(["additions", "deletions"]).optional(),
+	startLineNumber: z.number().int().positive().optional(),
+	startSide: z.enum(["additions", "deletions"]).optional(),
+	submittedAt: boundedString(64).optional(),
+	threadId: nonEmptyString(256).optional()
+}).passthrough().refine((comment) => comment.anchor === "file" || comment.lineNumber != null && comment.side != null && (comment.startLineNumber == null || comment.startSide != null), "Invalid walkthrough review comment.");
+const generalCommentSchema = z.object({
+	author: reviewAuthorSchema,
+	body: boundedString(128 * 1024),
+	id: nonEmptyString(256),
+	submittedAt: boundedString(64).optional()
+}).passthrough();
+const generalCommentThreadSchema = z.object({
+	comments: z.array(generalCommentSchema).max(1e3),
+	id: nonEmptyString(256),
+	isResolved: z.boolean().optional()
+}).passthrough();
+const walkthroughFileSchema = z.object({ path: nonEmptyString(4096) }).passthrough();
+const walkthroughSourceSchema = z.object({
+	host: boundedString(512).optional(),
+	number: z.number().int().positive().optional(),
+	projectPath: boundedString(4096).optional(),
+	title: boundedString(300).optional(),
+	type: nonEmptyString(64),
+	url: boundedString(4096).optional()
+}).passthrough();
+const walkthroughManifestSchema = z.object({
+	branch: boundedString(1024).optional(),
+	codiffVersion: nonEmptyString(100),
+	exportedAt: boundedString(64),
+	files: z.array(walkthroughFileSchema).max(1e5),
+	kind: z.literal("codiff-walkthrough-share"),
+	repository: z.object({
+		generalComments: z.array(generalCommentThreadSchema).max(1e3).optional(),
+		source: walkthroughSourceSchema.optional(),
+		title: boundedString(300).optional()
+	}).passthrough(),
+	reviewComments: z.array(reviewCommentSchema).max(1e4).optional(),
+	version: z.literal(1),
+	walkthrough: z.object({
+		summary: boundedString(128 * 1024).optional(),
+		title: nonEmptyString(300)
+	}).passthrough()
+}).passthrough();
+const uploaderSchema = z.object({
+	email: boundedString(320).optional(),
+	name: boundedString(200).optional()
+}).passthrough();
+const walkthroughUploadSchema = z.object({
+	snapshot: walkthroughManifestSchema,
+	uploader: uploaderSchema.optional()
+}).passthrough();
+const json = (value, init) => new Response(JSON.stringify(value), {
+	...init,
+	headers: {
+		"content-type": "application/json; charset=utf-8",
+		...init?.headers ?? {}
+	}
+});
+const notFound = () => json({ error: "not-found" }, { status: 404 });
+const badRequest = (message) => json({ error: message }, { status: 400 });
+const unauthorized = () => json({ error: "authentication-required" }, { status: 401 });
+const maxUploadByteSize = 25 * 1024 * 1024;
+const textEncoder = new TextEncoder();
+const isRecord = (value) => value !== null && typeof value === "object";
+const isBetterAuthApi = (value) => isRecord(value) && isRecord(value.api) && typeof value.api.getSession === "function";
+const stringValue = (value) => typeof value === "string" && value ? value : null;
+const shareUserFromAuthValue = (value) => {
+	const result = isRecord(value) && isRecord(value.response) ? value.response : value;
+	const userValue = isRecord(result) ? result.user : null;
+	if (!isRecord(userValue)) return null;
+	const id = stringValue(userValue.id);
+	const name = stringValue(userValue.name) ?? stringValue(userValue.username);
+	if (!id || !name) return null;
+	return {
+		id,
+		image: stringValue(userValue.image),
+		name,
+		username: stringValue(userValue.displayUsername) ?? stringValue(userValue.username)
+	};
+};
+const shareUserFromRow = (row) => row ? {
+	id: row.id,
+	image: row.image,
+	name: row.name,
+	username: row.displayUsername ?? row.username
+} : null;
+const getAuthenticatedShareUser = async (request, auth) => {
+	if (!isBetterAuthApi(auth)) return null;
+	try {
+		return shareUserFromAuthValue(await auth.api.getSession({
+			asResponse: false,
+			headers: request.headers,
+			returnHeaders: true
+		}));
+	} catch {
+		return null;
+	}
+};
+const getShareUserById = async (userId) => {
+	if (!userId) return null;
+	const [record] = await db.select().from(user).where(eq(user.id, userId)).limit(1);
+	return shareUserFromRow(record);
+};
+const randomToken = (bytes = 24) => {
+	const value = new Uint8Array(bytes);
+	crypto.getRandomValues(value);
+	return btoa(String.fromCharCode(...value)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+};
+const randomCode = () => randomToken(8).slice(0, 10).toUpperCase();
+const publicOrigin = (request, env) => {
+	const url = new URL(request.url);
+	return (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]" ? url.origin : env.PUBLIC_ORIGIN || url.origin).replace(/\/+$/, "");
+};
+const sha256 = async (value) => {
+	const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(value));
+	return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+};
+const cleanTitleValue = (value) => typeof value === "string" ? value.replaceAll(/\s+/g, " ").trim().slice(0, 300) || null : null;
+const cleanIdentityValue = (value, maxLength) => typeof value === "string" ? value.trim().slice(0, maxLength) || null : null;
+const sanitizeWalkthrough = (snapshot) => {
+	const repository = snapshot.repository;
+	const commitTitle = repository.source?.type === "commit" ? cleanTitleValue(repository.title) ?? cleanTitleValue(snapshot.walkthrough.title) : null;
+	const sanitizedRepository = {
+		...repository,
+		root: commitTitle ?? "Shared Codiff review",
+		...commitTitle ? { title: commitTitle } : {}
+	};
+	if (!commitTitle) delete sanitizedRepository.title;
+	return {
+		...snapshot,
+		repository: sanitizedRepository
+	};
+};
+const parseShareUpload = (body) => {
+	const payload = JSON.parse(body);
+	const snapshotValue = (isRecord(payload) ? payload : null)?.snapshot ?? payload;
+	if (!isRecord(snapshotValue) || snapshotValue.version !== 1) throw new Error("unsupported-manifest");
+	if (snapshotValue.kind === "codiff-walkthrough-share") {
+		const envelope = walkthroughUploadSchema.safeParse(payload);
+		const parsed = envelope.success ? envelope.data : { snapshot: walkthroughManifestSchema.parse(payload) };
+		return {
+			kind: "walkthrough",
+			sharedByEmail: cleanIdentityValue(parsed.uploader?.email, 320),
+			sharedByName: cleanIdentityValue(parsed.uploader?.name, 200),
+			snapshot: sanitizeWalkthrough(parsed.snapshot)
+		};
+	}
+	if (snapshotValue.kind !== "codiff-plan-share") throw new Error("unsupported-manifest");
+	const parsed = parsePlanShareUpload(payload);
+	return {
+		kind: "plan",
+		sharedByEmail: cleanIdentityValue(parsed.uploader?.email, 320),
+		sharedByName: cleanIdentityValue(parsed.uploader?.name, 200),
+		snapshot: parsed.snapshot
+	};
+};
+const parseGitPullRequestUrl = (value) => {
+	if (!value) return null;
+	try {
+		const url = new URL(value);
+		const gitLab = /^\/(.+)\/-\/merge_requests\/(\d+)(?:\/.*)?$/.exec(url.pathname);
+		if (gitLab) return {
+			host: url.host,
+			number: Number(gitLab[2]),
+			projectPath: decodeURIComponent(gitLab[1])
+		};
+		const gitHub = /^\/([^/]+)\/([^/]+)\/pull\/(\d+)(?:\/.*)?$/.exec(url.pathname);
+		if (gitHub) return {
+			host: url.host,
+			number: Number(gitHub[3]),
+			projectPath: `${decodeURIComponent(gitHub[1])}/${decodeURIComponent(gitHub[2])}`
+		};
+	} catch {
+		return null;
+	}
+	return null;
+};
+const getRepositoryMetadata = (source) => {
+	if (!source || source.type !== "pull-request") return null;
+	const parsed = parseGitPullRequestUrl(source.url);
+	const projectPath = source.projectPath || parsed?.projectPath;
+	const host = source.host || parsed?.host;
+	if (!projectPath || !host) return null;
+	const segments = projectPath.split("/");
+	return {
+		host,
+		name: segments.at(-1) ?? projectPath,
+		number: source.number ?? parsed?.number ?? null,
+		owner: segments.slice(0, -1).join("/") || null,
+		url: `https://${host}/${projectPath}`
+	};
+};
+const utcDateKey = (date = /* @__PURE__ */ new Date()) => date.toISOString().slice(0, 10);
+const quotaResponse = () => {
+	const now = /* @__PURE__ */ new Date();
+	const resetAt = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1));
+	return json({
+		error: "share-quota-exceeded",
+		resetAt: resetAt.toISOString()
+	}, {
+		headers: { "retry-after": String(Math.max(1, Math.ceil((+resetAt - +now) / 1e3))) },
+		status: 429
+	});
+};
+const hasAvailableQuota = async (userId, kind) => {
+	const [usage] = await db.select().from(shareDailyUsage).where(sql`${shareDailyUsage.userId} = ${userId} and ${shareDailyUsage.date} = ${utcDateKey()}`).limit(1);
+	if (!usage) return true;
+	return usage.planCount + usage.walkthroughCount < 100 && (kind === "plan" ? usage.planCount < 50 : kind === "walkthrough" ? usage.walkthroughCount < 50 : true);
+};
+const createUploadIntent = async (request, env, options) => {
+	const code = randomCode();
+	const now = /* @__PURE__ */ new Date();
+	const expiresAt = new Date(now.getTime() + 600 * 1e3);
+	const secret = await createUploadIntentSecret(env, code, expiresAt);
+	const tokenHash = await hashUploadIntentSecret(secret);
+	const shareUser = await getAuthenticatedShareUser(request, options.auth);
+	if (shareUser && options.enforceDailyQuota && !await hasAvailableQuota(shareUser.id)) return quotaResponse();
+	if (shareUser) await db.insert(uploadIntent).values({
+		claimedAt: now,
+		code,
+		expiresAt,
+		secretHash: tokenHash,
+		sharedByUserId: shareUser.id,
+		status: "claimed",
+		updatedAt: now,
+		uploadTokenHash: tokenHash
+	});
+	const origin = publicOrigin(request, env);
+	return json({
+		claimUrl: `${origin}/connect/${code}?secret=${secret}`,
+		code,
+		pollUrl: `${origin}/api/upload-intents/${code}?secret=${secret}`,
+		secret,
+		status: shareUser ? "claimed" : "pending"
+	});
+};
+const readUploadIntent = async (request, env, code) => {
+	const secret = new URL(request.url).searchParams.get("secret");
+	if (!secret) return badRequest("missing-secret");
+	const [intent] = await db.select().from(uploadIntent).where(eq(uploadIntent.code, code)).limit(1);
+	const tokenHash = await hashUploadIntentSecret(secret);
+	if (intent && intent.secretHash !== tokenHash) return notFound();
+	const pending = intent ? null : await verifyUploadIntentSecret(env, code, secret);
+	if (!intent && !pending) return notFound();
+	if ((intent?.expiresAt ?? pending.expiresAt).getTime() < Date.now() && intent?.status !== "uploaded") return json({ status: "expired" }, { status: 410 });
+	if (!intent) return json({ status: "pending" });
+	return json({
+		status: intent.status,
+		uploadToken: intent.status === "claimed" ? secret : void 0,
+		url: intent.status === "uploaded" && intent.walkthroughSlug ? `${publicOrigin(request, env)}/${intent.shareKind === "plan" ? "p" : "w"}/${intent.walkthroughSlug}` : void 0
+	});
+};
+const isQuotaError = (error) => error instanceof Error && error.message.toLowerCase().includes("share-quota-exceeded");
+const uploadShare = async (request, env, options) => {
+	const code = request.headers.get("x-codiff-upload-code");
+	const authorization = request.headers.get("authorization");
+	const token = authorization?.startsWith("Bearer ") ? authorization.slice(7) : null;
+	if (!code || !token) return unauthorized();
+	const [intent] = await db.select().from(uploadIntent).where(eq(uploadIntent.code, code)).limit(1);
+	if (!intent || intent.status !== "claimed" || !intent.sharedByUserId || intent.expiresAt.getTime() < Date.now() || intent.uploadTokenHash !== await sha256(token)) return unauthorized();
+	const body = await request.text();
+	if (textEncoder.encode(body).byteLength > maxUploadByteSize) return json({ error: "manifest-too-large" }, { status: 413 });
+	let upload;
+	try {
+		upload = parseShareUpload(body);
+	} catch (error) {
+		return badRequest(error instanceof Error && error.message === "unsupported-manifest" ? error.message : "invalid-manifest");
+	}
+	if (options.enforceDailyQuota && !await hasAvailableQuota(intent.sharedByUserId, upload.kind)) return quotaResponse();
+	const canonical = JSON.stringify(upload.snapshot);
+	const digest = await sha256(canonical);
+	const slug = randomToken(18);
+	const objectKey = `${upload.kind === "plan" ? "plans" : "walkthroughs"}/${slug}/manifest.json`;
+	const shareUser = await getShareUserById(intent.sharedByUserId);
+	if (!shareUser) return unauthorized();
+	const now = /* @__PURE__ */ new Date();
+	await env.WALKTHROUGH_BUCKET.put(objectKey, canonical, { httpMetadata: { contentType: "application/json; charset=utf-8" } });
+	try {
+		if (upload.kind === "walkthrough") {
+			const source = upload.snapshot.repository.source;
+			const repository = getRepositoryMetadata(source);
+			const commitTitle = source?.type === "commit" ? cleanTitleValue(upload.snapshot.repository.title) : null;
+			const walkthroughId = crypto.randomUUID();
+			await db.batch([db.insert(walkthrough).values({
+				branch: upload.snapshot.branch ?? null,
+				byteSize: textEncoder.encode(canonical).byteLength,
+				codiffVersion: upload.snapshot.codiffVersion,
+				description: upload.snapshot.walkthrough.summary ?? null,
+				id: walkthroughId,
+				objectKey,
+				pullRequestNumber: repository?.number ?? source?.number ?? null,
+				pullRequestTitle: source?.title ?? null,
+				pullRequestUrl: source?.type === "pull-request" ? source.url ?? null : null,
+				repositoryHost: repository?.host ?? null,
+				repositoryName: repository?.name ?? null,
+				repositoryOwner: repository?.owner ?? null,
+				repositoryUrl: repository?.url ?? null,
+				schemaVersion: upload.snapshot.version,
+				sha256: digest,
+				sharedByEmail: null,
+				sharedByName: null,
+				sharedByUserId: shareUser.id,
+				slug,
+				sourceType: source?.type ?? "unknown",
+				title: commitTitle ?? upload.snapshot.walkthrough.title,
+				updatedAt: now
+			}), db.update(uploadIntent).set({
+				shareKind: upload.kind,
+				status: "uploaded",
+				updatedAt: now,
+				walkthroughSlug: slug
+			}).where(eq(uploadIntent.id, intent.id))]);
+		} else await db.batch([db.insert(plan).values({
+			agent: cleanIdentityValue(upload.snapshot.source?.agent, 40),
+			byteSize: textEncoder.encode(canonical).byteLength,
+			codiffVersion: upload.snapshot.codiffVersion,
+			objectKey,
+			schemaVersion: upload.snapshot.version,
+			sessionId: cleanIdentityValue(upload.snapshot.source?.sessionId, 200),
+			sha256: digest,
+			sharedByEmail: null,
+			sharedByName: null,
+			sharedByUserId: shareUser.id,
+			slug,
+			sourceFileName: cleanTitleValue(upload.snapshot.document.name) ?? "plan.md",
+			title: cleanTitleValue(upload.snapshot.document.title) ?? "Codiff Plan",
+			updatedAt: now
+		}), db.update(uploadIntent).set({
+			shareKind: upload.kind,
+			status: "uploaded",
+			updatedAt: now,
+			walkthroughSlug: slug
+		}).where(eq(uploadIntent.id, intent.id))]);
+	} catch (error) {
+		await env.WALKTHROUGH_BUCKET.delete(objectKey);
+		if (isQuotaError(error)) return quotaResponse();
+		throw error;
+	}
+	options.onUploadIntentUpdated?.({
+		changed: upload.kind === "plan" ? [
+			"shareKind",
+			"status",
+			"walkthroughSlug"
+		] : ["status", "walkthroughSlug"],
+		id: intent.id,
+		shareKind: upload.kind,
+		walkthroughSlug: slug
+	});
+	return json({
+		slug,
+		status: "uploaded",
+		url: `${publicOrigin(request, env)}/${upload.kind === "plan" ? "p" : "w"}/${slug}`
+	});
+};
+const getManifest = async (env, kind, slug) => {
+	const [record] = kind === "plan" ? await db.select({ objectKey: plan.objectKey }).from(plan).where(eq(plan.slug, slug)).limit(1) : await db.select({ objectKey: walkthrough.objectKey }).from(walkthrough).where(eq(walkthrough.slug, slug)).limit(1);
+	if (!record) return notFound();
+	const object = await env.WALKTHROUGH_BUCKET.get(record.objectKey);
+	if (!object) return notFound();
+	return new Response(object.body, { headers: {
+		"cache-control": "private, no-store",
+		"content-type": "application/json; charset=utf-8",
+		"x-robots-tag": "noindex"
+	} });
+};
+const handleSharingApi = async (request, env, options) => {
+	const url = new URL(request.url);
+	const uploadIntentMatch = /^\/api\/upload-intents\/([^/]+)$/.exec(url.pathname);
+	const planManifestMatch = /^\/api\/plans\/([^/]+)\/manifest$/.exec(url.pathname);
+	const walkthroughManifestMatch = /^\/api\/walkthroughs\/([^/]+)\/manifest$/.exec(url.pathname);
+	if (request.method === "POST" && url.pathname === "/api/upload-intents") return createUploadIntent(request, env, options);
+	if (request.method === "GET" && uploadIntentMatch) return readUploadIntent(request, env, uploadIntentMatch[1]);
+	if (request.method === "POST" && url.pathname === "/api/uploads") return uploadShare(request, env, options);
+	if (request.method === "GET" && planManifestMatch) return getManifest(env, "plan", planManifestMatch[1]);
+	if (request.method === "GET" && walkthroughManifestMatch) return getManifest(env, "walkthrough", walkthroughManifestMatch[1]);
+	return notFound();
+};
+const handleSharingApiRequest = (request, env, options = {}) => withDatabase(env.DB, () => handleSharingApi(request, env, options));
+//#endregion
+export { getAuthenticatedShareUser, getRepositoryMetadata, handleSharingApiRequest, parseGitPullRequestUrl, parseShareUpload, shareUserFromAuthValue };

package/dist/db.mjs

@@ -0,0 +1,26 @@
+import schema from "./schema.mjs";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { and, eq, gte, sql } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/d1";
+//#region db.ts
+const databaseBatchSize = 500;
+const store = new AsyncLocalStorage();
+const createDb = (binding) => drizzle(binding, { schema });
+const withDatabase = (binding, callback) => store.run(createDb(binding), callback);
+const runDatabaseBatches = async (database, statements) => {
+	for (let index = 0; index < statements.length; index += databaseBatchSize) {
+		const chunk = statements.slice(index, index + databaseBatchSize);
+		const first = chunk[0];
+		if (first) await database.batch([first, ...chunk.slice(1)]);
+	}
+};
+const getDb = () => {
+	const database = store.getStore();
+	if (!database) throw new Error("Codiff sharing database is unavailable.");
+	return database;
+};
+const db = new Proxy({}, { get(_target, property, receiver) {
+	return Reflect.get(getDb(), property, receiver);
+} });
+//#endregion
+export { and, createDb, db, eq, gte, runDatabaseBatches, sql, withDatabase };