@omega.js/web 0.1.0

package/dist/vendor/devkit/license.js

@@ -0,0 +1,155 @@
+/**
+ * resolveLicenseVerdict — the deploy-time license check
+ * ([#320](https://github.com/Omega-JS-Stack/omega/issues/320)).
+ *
+ * A published OMEGA install needs a license to enable the payment system and
+ * remove the omega attribution. A license is a subscription bought on
+ * omegajs.dev and the KEY is that account's API key — opaque, one per account,
+ * unlimited brands for now. The verdict is decided SERVER-side: the key plus
+ * the brand id go to the omega brand's own backend and the resolved
+ * subscription on the answer decides. No offline signing, no local shape check.
+ *
+ * This module is the "get the verdict" half only. Each target's deploy asks
+ * once and bakes the answer into that artifact; runtime never phones home, so
+ * a cancelled key holds until the next deploy (accepted, spec call 3).
+ *
+ * Honesty system, deliberately (spec call 6): plain readable code, no
+ * obfuscation and no artifact signing. The legal backing is the package license
+ * (Elastic License 2.0), whose terms forbid circumventing license-key
+ * functionality and removing notices.
+ */
+
+const { isDemoProject } = require('../config/index.js');
+const { resolveSubscription } = require('../account/index.js');
+
+// The omega brand's own api host, HARDCODED. Every other api base in OMEGA is
+// derived from a brand's `brand.url` (api.<host>) because it belongs to that
+// brand — this one is the PRODUCT's license server, the same host for every
+// brand that installs OMEGA, so config can never name it.
+const LICENSE_ENDPOINT = 'https://api.omegajs.dev/omega/user';
+
+const FETCH_TIMEOUT_MS = 30 * 1000;
+
+// The one keyless answer: payments in test mode, attribution shown.
+function keyless(reason) {
+  return { licensed: false, payments: 'gated', attribution: 'shown', reason };
+}
+
+/**
+ * Resolve what a deploy is licensed to ship.
+ *
+ * @param {object} input
+ * @param {object} input.config - The resolved omega.json5 (brand.id, cloud.config.projectId).
+ * @param {object} [input.env] - The environment holding OMEGA_LICENSE_KEY (default: process.env).
+ * @param {function} [input.transport] - The fetch seam (default: global fetch).
+ * @returns {Promise<{ licensed: boolean, payments: 'live'|'gated', attribution: 'removed'|'shown', reason: string }>}
+ * @throws {Error} A key IS present but the server could not answer for it.
+ */
+async function resolveLicenseVerdict({ config, env = process.env, transport = fetch } = {}) {
+  const projectId = config?.cloud?.config?.projectId;
+
+  // Local dev, the test brands and every demo-* project run keyless forever
+  // (spec call 5) — the carve-out comes FIRST, so a developer with a real key
+  // in their shell still never spends a check on an emulator-only build.
+  if (isDemoProject(projectId)) {
+    return keyless(`${projectId} is a demo-* (emulator-only) project — no license check runs`);
+  }
+
+  const key = String(env.OMEGA_LICENSE_KEY || '').trim();
+  if (!key) {
+    return keyless('no OMEGA_LICENSE_KEY in the environment');
+  }
+
+  const url = new URL(LICENSE_ENDPOINT);
+  url.searchParams.set('apiKey', key);
+  // Sent on every check and ignored by the server today: it is what lets a
+  // future per-key brand limit be a server-side change alone (spec call 1).
+  url.searchParams.set('brandId', String(config?.brand?.id || ''));
+
+  let response;
+  try {
+    response = await transport(url.toString(), {
+      headers: { accept: 'application/json' },
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+  } catch (e) {
+    // LOUD: a key is present, so the brand believes it is licensed. Shipping a
+    // gated artifact because the network blinked would be the worst answer.
+    throw new Error(`OMEGA_LICENSE_KEY is set but the license server could not be reached (${LICENSE_ENDPOINT}): ${e.message}`);
+  }
+
+  if (!response.ok) {
+    throw new Error(`OMEGA_LICENSE_KEY was rejected by the license server (HTTP ${response.status}) — check the key on omegajs.dev`);
+  }
+
+  let body;
+  try {
+    body = await response.json();
+  } catch (e) {
+    throw new Error(`The license server's answer could not be read as JSON (${LICENSE_ENDPOINT}): ${e.message}`);
+  }
+
+  const user = body?.user;
+  if (!user) {
+    throw new Error(`OMEGA_LICENSE_KEY resolved no account on omegajs.dev — check the key on your account's API page`);
+  }
+
+  // The SAME derivation the backend and the client run, so "licensed" means
+  // exactly what "subscribed" means everywhere else: `basic` is the reserved
+  // free sentinel a cancelled or never-paid account resolves to.
+  const { plan } = resolveSubscription(user);
+  if (plan === 'basic') {
+    return keyless('the OMEGA_LICENSE_KEY account has no active omegajs.dev subscription');
+  }
+
+  return {
+    licensed: true,
+    payments: 'live',
+    attribution: 'removed',
+    reason: `licensed by the omegajs.dev "${plan}" subscription`,
+  };
+}
+
+/**
+ * The verdict as an ARTIFACT records it: the three decided facts under one
+ * shape, shared by every consumer — the website's `site.license` build fact,
+ * the desktop/extension build stamp, and the backend's OMEGA_LICENSE_STATUS
+ * (its `status` alone, because an env value is a string). The human `reason`
+ * is dropped: it names the account's plan, and a shipped bundle is public.
+ *
+ * @param {object} verdict - A resolveLicenseVerdict answer.
+ * @returns {{ status: 'licensed'|'keyless', payments: string, attribution: string }}
+ */
+function licenseStamp(verdict) {
+  return {
+    status: verdict.licensed ? 'licensed' : 'keyless',
+    payments: verdict.payments,
+    attribution: verdict.attribution,
+  };
+}
+
+// What a build that ran no check at all carries (a dev build, a test, any lane
+// that never asks) — the keyless verdict's own stamp, because that is exactly
+// what such a build is.
+const KEYLESS_STAMP = Object.freeze(licenseStamp(keyless('no license check ran')));
+
+/**
+ * The stamp a build bakes: a PRODUCTION build asks the license server once (a
+ * key that cannot be answered for throws, gating the deploy); everything else
+ * is keyless by definition and never phones home — spec call 5's "no check
+ * fires outside deploy" half, with ONE home for all three baking targets.
+ *
+ * @param {object} input
+ * @param {object} input.config - The resolved omega.json5.
+ * @param {boolean} input.production - Whether this build ships.
+ * @param {object} [input.env] - See resolveLicenseVerdict.
+ * @param {function} [input.transport] - See resolveLicenseVerdict.
+ * @returns {Promise<{ status: string, payments: string, attribution: string }>}
+ */
+async function resolveLicenseStamp({ config, production, env, transport }) {
+  if (!production) return { ...KEYLESS_STAMP };
+
+  return licenseStamp(await resolveLicenseVerdict({ config, env, transport }));
+}
+
+module.exports = { resolveLicenseVerdict, resolveLicenseStamp, licenseStamp, KEYLESS_STAMP, LICENSE_ENDPOINT };

package/dist/vendor/devkit/local-https.js

@@ -0,0 +1,360 @@
+/**
+ * Local HTTPS for dev servers (mkcert) — the shared mechanism behind
+ * `omega serve` / `omega emulator` (backend) and `omega dev` (web):
+ * the PUBLIC port speaks TLS through a forwarding proxy while the real
+ * server sits on an internal plain-http port.
+ *
+ * - ensureLocalHttpsCerts({ certsDir, log }) → { key, cert } | null
+ *   Reuses mkcert certificates from certsDir when they're usable; stale
+ *   ones (expired, or issued by a DIFFERENT machine's mkcert CA — e.g. a
+ *   .temp copied over from another Mac) are wiped and regenerated against
+ *   THIS machine's trusted CA. No mkcert installed → null, and callers
+ *   fall back to plain http.
+ *
+ * - startLocalHttpsProxy({ port, targetPort, certs, log }) → net.Server
+ *   TLS terminator forwarding every request to localhost:targetPort with
+ *   x-forwarded-proto/host set. WebSocket upgrades tunnel as raw sockets
+ *   (dev-server live-reload keeps working through the proxy). The public
+ *   port is polyglot: the first byte decides TLS vs plain http, and plain
+ *   http gets a 307 redirect to https on the same host — anyone typing
+ *   http://localhost:<port> lands in the right place instead of a browser
+ *   connection error.
+ *
+ * - mkcertCaRootPem() → '<mkcert -CAROOT>/rootCA.pem' | null
+ *   The root certificate a spawned Node process TRUSTS through
+ *   NODE_EXTRA_CA_CERTS, so a child calling the public https port verifies it
+ *   instead of bypassing verification (#795). Memoised per process.
+ */
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const net = require('net');
+const http = require('http');
+const https = require('https');
+const { execSync } = require('child_process');
+const jetpack = require('fs-jetpack');
+const { commandOnPath } = require('./command-path.js');
+
+const NOOP = () => {};
+
+/**
+ * The install line to print when mkcert is absent, for THIS host.
+ *
+ * mkcert ships through a different manager on every platform — its README
+ * (https://github.com/FiloSottile/mkcert#installation) names Homebrew on
+ * macOS, Chocolatey or Scoop on Windows, and on Linux certutil from apt plus
+ * mkcert itself from the release binary or Linuxbrew. One home for the string,
+ * since `omega serve`, `omega emulator`, web's `omega dev` and the generator
+ * below all print it.
+ *
+ * Every line OPENS with something pasteable — an alternative belongs in a
+ * sentence after it, never spliced into the command a reader will copy.
+ *
+ * @param {string} [platform] - Host platform (test seam)
+ * @returns {string} The command to run, then any alternative
+ */
+function mkcertInstallHint(platform = process.platform) {
+  if (platform === 'darwin') {
+    return 'brew install mkcert && mkcert -install';
+  }
+
+  if (platform === 'win32') {
+    return 'choco install mkcert && mkcert -install. Scoop works too: scoop bucket add extras, then scoop install mkcert.';
+  }
+
+  return 'sudo apt install libnss3-tools, then install mkcert itself from https://github.com/FiloSottile/mkcert/releases (or Linuxbrew) and run mkcert -install.';
+}
+
+// One CAROOT lookup per process — mkcert's root does not move under a running
+// stack, and three call sites ask for it. Keyed by the exec that answered, so a
+// test seam never inherits (or poisons) the real host's answer.
+const caRootPemCache = new Map();
+
+/**
+ * The absolute path to THIS machine's mkcert root CA certificate.
+ *
+ * A Node child reads no system trust store, so a process calling the public
+ * https port (the proxy above) fails the certificate. Handing it this path as
+ * NODE_EXTRA_CA_CERTS makes it VERIFY the local certificate — the reason it is
+ * not NODE_TLS_REJECT_UNAUTHORIZED=0, which disables verification wholesale and
+ * makes Node print a warning (#795).
+ *
+ * The `mkcert -CAROOT` call IS the on-PATH probe: mkcert missing means the
+ * shell exits nonzero, which is the null answer.
+ *
+ * @param {object} [options]
+ * @param {function} [options.exec] - execSync (test seam)
+ * @returns {string|null} The rootCA.pem path, or null when mkcert or its root is absent
+ */
+function mkcertCaRootPem({ exec = execSync } = {}) {
+  if (caRootPemCache.has(exec)) {
+    return caRootPemCache.get(exec);
+  }
+
+  let pem = null;
+  try {
+    // A host without mkcert answers with a nonzero exit, the expected null, so
+    // the child's stderr stays quiet (no "command not found" in the dev banner).
+    const caRoot = String(exec('mkcert -CAROOT', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })).trim();
+    const candidate = caRoot ? path.join(caRoot, 'rootCA.pem') : null;
+    pem = candidate && fs.existsSync(candidate) ? candidate : null;
+  } catch (e) {
+    // No mkcert on this host — callers fall back (plain http, or no trust var).
+    pem = null;
+  }
+
+  caRootPemCache.set(exec, pem);
+  return pem;
+}
+
+/**
+ * Find-or-generate mkcert certificates in certsDir.
+ * @param {object} options
+ * @param {string} options.certsDir - Where the localhost*.pem pair lives
+ * @param {function} [options.log] - Line logger
+ * @returns {Promise<{ key: string, cert: string } | null>} Cert file paths, or null when unobtainable
+ */
+async function ensureLocalHttpsCerts({ certsDir, log = NOOP }) {
+  jetpack.dir(certsDir);
+
+  // Check if mkcert certificates already exist
+  const existing = findCertPair(certsDir);
+
+  if (existing) {
+    const problem = checkCertProblem(existing.cert);
+
+    if (!problem) {
+      log(`Using existing mkcert certificates from ${path.basename(path.dirname(certsDir))}/${path.basename(certsDir)}/`);
+      return existing;
+    }
+
+    // Unusable certs make browsers reject the proxy outright — wipe and
+    // regenerate against this machine's trusted CA.
+    log(`Existing certificates are not usable (${problem}) — regenerating...`);
+    jetpack.remove(certsDir);
+    jetpack.dir(certsDir);
+  }
+
+  return generateMkcertCerts(certsDir, log);
+}
+
+/**
+ * Locate the mkcert localhost pair in a directory.
+ * @param {string} certsDir
+ * @returns {{ key: string, cert: string } | null}
+ */
+function findCertPair(certsDir) {
+  const certFiles = (jetpack.find(certsDir, { matching: 'localhost*.pem' }) || []);
+  const key = certFiles.find((f) => f.includes('-key.pem'));
+  const cert = certFiles.find((f) => !f.includes('-key.pem'));
+
+  return key && cert ? { key, cert } : null;
+}
+
+/**
+ * Returns a reason string when the existing cert must be regenerated, or null
+ * when it's usable: unexpired AND signed by this machine's trusted mkcert root CA.
+ * @param {string} certFile
+ * @returns {string | null}
+ */
+function checkCertProblem(certFile) {
+  const { X509Certificate } = require('crypto');
+
+  let cert;
+  try {
+    cert = new X509Certificate(fs.readFileSync(certFile));
+  } catch (e) {
+    return 'unreadable certificate';
+  }
+
+  if (new Date(cert.validTo) <= new Date()) {
+    return `expired ${cert.validTo}`;
+  }
+
+  // Verify the signature chains to the CURRENT mkcert root CA. If mkcert (or
+  // its root) isn't available we can't verify — keep the existing certs rather
+  // than breaking the no-mkcert fallback path.
+  const caPem = mkcertCaRootPem();
+  if (!caPem) {
+    return null;
+  }
+
+  try {
+    const ca = new X509Certificate(fs.readFileSync(caPem));
+
+    if (!cert.verify(ca.publicKey)) {
+      const issuerCN = cert.issuer.split('\n').find((line) => line.startsWith('CN=')) || cert.issuer;
+      return `issued by a different CA (${issuerCN})`;
+    }
+  } catch (e) {
+    return null;
+  }
+
+  return null;
+}
+
+/**
+ * Generate a fresh localhost cert pair with mkcert (SANs: localhost,
+ * loopbacks, and the machine's LAN IPv4s so phones on the same network work).
+ * @param {string} certsDir
+ * @param {function} log
+ * @returns {{ key: string, cert: string } | null}
+ */
+function generateMkcertCerts(certsDir, log = NOOP) {
+  if (!commandOnPath('mkcert')) {
+    log(`mkcert not found. Install with: ${mkcertInstallHint()}`);
+    return null;
+  }
+
+  try {
+    execSync('mkcert -install', { stdio: 'pipe' });
+  } catch (e) {
+    // CA may already be installed
+  }
+
+  log('Generating mkcert certificates...');
+
+  const hosts = ['localhost', '127.0.0.1', '::1'];
+  const interfaces = os.networkInterfaces();
+
+  for (const name of Object.keys(interfaces)) {
+    for (const iface of interfaces[name]) {
+      if (!iface.internal && iface.family === 'IPv4') {
+        hosts.push(iface.address);
+        break;
+      }
+    }
+  }
+
+  try {
+    execSync(`mkcert ${hosts.join(' ')}`, { cwd: certsDir, stdio: 'pipe' });
+
+    const pair = findCertPair(certsDir);
+    if (pair) {
+      log('Trusted HTTPS certificates generated');
+    }
+
+    return pair;
+  } catch (e) {
+    log(`Failed to generate certificates: ${e.message}`);
+    return null;
+  }
+}
+
+/**
+ * Start the TLS-terminating forwarder: https://localhost:port →
+ * http://localhost:targetPort. Handles plain requests AND WebSocket
+ * upgrades (raw tunnel), so dev-server live-reload sockets survive.
+ * The listener is a polyglot front: TLS handshakes (first byte 0x16) go to
+ * the TLS server, plain http gets a 307 to https on the same host.
+ * @param {object} options
+ * @param {number} options.port - Public TLS port
+ * @param {number} options.targetPort - Internal plain-http port
+ * @param {{ key: string, cert: string }} options.certs - Cert file paths
+ * @param {function} [options.log] - Line logger
+ * @returns {import('net').Server}
+ */
+function startLocalHttpsProxy({ port, targetPort, certs, log = NOOP }) {
+  const options = {
+    key: fs.readFileSync(certs.key),
+    cert: fs.readFileSync(certs.cert),
+  };
+
+  const proxy = https.createServer(options, (clientReq, clientRes) => {
+    const proxyOpts = {
+      hostname: 'localhost',
+      port: targetPort,
+      path: clientReq.url,
+      method: clientReq.method,
+      headers: {
+        ...clientReq.headers,
+        'x-forwarded-proto': 'https',
+        'x-forwarded-host': clientReq.headers.host,
+      },
+    };
+
+    const proxyReq = http.request(proxyOpts, (proxyRes) => {
+      clientRes.writeHead(proxyRes.statusCode, proxyRes.headers);
+      proxyRes.pipe(clientRes, { end: true });
+    });
+
+    proxyReq.on('error', (err) => {
+      clientRes.writeHead(502);
+      clientRes.end(`Proxy error: ${err.message}`);
+    });
+
+    clientReq.pipe(proxyReq, { end: true });
+  });
+
+  // WebSocket upgrades (dev-server live-reload): replay the handshake at the
+  // target and splice the sockets — rawHeaders preserves case + duplicates.
+  proxy.on('upgrade', (req, socket, head) => {
+    const upstream = net.connect(targetPort, 'localhost', () => {
+      const lines = [`${req.method} ${req.url} HTTP/1.1`];
+      for (let i = 0; i < req.rawHeaders.length; i += 2) {
+        lines.push(`${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}`);
+      }
+      upstream.write(`${lines.join('\r\n')}\r\n\r\n`);
+
+      if (head && head.length) {
+        upstream.write(head);
+      }
+
+      socket.pipe(upstream);
+      upstream.pipe(socket);
+    });
+
+    // Either side going away (error OR clean close) releases the other —
+    // without this, half-open tunnels strand sockets on every closed tab
+    upstream.on('error', () => socket.destroy());
+    socket.on('error', () => upstream.destroy());
+    upstream.on('close', () => socket.destroy());
+    socket.on('close', () => upstream.destroy());
+  });
+
+  // Plain-http answers on the SAME port: whatever the path, bounce the
+  // browser to https on the host it asked for (Host carries the port).
+  const redirect = http.createServer((req, res) => {
+    const host = req.headers.host || `localhost:${port}`;
+    res.writeHead(307, { Location: `https://${host}${req.url}` });
+    res.end();
+  });
+
+  // Polyglot front — peek the first byte without consuming it: a TLS
+  // handshake record starts with 0x16, anything else is treated as plain
+  // http. The byte goes back via unshift before the real server takes over.
+  const front = net.createServer((socket) => {
+    socket.on('error', () => socket.destroy());
+
+    socket.once('data', (firstChunk) => {
+      socket.pause();
+      socket.unshift(firstChunk);
+
+      const target = firstChunk[0] === 0x16 ? proxy : redirect;
+      target.emit('connection', socket);
+
+      process.nextTick(() => socket.resume());
+    });
+  });
+
+  front.listen(port, () => {
+    log(`HTTPS proxy listening on https://localhost:${port}`);
+    log(`Forwarding to http://localhost:${targetPort} (plain http redirects to https)`);
+  });
+
+  front.on('error', (err) => {
+    log(`HTTPS proxy error: ${err.message}`);
+  });
+
+  return front;
+}
+
+module.exports = {
+  ensureLocalHttpsCerts,
+  startLocalHttpsProxy,
+  checkCertProblem,
+  findCertPair,
+  generateMkcertCerts,
+  mkcertInstallHint,
+  mkcertCaRootPem,
+};