@nuxt-customer-portal/core 0.3.1 → 0.3.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @nuxt-customer-portal/core
 
+## 0.3.2
+
+### Patch Changes
+
+- f23f664: Add opt-in server restrictions for shared demo deployments, protecting accounts and access settings and preventing all outgoing email. The private example apps now support anonymous sample identities, shared historical business data, user switching, and transactional daily resets at midnight Europe/Amsterdam.
+
 ## 0.3.1
 
 ## 0.3.0

package/nuxt.config.ts

@@ -18,6 +18,7 @@ export default defineNuxtConfig({
     ]
   },
   runtimeConfig: {
+    portalDemo: { enabled: false },
     portalEmail: {
       templateStorage: 'assets:portal-core',
       brandingSource: 'runtime',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxt-customer-portal/core",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "license": "MIT",
   "homepage": "https://nuxt-customer-portal.com",
   "repository": {

package/portal.manifest.mjs

@@ -1,6 +1,6 @@
 export default {
   id: 'core',
-  version: '0.3.1',
+  version: '0.3.2',
   source: '@nuxt-customer-portal/core',
   dependsOn: [],
   schema: './server/db/schema/index.ts',

package/server/middleware/00-demo-guard.ts

@@ -0,0 +1,9 @@
+import { defineEventHandler } from 'h3'
+import { isPortalDemo, rejectDemoAction } from '../utils/demo'
+import { isDemoRequestAllowed } from '../../shared/demo-policy'
+
+export default defineEventHandler((event) => {
+  if (isPortalDemo() && !isDemoRequestAllowed(event.method, event.path)) {
+    rejectDemoAction(event)
+  }
+})

package/server/utils/auth.ts

@@ -1,3 +1,5 @@
+import { isPortalDemo } from './demo'
+import { demoMessage, isDemoRequestAllowed } from '../../shared/demo-policy'
 import { betterAuth } from 'better-auth'
 import { APIError, createAuthMiddleware, getSessionFromCtx } from 'better-auth/api'
 import { drizzleAdapter } from 'better-auth/adapters/drizzle'
@@ -35,7 +37,7 @@ const registrationMode = ['open', 'invitation-only', 'disabled'].includes(proces
   : portalAuthConfig.registrationMode
 const githubEnabled = envFlag(process.env.PORTAL_GITHUB_ENABLED, portalAuthConfig.githubEnabled)
 const googleEnabled = envFlag(process.env.PORTAL_GOOGLE_ENABLED, portalAuthConfig.googleEnabled)
-const systemAdminEmails = parseSystemAdminEmails(process.env.ADMIN_EMAILS)
+const systemAdminEmails = isPortalDemo() ? new Set<string>() : parseSystemAdminEmails(process.env.ADMIN_EMAILS)
 
 export const auth = betterAuth({
   baseURL: process.env.BETTER_AUTH_URL || process.env.PUBLIC_URL || 'http://localhost:3051',
@@ -55,6 +57,15 @@ export const auth = betterAuth({
   }),
   hooks: {
     before: createAuthMiddleware(async (ctx) => {
+      if (
+        isPortalDemo() &&
+        !isDemoRequestAllowed(ctx.request?.method || (ctx.body ? 'POST' : 'GET'), `/api/auth${ctx.path}`)
+      ) {
+        throw new APIError('FORBIDDEN', {
+          code: 'DEMO_RESTRICTED',
+          message: demoMessage(ctx.headers?.get('accept-language') || '')
+        })
+      }
       if (ctx.path !== '/organization/list-members' && ctx.path !== '/organization/list-invitations') {
         return
       }

package/server/utils/demo.ts

@@ -0,0 +1,13 @@
+import { createError, getCookie, getHeader, type H3Event } from 'h3'
+import { demoMessage } from '../../shared/demo-policy'
+
+export const isPortalDemo = () => useRuntimeConfig().portalDemo?.enabled === true
+export function rejectDemoAction(event?: H3Event): never {
+  const message = demoMessage(event ? getCookie(event, 'i18n_redirected') || getHeader(event, 'accept-language') : '')
+  throw createError({
+    statusCode: 403,
+    statusMessage: 'Demo action unavailable',
+    message,
+    data: { code: 'DEMO_RESTRICTED', message }
+  })
+}

package/server/utils/portal-email.ts

@@ -1,3 +1,4 @@
+import { isPortalDemo, rejectDemoAction } from './demo'
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto'
 import { eq } from 'drizzle-orm'
 import { createError } from 'h3'
@@ -302,6 +303,9 @@ const providerConfiguration = async () => {
 }
 
 export const getPortalEmailProviderStatus = async () => {
+  if (isPortalDemo()) {
+    rejectDemoAction()
+  }
   const settings = await getPortalEmailSettings()
   if (!settings.configured) {
     return { ...settings, verifiedDomains: [] as string[] }
@@ -389,6 +393,9 @@ export const sendPortalEmail = async (input: {
   attachments?: PortalEmailAttachment[]
   idempotencyKey?: string
 }) => {
+  if (isPortalDemo()) {
+    rejectDemoAction()
+  }
   const [rendered, provider] = await Promise.all([
     renderPortalEmail({ ...input, inlineBrandAssets: true }),
     providerConfiguration()
@@ -415,6 +422,9 @@ export const sendPortalEmail = async (input: {
 }
 
 export const retrievePortalEmail = async (providerMessageId: string) => {
+  if (isPortalDemo()) {
+    rejectDemoAction()
+  }
   const provider = await providerConfiguration()
   const { data, error } = await new Resend(provider.apiKey).emails.get(providerMessageId)
   if (error) {

package/shared/demo-policy.ts

@@ -0,0 +1,75 @@
+export const demoMessages = {
+  en: 'This action is unavailable in the demo. No changes have been applied.',
+  nl: 'Deze actie is niet beschikbaar in de demo. Er zijn geen wijzigingen toegepast.'
+} as const
+
+export function demoMessage(locale = '') {
+  return demoMessages[locale.toLowerCase().startsWith('nl') ? 'nl' : 'en']
+}
+
+// Explicit allowlists keep newly introduced account endpoints closed in demos.
+export function isDemoRequestAllowed(method: string, rawPath: string): boolean {
+  let path: string
+  try {
+    path = decodeURIComponent(rawPath.split('?')[0]!).replace(/\/+$/, '')
+  } catch {
+    return false
+  }
+  if (path.includes('\\') || path.split('/').some((part) => part === '..' || part === '.')) {
+    return false
+  }
+  const read = method === 'GET' || method === 'HEAD'
+  if (path.startsWith('/api/auth/')) {
+    const route = path.slice('/api/auth/'.length)
+    if (read) {
+      return [
+        'get-session',
+        'open-api/generate-schema',
+        'permissions',
+        'list-sessions',
+        'list-accounts',
+        'organization/list',
+        'organization/get-full-organization',
+        'organization/list-members',
+        'organization/list-invitations',
+        'organization/get-active-member',
+        'organization/get-active-member-role',
+        'organization/get-invitation',
+        'admin/list-users',
+        'admin/get-user',
+        'admin/list-user-sessions'
+      ].includes(route)
+    }
+    return (
+      method === 'POST' &&
+      ['organization/set-active', 'organization/has-permission', 'admin/has-permission'].includes(route)
+    )
+  }
+  if (!path.startsWith('/api/')) {
+    return true
+  }
+  if (read) {
+    return true
+  }
+  if (path === '/api/demo/switch') {
+    return method === 'POST'
+  }
+  if (
+    /\/(members|invitations|reviewers|viewers|modules|internal-approvals|team|organization-capabilities|client-settings)(\/|$)/.test(
+      path
+    )
+  ) {
+    // Submitting an approval is business activity; configuring approvers changes access.
+    return method === 'POST' && /^\/api\/timesheets\/internal-approvals\/[^/]+$/.test(path)
+  }
+  if (/^\/api\/(profile|auth|admin|organizations)(\/|$)/.test(path)) {
+    return false
+  }
+  if (/^\/api\/timesheets\/admin\/(clients|settings)(\/|$)/.test(path) || path === '/api/invoices/admin/settings') {
+    return false
+  }
+  if (/\/(email|email-status|reminder)(\/|$)/.test(path)) {
+    return false
+  }
+  return /^\/api\/(clients|service-requests|timesheets|invoices|invoice-timesheets)(\/|$)/.test(path)
+}