@pasko70/pibo 1.9.9 → 1.9.10

package/dist/web/http.js

@@ -0,0 +1,195 @@
+import { gzipSync } from "node:zlib";
+export const MAX_WEB_REQUEST_BODY_BYTES = 4 * 1024 * 1024;
+const MIN_COMPRESS_RESPONSE_BYTES = 1024;
+const MAX_SYNC_GZIP_RESPONSE_BYTES = 64 * 1024;
+const INTERNAL_SOCKET_PEER_HEADER = "x-pibo-socket-peer";
+export class PiboWebHttpError extends Error {
+    statusCode;
+    constructor(message, statusCode) {
+        super(message);
+        this.statusCode = statusCode;
+        this.name = "PiboWebHttpError";
+    }
+}
+export function responseJson(payload, init = {}) {
+    const startedAt = performance.now();
+    const body = JSON.stringify(payload);
+    const serializeMs = performance.now() - startedAt;
+    const headers = new Headers(init.headers);
+    headers.set("content-type", "application/json; charset=utf-8");
+    headers.set("x-pibo-response-bytes", String(Buffer.byteLength(body, "utf8")));
+    headers.set("server-timing", appendServerTiming(headers.get("server-timing"), `json_serialize;dur=${serializeMs.toFixed(1)}`));
+    return new Response(body, {
+        ...init,
+        headers,
+    });
+}
+export function responseHtml(html, init = {}) {
+    return new Response(html, {
+        ...init,
+        headers: {
+            "content-type": "text/html; charset=utf-8",
+            ...init.headers,
+        },
+    });
+}
+export async function readJsonBody(request) {
+    try {
+        const body = await request.json();
+        if (!body || typeof body !== "object")
+            throw new PiboWebHttpError("Invalid JSON body", 400);
+        return body;
+    }
+    catch {
+        throw new PiboWebHttpError("Invalid JSON body", 400);
+    }
+}
+export async function nodeRequestToWebRequest(request, baseURL) {
+    const url = new URL(request.url ?? "/", baseURL);
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(request.headers)) {
+        if (Array.isArray(value)) {
+            for (const entry of value)
+                headers.append(key, entry);
+        }
+        else if (value !== undefined) {
+            headers.set(key, value);
+        }
+    }
+    let body;
+    if (request.method !== "GET" && request.method !== "HEAD") {
+        const chunks = [];
+        let receivedBytes = 0;
+        for await (const chunk of request) {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            receivedBytes += buffer.length;
+            if (receivedBytes > MAX_WEB_REQUEST_BODY_BYTES) {
+                throw new PiboWebHttpError("Request body too large", 413);
+            }
+            chunks.push(buffer);
+        }
+        body = Buffer.concat(chunks);
+    }
+    return new Request(url, {
+        method: request.method,
+        headers,
+        body,
+    });
+}
+export async function sendWebResponse(response, webResponse) {
+    const headers = responseHeaders(webResponse);
+    const compressEncoding = preferredResponseEncoding(response.req?.headers["accept-encoding"], webResponse);
+    if (compressEncoding && webResponse.body) {
+        const body = await readResponseBody(webResponse);
+        if (body.length >= MIN_COMPRESS_RESPONSE_BYTES && body.length <= MAX_SYNC_GZIP_RESPONSE_BYTES) {
+            const compressionStartedAt = performance.now();
+            const compressed = gzipSync(body, { level: 1 });
+            appendServerTimingHeader(headers, `response_compress;dur=${(performance.now() - compressionStartedAt).toFixed(1)}`);
+            headers["content-encoding"] = compressEncoding;
+            headers["content-length"] = String(compressed.length);
+            headers.vary = appendVary(headers.vary, "accept-encoding");
+            response.writeHead(webResponse.status, headers);
+            response.end(compressed);
+            return;
+        }
+        if (body.length > MAX_SYNC_GZIP_RESPONSE_BYTES) {
+            headers["x-pibo-compression-skipped"] = "sync-gzip-size-limit";
+        }
+        response.writeHead(webResponse.status, headers);
+        response.end(body);
+        return;
+    }
+    response.writeHead(webResponse.status, headers);
+    if (!webResponse.body) {
+        response.end();
+        return;
+    }
+    const reader = webResponse.body.getReader();
+    const cancel = () => {
+        void reader.cancel();
+    };
+    response.once("close", cancel);
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            response.write(Buffer.from(value));
+        }
+        response.end();
+    }
+    finally {
+        response.off("close", cancel);
+    }
+}
+function appendServerTimingHeader(headers, value) {
+    const existing = headers["server-timing"];
+    headers["server-timing"] = appendServerTiming(Array.isArray(existing) ? existing.join(", ") : existing ?? null, value);
+}
+function responseHeaders(webResponse) {
+    const headers = {};
+    const setCookie = webResponse.headers.getSetCookie?.();
+    webResponse.headers.forEach((value, key) => {
+        if (key.toLowerCase() === "set-cookie")
+            return;
+        if (key.toLowerCase() === INTERNAL_SOCKET_PEER_HEADER)
+            return;
+        headers[key] = value;
+    });
+    if (setCookie?.length) {
+        headers["set-cookie"] = setCookie;
+    }
+    else {
+        const setCookieHeader = webResponse.headers.get("set-cookie");
+        if (setCookieHeader)
+            headers["set-cookie"] = setCookieHeader;
+    }
+    return headers;
+}
+function preferredResponseEncoding(acceptEncoding, webResponse) {
+    if (!responseCanBeCompressed(webResponse))
+        return undefined;
+    return acceptsEncoding(acceptEncoding, "gzip") ? "gzip" : undefined;
+}
+function acceptsEncoding(acceptEncoding, encoding) {
+    const accepted = Array.isArray(acceptEncoding) ? acceptEncoding.join(",") : acceptEncoding ?? "";
+    return accepted.split(",").some((entry) => {
+        const [name, ...parameters] = entry.trim().split(";").map((part) => part.trim());
+        if (name !== encoding && name !== "*")
+            return false;
+        const q = parameters.find((parameter) => parameter.toLowerCase().startsWith("q="));
+        if (!q)
+            return true;
+        const weight = Number(q.slice(2));
+        return Number.isFinite(weight) && weight > 0;
+    });
+}
+function responseCanBeCompressed(webResponse) {
+    if (webResponse.status === 204 || webResponse.status === 304)
+        return false;
+    if (webResponse.headers.has("content-encoding"))
+        return false;
+    const contentType = webResponse.headers.get("content-type") ?? "";
+    return /^application\/json\b/.test(contentType);
+}
+async function readResponseBody(webResponse) {
+    const chunks = [];
+    const reader = webResponse.body.getReader();
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        chunks.push(Buffer.from(value));
+    }
+    return Buffer.concat(chunks);
+}
+function appendVary(existing, value) {
+    const values = Array.isArray(existing) ? existing.flatMap((item) => item.split(",")) : (existing ?? "").split(",");
+    const normalized = values.map((item) => item.trim()).filter(Boolean);
+    if (!normalized.some((item) => item.toLowerCase() === value.toLowerCase()))
+        normalized.push(value);
+    return normalized.join(", ");
+}
+function appendServerTiming(existing, value) {
+    return existing ? `${existing}, ${value}` : value;
+}

package/dist/web/types.js

@@ -0,0 +1 @@
+export {};

package/dist/web-annotations/api.js

@@ -0,0 +1,348 @@
+import { randomBytes } from "node:crypto";
+import { PiboWebHttpError, readJsonBody, responseJson } from "../web/http.js";
+import { buildWebAnnotationOverlayScript, createWebAnnotationCdpService } from "./cdp.js";
+import { serializeWebAnnotationAttachment } from "./attachments.js";
+import { createDefaultWebAnnotationStore } from "./store.js";
+import { isWebAnnotationStatus, isWebAnnotationTargetKind } from "./types.js";
+import { assertWebAnnotationStatusTransition, normalizeWebAnnotationLimit, normalizeWebAnnotationScreenshotRef, normalizeWebAnnotationTarget, normalizeWebAnnotationViewport, requireWebAnnotationText, sanitizeWebAnnotationText, WEB_ANNOTATION_LIMITS, } from "./validation.js";
+export const WEB_ANNOTATIONS_API_PREFIX = "/api/web-annotations";
+export const WEB_ANNOTATIONS_APP_MOUNT = "/apps/web-annotations";
+let defaultStore;
+function getDefaultStore() {
+    defaultStore ??= createDefaultWebAnnotationStore();
+    return defaultStore;
+}
+function createSameOriginBinding(store, request, context, body) {
+    const bindingToken = randomBytes(24).toString("base64url");
+    const binding = store.createBinding({
+        ...context,
+        url: normalizeSameOriginBindingUrl(request, body.url),
+        title: optionalBodyString(body.title, WEB_ANNOTATION_LIMITS.title),
+        state: "active",
+        metadata: { source: "same-origin", overlaySubmissionToken: bindingToken },
+    });
+    return {
+        binding,
+        overlay: {
+            bindingId: binding.id,
+            bindingToken,
+            piboSessionId: binding.piboSessionId,
+            annotationShortcut: optionalBodyString(body.annotationShortcut, 80, false),
+        },
+    };
+}
+export function createWebAnnotationsWebApp(options = {}) {
+    const store = options.store ?? getDefaultStore();
+    const baseService = options.cdpService ?? createWebAnnotationCdpService({ store });
+    return {
+        name: "web-annotations",
+        mountPath: WEB_ANNOTATIONS_APP_MOUNT,
+        apiPrefix: WEB_ANNOTATIONS_API_PREFIX,
+        async handleRequest(request, context) {
+            const url = new URL(request.url);
+            if (url.pathname === `${WEB_ANNOTATIONS_APP_MOUNT}/overlay.js` && request.method === "GET") {
+                return responseJavaScript(buildWebAnnotationOverlayScript(), { headers: { "cache-control": "no-store" } });
+            }
+            if (url.pathname === WEB_ANNOTATIONS_APP_MOUNT && request.method === "GET") {
+                return responseJson({ ok: true, apiPrefix: WEB_ANNOTATIONS_API_PREFIX });
+            }
+            if (!url.pathname.startsWith(WEB_ANNOTATIONS_API_PREFIX))
+                return undefined;
+            try {
+                if (url.pathname === `${WEB_ANNOTATIONS_API_PREFIX}/submissions` && request.method === "OPTIONS") {
+                    return corsResponse(null, { status: 204 });
+                }
+                if (url.pathname === `${WEB_ANNOTATIONS_API_PREFIX}/submissions` && request.method === "POST") {
+                    const annotation = await handleOverlaySubmission(store, request);
+                    return corsJson({ ok: true, annotation }, { status: 201 });
+                }
+                const webSession = await context.requireSession({ request });
+                if (url.pathname === `${WEB_ANNOTATIONS_API_PREFIX}/targets` && request.method === "GET") {
+                    const service = serviceForRequest(baseService, url.searchParams.get("cdpUrl") ?? undefined, request, store, options);
+                    const targets = await service.listTargets();
+                    return responseJson({ ok: true, targets });
+                }
+                if (url.pathname === `${WEB_ANNOTATIONS_API_PREFIX}/bindings` && request.method === "GET") {
+                    const piboSessionId = requireQueryParam(url, "piboSessionId");
+                    const bindingContext = resolveBindingContext(context, webSession, { piboSessionId });
+                    const bindings = baseService.listBindings(bindingContext, parseLimit(url.searchParams.get("limit")));
+                    return responseJson({ ok: true, bindings });
+                }
+                if (url.pathname === `${WEB_ANNOTATIONS_API_PREFIX}/bindings` && request.method === "POST") {
+                    requireSameOriginJsonRequest(request);
+                    const body = await readJsonBody(request);
+                    const bindingContext = resolveBindingContext(context, webSession, body);
+                    const service = serviceForRequest(baseService, body.cdpUrl, request, store, options);
+                    if (body.url) {
+                        if (body.sameOrigin) {
+                            const result = createSameOriginBinding(store, request, bindingContext, body);
+                            return responseJson({ ok: true, ...result }, { status: 201 });
+                        }
+                        const result = await service.createUrlBinding({ ...bindingContext, url: body.url });
+                        return responseJson({ ok: true, ...result }, { status: 201 });
+                    }
+                    if (body.targetId) {
+                        const result = await service.createTargetBinding({ ...bindingContext, targetId: body.targetId });
+                        return responseJson({ ok: true, ...result }, { status: 201 });
+                    }
+                    throw new PiboWebHttpError("url or targetId is required", 400);
+                }
+                if (url.pathname === WEB_ANNOTATIONS_API_PREFIX && request.method === "GET") {
+                    const piboSessionId = requireQueryParam(url, "piboSessionId", "sessionId");
+                    const bindingContext = resolveBindingContext(context, webSession, { piboSessionId });
+                    const status = optionalStatus(url.searchParams.get("status"));
+                    const scope = url.searchParams.get("scope") === "app" || url.searchParams.get("allSessions") === "true" ? "app" : "session";
+                    const annotations = store.listAnnotations({
+                        ...(scope === "session" ? { piboSessionId: bindingContext.piboSessionId } : {}),
+                        status,
+                        limit: parseLimit(url.searchParams.get("limit")),
+                    }).map(serializeWebAnnotationAttachment);
+                    return responseJson({ ok: true, annotations, scope });
+                }
+                const annotationResource = matchAnnotationResource(url.pathname);
+                if (annotationResource) {
+                    if (request.method === "GET") {
+                        const piboSessionId = requireQueryParam(url, "piboSessionId", "sessionId");
+                        const bindingContext = resolveBindingContext(context, webSession, { piboSessionId });
+                        const annotation = store.getAnnotation(bindingContext.piboSessionId, annotationResource.id);
+                        if (!annotation)
+                            throw new PiboWebHttpError("Web Annotation was not found", 404);
+                        return responseJson({ ok: true, annotation });
+                    }
+                    if (request.method === "PATCH") {
+                        requireSameOriginJsonRequest(request);
+                        const body = await readJsonBody(request);
+                        const bindingContext = resolveBindingContext(context, webSession, body);
+                        const status = optionalStatus(body.status);
+                        const existing = store.getAnnotation(bindingContext.piboSessionId, annotationResource.id);
+                        if (!existing)
+                            throw new PiboWebHttpError("Web Annotation was not found", 404);
+                        try {
+                            assertWebAnnotationStatusTransition(existing.status, status);
+                        }
+                        catch (error) {
+                            throw new PiboWebHttpError(error instanceof Error ? error.message : String(error), 400);
+                        }
+                        const annotation = store.patchAnnotation(bindingContext.piboSessionId, annotationResource.id, {
+                            ...(status ? { status } : {}),
+                            ...(body.summary !== undefined ? { summary: body.summary } : {}),
+                        });
+                        if (!annotation)
+                            throw new PiboWebHttpError("Web Annotation was not found", 404);
+                        return responseJson({ ok: true, annotation: serializeWebAnnotationAttachment(annotation) });
+                    }
+                }
+                const bindingResource = matchBindingResource(url.pathname);
+                if (bindingResource) {
+                    if (request.method === "POST" && (bindingResource.action === "inject" || bindingResource.action === "reinject")) {
+                        requireSameOriginJsonRequest(request);
+                        const body = await readJsonBody(request);
+                        const bindingContext = resolveBindingContext(context, webSession, body);
+                        const service = serviceForRequest(baseService, body.cdpUrl, request, store, options);
+                        const result = await service.injectBinding(bindingContext, bindingResource.id, { annotationShortcut: optionalBodyString(body.annotationShortcut, 80, false) });
+                        return responseJson({ ok: true, ...result });
+                    }
+                    if (request.method === "POST" && bindingResource.action === "stop") {
+                        requireSameOriginJsonRequest(request);
+                        const body = await readJsonBody(request);
+                        const bindingContext = resolveBindingContext(context, webSession, body);
+                        const service = serviceForRequest(baseService, body.cdpUrl, request, store, options);
+                        const result = await service.stopBinding(bindingContext, bindingResource.id);
+                        return responseJson({ ok: true, ...result });
+                    }
+                    if (request.method === "DELETE" && !bindingResource.action) {
+                        requireSameOriginRequest(request);
+                        const piboSessionId = requireQueryParam(url, "piboSessionId");
+                        const bindingContext = resolveBindingContext(context, webSession, { piboSessionId });
+                        return responseJson({ ok: true, removed: baseService.removeBinding(bindingContext, bindingResource.id) });
+                    }
+                }
+                return undefined;
+            }
+            catch (error) {
+                if (error instanceof PiboWebHttpError)
+                    throw error;
+                const message = error instanceof Error ? error.message : String(error);
+                throw new PiboWebHttpError(message, 400);
+            }
+        },
+    };
+}
+async function handleOverlaySubmission(store, request) {
+    const contentType = request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
+    if (contentType !== "application/json")
+        throw new PiboWebHttpError("Content-Type must be application/json", 415);
+    const body = await readJsonBody(request);
+    const bindingId = requireBodyString(body.bindingId, "bindingId", WEB_ANNOTATION_LIMITS.id, false);
+    const bindingToken = requireBodyString(body.bindingToken, "bindingToken", WEB_ANNOTATION_LIMITS.bindingToken, false);
+    const binding = store.getBindingById(bindingId);
+    if (!binding)
+        throw new PiboWebHttpError("Web Annotation binding was not found", 404);
+    if (binding.state === "removed")
+        throw new PiboWebHttpError("Web Annotation binding was removed", 404);
+    if (binding.metadata?.overlaySubmissionToken !== bindingToken)
+        throw new PiboWebHttpError("Invalid Web Annotation binding token", 403);
+    const note = requireBodyString(body.note, "note", WEB_ANNOTATION_LIMITS.note);
+    const targetKind = requireTargetKind(body.targetKind);
+    const viewport = normalizeViewport(body.viewport);
+    return store.createAnnotation({
+        piboSessionId: binding.piboSessionId,
+        piboRoomId: binding.piboRoomId,
+        bindingId: binding.id,
+        note,
+        url: optionalBodyString(body.url, WEB_ANNOTATION_LIMITS.url, false) ?? binding.url,
+        title: optionalBodyString(body.title, WEB_ANNOTATION_LIMITS.title) ?? binding.title,
+        targetId: binding.targetId,
+        targetKind,
+        viewport,
+        target: normalizeTarget(body.target, targetKind),
+        screenshotRef: normalizeWebAnnotationScreenshotRef(body.screenshotRef),
+    });
+}
+function requireBodyString(value, field, max, redactSecrets = true) {
+    try {
+        return requireWebAnnotationText(value, { field, max, redactSecrets });
+    }
+    catch (error) {
+        throw new PiboWebHttpError(error instanceof Error ? error.message : String(error), 400);
+    }
+}
+function optionalBodyString(value, max, redactSecrets = true) {
+    try {
+        return sanitizeWebAnnotationText(value, { field: "field", max, redactSecrets });
+    }
+    catch (error) {
+        throw new PiboWebHttpError(error instanceof Error ? error.message : String(error), 400);
+    }
+}
+function normalizeSameOriginBindingUrl(request, value) {
+    const raw = requireBodyString(value, "url", WEB_ANNOTATION_LIMITS.url, false);
+    const requestOrigin = new URL(request.url).origin;
+    let parsed;
+    try {
+        parsed = new URL(raw, requestOrigin);
+    }
+    catch {
+        throw new PiboWebHttpError("url must be a valid URL", 400);
+    }
+    if (parsed.origin !== requestOrigin)
+        throw new PiboWebHttpError("same-origin annotations require a URL on this Pibo web origin", 400);
+    return parsed.href;
+}
+function requireTargetKind(value) {
+    if (!value || !isWebAnnotationTargetKind(value))
+        throw new PiboWebHttpError("Invalid annotation target kind", 400);
+    return value;
+}
+function normalizeViewport(value) {
+    if (!value || typeof value.width !== "number" || typeof value.height !== "number")
+        throw new PiboWebHttpError("viewport width and height are required", 400);
+    try {
+        return normalizeWebAnnotationViewport(value);
+    }
+    catch (error) {
+        throw new PiboWebHttpError(error instanceof Error ? error.message : String(error), 400);
+    }
+}
+function normalizeTarget(value, targetKind) {
+    if (value === undefined)
+        return { kind: targetKind };
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new PiboWebHttpError("target must be an object", 400);
+    try {
+        return normalizeWebAnnotationTarget({ ...value, kind: targetKind }, targetKind);
+    }
+    catch (error) {
+        throw new PiboWebHttpError(error instanceof Error ? error.message : String(error), 400);
+    }
+}
+function responseJavaScript(source, init = {}) {
+    return new Response(source, {
+        ...init,
+        headers: {
+            "content-type": "text/javascript; charset=utf-8",
+            ...init.headers,
+        },
+    });
+}
+function corsJson(payload, init = {}) {
+    return responseJson(payload, { ...init, headers: corsHeaders(init.headers) });
+}
+function corsResponse(body, init = {}) {
+    return new Response(body, { ...init, headers: corsHeaders(init.headers) });
+}
+function corsHeaders(existing) {
+    return {
+        "access-control-allow-origin": "*",
+        "access-control-allow-methods": "POST, OPTIONS",
+        "access-control-allow-headers": "content-type",
+        ...Object.fromEntries(new Headers(existing).entries()),
+    };
+}
+function requireSameOriginJsonRequest(request) {
+    const contentType = request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
+    if (contentType !== "application/json")
+        throw new PiboWebHttpError("Content-Type must be application/json", 415);
+    requireSameOriginRequest(request);
+}
+function requireSameOriginRequest(request) {
+    const origin = request.headers.get("origin");
+    if (!origin)
+        throw new PiboWebHttpError("Origin header is required", 403);
+    if (origin !== new URL(request.url).origin)
+        throw new PiboWebHttpError("Origin is not allowed", 403);
+}
+function serviceForRequest(baseService, cdpUrl, request, store, options) {
+    if (options.cdpService)
+        return baseService;
+    return createWebAnnotationCdpService({ store, cdpUrl, apiBaseUrl: new URL(request.url).origin });
+}
+function resolveBindingContext(context, _webSession, input) {
+    const piboSessionId = input.piboSessionId?.trim();
+    if (!piboSessionId)
+        throw new PiboWebHttpError("piboSessionId is required", 400);
+    const session = context.channelContext.getSession(piboSessionId);
+    if (!session)
+        throw new PiboWebHttpError("Pibo session not found", 404);
+    return {
+        piboSessionId,
+        piboRoomId: input.piboRoomId?.trim() || undefined,
+    };
+}
+function requireQueryParam(url, name, fallbackName) {
+    const value = (url.searchParams.get(name) ?? (fallbackName ? url.searchParams.get(fallbackName) : undefined))?.trim();
+    if (!value)
+        throw new PiboWebHttpError(`${name} is required`, 400);
+    return value;
+}
+function optionalStatus(value) {
+    if (!value)
+        return undefined;
+    if (!isWebAnnotationStatus(value))
+        throw new PiboWebHttpError("Invalid annotation status", 400);
+    return value;
+}
+function parseLimit(value) {
+    if (!value)
+        return undefined;
+    const parsed = Number.parseInt(value, 10);
+    return Number.isFinite(parsed) ? normalizeWebAnnotationLimit(parsed, 100, 500) : undefined;
+}
+function matchBindingResource(pathname) {
+    const prefix = `${WEB_ANNOTATIONS_API_PREFIX}/bindings/`;
+    if (!pathname.startsWith(prefix))
+        return undefined;
+    const parts = pathname.slice(prefix.length).split("/").filter(Boolean).map(decodeURIComponent);
+    if (parts.length === 0 || parts.length > 2)
+        return undefined;
+    return { id: parts[0], action: parts[1] };
+}
+function matchAnnotationResource(pathname) {
+    const prefix = `${WEB_ANNOTATIONS_API_PREFIX}/`;
+    if (!pathname.startsWith(prefix) || pathname.startsWith(`${WEB_ANNOTATIONS_API_PREFIX}/bindings/`))
+        return undefined;
+    const parts = pathname.slice(prefix.length).split("/").filter(Boolean).map(decodeURIComponent);
+    if (parts.length !== 1 || parts[0] === "targets" || parts[0] === "submissions" || parts[0] === "bindings")
+        return undefined;
+    return { id: parts[0] };
+}