@obelism/content 0.28.3 → 0.29.0

package/dist/site-m85jdjid.mjs

@@ -0,0 +1,360 @@
+import { n as normalizeUrl, a as DEFAULT_TIMEOUT, D as DEFAULT_URL } from './config-c6qktlz6.mjs';
+
+// The cookies in a `Cookie` header or `document.cookie`, by name: the first
+// of each name, percent-decoded when it decodes.
+const parseCookies = (header)=>{
+    const cookies = new Map();
+    for (const part of header.split(';')){
+        const index = part.indexOf('=');
+        if (index < 0) continue;
+        const name = part.slice(0, index).trim();
+        if (!name || cookies.has(name)) continue;
+        try {
+            cookies.set(name, decodeURIComponent(part.slice(index + 1).trim()));
+        } catch  {
+            cookies.set(name, part.slice(index + 1).trim());
+        }
+    }
+    return cookies;
+};
+
+// What a site's shop pages come in: the bridge's SHOP table is keyed by the
+// type, and the site's API routes are built from the list.
+const SHOP_KINDS = [
+    'product',
+    'collection'
+];
+
+// Every call the bridge makes through the site's `/cms/api/…`, and what the
+// site's handler (`createSiteEditing`, ./site) lets through: one list, so a
+// call the bridge makes can't be one the proxy refuses.
+//
+// The bridge goes through the site because the CMS token stays in an httpOnly
+// cookie on it (the CMS's docs/adr/0010).
+const entryPath = (entryId, suffix = '')=>`entries/${encodeURIComponent(entryId)}${suffix}`;
+const siteApi = {
+    session: ()=>'session',
+    pages: ()=>'pages',
+    stats: ()=>'stats',
+    form: ()=>'form',
+    createEntry: ()=>'entries',
+    shopPages: (kind)=>`${kind}-pages`,
+    entry: (entryId)=>entryPath(entryId),
+    preview: (entryId)=>entryPath(entryId, '/preview'),
+    prompt: (entryId)=>entryPath(entryId, '/prompt'),
+    view: (entryId)=>entryPath(entryId, '/view'),
+    apply: (entryId)=>entryPath(entryId, '/apply'),
+    save: (entryId)=>entryPath(entryId, '/save'),
+    publish: (entryId)=>entryPath(entryId, '/publish')
+};
+// Each call's route on the CMS's site API, as the site's proxy matches it: an
+// entry id is one path segment of word characters or dashes.
+const ROUTE = {
+    session: 'session',
+    pages: 'pages',
+    stats: 'stats',
+    form: 'form',
+    createEntry: 'entries',
+    shopPages: `(?:${SHOP_KINDS.join('|')})-pages`,
+    entry: 'entries/[\\w-]+',
+    preview: 'entries/[\\w-]+/preview',
+    prompt: 'entries/[\\w-]+/prompt',
+    view: 'entries/[\\w-]+/view',
+    apply: 'entries/[\\w-]+/apply',
+    save: 'entries/[\\w-]+/save',
+    publish: 'entries/[\\w-]+/publish'
+};
+// The method each call is made with. The proxy lets only that one through.
+const SITE_METHOD = {
+    session: 'GET',
+    pages: 'GET',
+    stats: 'POST',
+    form: 'POST',
+    createEntry: 'POST',
+    shopPages: 'POST',
+    entry: 'GET',
+    preview: 'POST',
+    prompt: 'POST',
+    view: 'POST',
+    apply: 'POST',
+    save: 'POST',
+    publish: 'POST'
+};
+// Whether the site's proxy lets this method and route through.
+const siteApiAllows = (method, route)=>Object.keys(siteApi).some((name)=>SITE_METHOD[name] === method && new RegExp(`^${ROUTE[name]}$`).test(route));
+
+// Editing on your own site, outside the visual editor
+// (https://content.obelism.studio/docs/guides/site-editing). One handler
+// serves everything under `/cms` (the `basePath`) on your site:
+//
+// - `/cms/login?return_to=/pricing` — sends the browser to Obelism Content
+//   to sign in, with a PKCE challenge, and…
+// - `/cms/callback` — …takes it back: trades the one-time code for a site
+//   token, keeps it in an httpOnly cookie, calls `onSignIn` (turn on your
+//   framework's draft mode there) and returns to `return_to`.
+// - `/cms/logout` — ends the session in the CMS, clears the cookies, calls
+//   `onSignOut`.
+// - `/cms/api/…` — what the bridge's prompt bar calls in the browser,
+//   forwarded to the CMS with the token. The token never reaches page
+//   scripts.
+//
+// While signed in, render drafts by reading the delivery API with the token
+// (`readSiteToken`), and the bridge shows the prompt bar with Save and
+// Publish.
+const SITE_TOKEN_COOKIE = 'obelism_content_token';
+// Readable by the page: tells the bridge the site is being edited, and where
+// this handler lives. Holds no secret.
+const SITE_EDITING_COOKIE = 'obelism_content_editing';
+const FLOW_COOKIE = 'obelism_content_flow';
+// The bridge sends it with every write, which a cross-site form can't.
+const SITE_REQUEST_HEADER = 'x-obelism-content';
+const SITE_PATH = '/api/site/v1';
+const FLOW_MAX_AGE = 10 * 60;
+// The site token from a Cookie header (or a framework's cookie store), or
+// null when not signed in to edit:
+//
+//   const token = readSiteToken(request.headers.get('cookie'))
+//   const content = token ? new ContentClient({ token, init: { cache: 'no-store' } }) : delivery
+const readSiteToken = (cookies)=>{
+    if (!cookies) return null;
+    if (typeof cookies !== 'string') return cookies.get(SITE_TOKEN_COOKIE)?.value || null;
+    return parseCookies(cookies).get(SITE_TOKEN_COOKIE) || null;
+};
+const serializeCookie = (name, value, { maxAge, path, httpOnly, secure })=>[
+        `${name}=${encodeURIComponent(value)}`,
+        `Path=${path}`,
+        `Max-Age=${Math.max(0, Math.floor(maxAge))}`,
+        // Also Expires: Next.js re-serializes response cookies when draft mode
+        // changes, and drops a Max-Age of 0.
+        `Expires=${new Date(maxAge > 0 ? Date.now() + maxAge * 1000 : 0).toUTCString()}`,
+        'SameSite=Lax',
+        httpOnly && 'HttpOnly',
+        secure && 'Secure'
+    ].filter(Boolean).join('; ');
+const base64Url = (bytes)=>{
+    let binary = '';
+    for (const byte of bytes)binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+const randomString = (bytes = 32)=>base64Url(crypto.getRandomValues(new Uint8Array(bytes)));
+const pkceChallenge = async (verifier)=>base64Url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))));
+const PLACEHOLDER_ORIGIN = 'https://site.invalid';
+// Only a path on this site: never an open redirect. Resolved the way a
+// browser reads Location, which drops tabs and newlines and reads \ as /.
+const safeReturnTo = (value)=>{
+    if (!value?.startsWith('/')) return '/';
+    const url = new URL(value, PLACEHOLDER_ORIGIN);
+    return url.origin === PLACEHOLDER_ORIGIN ? `${url.pathname}${url.search}${url.hash}` : '/';
+};
+const normalizeBasePath = (basePath)=>`/${basePath.replace(/^\/+|\/+$/g, '')}`;
+// The handler for everything under `basePath`. In Next.js:
+//
+//   // app/cms/[...path]/route.ts
+//   const handler = createSiteEditing({
+//     spaceId: process.env.CONTENT_SPACE_ID!,
+//     environment: 'production',
+//     onSignIn: async () => (await draftMode()).enable(),
+//     onSignOut: async () => (await draftMode()).disable(),
+//   })
+//   export { handler as GET, handler as POST }
+const createSiteEditing = ({ spaceId, environment, url, basePath = '/cms', siteUrl, onSignIn, onSignOut, timeout = DEFAULT_TIMEOUT, fetch: fetchImpl })=>{
+    const cms = normalizeUrl(url || DEFAULT_URL);
+    const base = normalizeBasePath(basePath);
+    const doFetch = fetchImpl ?? ((...args)=>fetch(...args));
+    const callCms = (path, init = {})=>doFetch(`${cms}${SITE_PATH}/${path}`, {
+            ...init,
+            redirect: 'manual',
+            signal: AbortSignal.timeout(timeout)
+        });
+    return async (request)=>{
+        const requestUrl = new URL(request.url);
+        const origin = siteUrl ? normalizeUrl(siteUrl) : requestUrl.origin;
+        const secure = origin.startsWith('https:');
+        const redirectUri = `${origin}${base}/callback`;
+        const cookies = parseCookies(request.headers.get('cookie') ?? '');
+        const path = requestUrl.pathname.startsWith(`${base}/`) ? requestUrl.pathname.slice(base.length + 1) : null;
+        const sessionCookies = (session)=>[
+                serializeCookie(SITE_TOKEN_COOKIE, session.token, {
+                    maxAge: session.maxAge,
+                    path: '/',
+                    httpOnly: true,
+                    secure
+                }),
+                serializeCookie(SITE_EDITING_COOKIE, session.token ? base : '', {
+                    maxAge: session.maxAge,
+                    path: '/',
+                    httpOnly: false,
+                    secure
+                })
+            ];
+        const clearedCookies = ()=>sessionCookies({
+                token: '',
+                maxAge: 0
+            });
+        const redirect = (location, setCookies = [])=>{
+            const headers = new Headers({
+                Location: location,
+                'Cache-Control': 'no-store'
+            });
+            for (const cookie of setCookies)headers.append('Set-Cookie', cookie);
+            return new Response(null, {
+                status: 302,
+                headers
+            });
+        };
+        if (path === 'login' && request.method === 'GET') {
+            const state = randomString(16);
+            const verifier = randomString(48);
+            const flow = JSON.stringify({
+                state,
+                verifier,
+                returnTo: safeReturnTo(requestUrl.searchParams.get('return_to'))
+            });
+            const connect = new URL(`${cms}/site/connect`);
+            connect.search = new URLSearchParams({
+                space: spaceId,
+                environment,
+                redirect_uri: redirectUri,
+                state,
+                code_challenge: await pkceChallenge(verifier),
+                code_challenge_method: 'S256'
+            }).toString();
+            return redirect(connect.toString(), [
+                serializeCookie(FLOW_COOKIE, flow, {
+                    maxAge: FLOW_MAX_AGE,
+                    path: base,
+                    httpOnly: true,
+                    secure
+                })
+            ]);
+        }
+        if (path === 'callback' && request.method === 'GET') {
+            const clearFlow = serializeCookie(FLOW_COOKIE, '', {
+                maxAge: 0,
+                path: base,
+                httpOnly: true,
+                secure
+            });
+            let flow;
+            try {
+                flow = JSON.parse(cookies.get(FLOW_COOKIE) ?? '');
+            } catch  {
+                flow = {};
+            }
+            const code = requestUrl.searchParams.get('code');
+            if (!code || typeof flow.state !== 'string' || typeof flow.verifier !== 'string' || flow.state !== requestUrl.searchParams.get('state')) {
+                return textResponse(400, 'This sign-in link is invalid or expired. Start again from the login link.', [
+                    clearFlow
+                ]);
+            }
+            const response = await callCms('token', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({
+                    code,
+                    code_verifier: flow.verifier,
+                    redirect_uri: redirectUri
+                })
+            });
+            if (!response.ok) {
+                return textResponse(400, 'Obelism Content did not accept the sign-in. Start again from the login link.', [
+                    clearFlow
+                ]);
+            }
+            const session = await response.json();
+            await onSignIn?.(session);
+            const maxAge = (Date.parse(session.expiresAt) - Date.now()) / 1000;
+            return redirect(safeReturnTo(flow.returnTo), [
+                clearFlow,
+                ...sessionCookies({
+                    token: session.token,
+                    maxAge
+                })
+            ]);
+        }
+        if (path === 'logout') {
+            const token = cookies.get(SITE_TOKEN_COOKIE);
+            if (token) {
+                await callCms('session', {
+                    method: 'DELETE',
+                    headers: {
+                        Authorization: `Bearer ${token}`
+                    }
+                }).catch(()=>null);
+            }
+            await onSignOut?.();
+            return redirect(safeReturnTo(requestUrl.searchParams.get('return_to')), clearedCookies());
+        }
+        if (path?.startsWith('api/')) {
+            const route = path.slice('api/'.length);
+            if (!siteApiAllows(request.method, route)) {
+                return Response.json({
+                    error: 'Not found'
+                }, {
+                    status: 404
+                });
+            }
+            if (request.method !== 'GET' && request.headers.get(SITE_REQUEST_HEADER) !== '1') {
+                return Response.json({
+                    error: 'Forbidden'
+                }, {
+                    status: 403
+                });
+            }
+            const token = cookies.get(SITE_TOKEN_COOKIE);
+            if (!token) {
+                return Response.json({
+                    error: 'Not signed in'
+                }, {
+                    status: 401
+                });
+            }
+            const response = await callCms(route, {
+                method: request.method,
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    ...request.method !== 'GET' && {
+                        'Content-Type': 'application/json'
+                    }
+                },
+                ...request.method !== 'GET' && {
+                    body: await request.text()
+                }
+            });
+            const headers = new Headers({
+                'Content-Type': 'application/json',
+                'Cache-Control': 'no-store'
+            });
+            // The session ended in the CMS: stop showing the editing UI.
+            if (response.status === 401) {
+                for (const cookie of clearedCookies()){
+                    headers.append('Set-Cookie', cookie);
+                }
+            }
+            return new Response(await response.text(), {
+                status: response.status,
+                headers
+            });
+        }
+        return Response.json({
+            error: 'Not found'
+        }, {
+            status: 404
+        });
+    };
+};
+const textResponse = (status, text, setCookies)=>{
+    const headers = new Headers({
+        'Content-Type': 'text/plain; charset=utf-8',
+        'Cache-Control': 'no-store'
+    });
+    for (const cookie of setCookies)headers.append('Set-Cookie', cookie);
+    return new Response(text, {
+        status,
+        headers
+    });
+};
+
+export { SITE_EDITING_COOKIE as S, SITE_REQUEST_HEADER as a, SITE_TOKEN_COOKIE as b, createSiteEditing as c, pkceChallenge as d, safeReturnTo as e, parseCookies as p, readSiteToken as r, siteApi as s };