@pmeweb/plugin-chat 0.0.0-stage → 1.1.0

package/src/worker.js

@@ -0,0 +1,273 @@
+// The site Worker's half of the PmeWeb chat: POST /api/chat/start opens a conversation, GET
+// /api/chat/ws carries the visitor's socket. Everything else (the conversation Durable Object, the
+// model, the limits, the lead email and SMS) lives in pmeweb-chat, reached over the CHAT service
+// binding to its ChatApi entrypoint. A socket can only travel over `fetch` (an RPC method cannot
+// carry one, spike task 1), so both routes are `env.CHAT.fetch`, with the RPC version in a header.
+//
+// - PREVIEW OFF (manifest `preview: "off"`): off the site's real hosts every route answers 403
+//   `disabled` and nothing is called, so nobody spends the client's cap from « Contenu » or a
+//   workers.dev address. Without `hosts`, every request is off (fail closed).
+// - The host sent to pmeweb-chat is the one this request ARRIVED on, never a header or a body
+//   field: it is how pmeweb-chat finds the client's settings.
+// - start: Turnstile (@pmeweb/turnstile, action `chat`, solved on this host), then CHAT_START_LIMIT
+//   (3 a minute) keyed on the visitor's IP, then pmeweb-chat. The contact form's start
+//   (`fallbackLead`) is on the looser CHAT_LIMIT instead, so a visitor refused a conversation can
+//   still leave a lead; a site that has not bound CHAT_START_LIMIT yet falls back to CHAT_LIMIT.
+//   The IP goes to siteverify, the limiters and, in the `x-pmw-visitor-ip` header only, to
+//   pmeweb-chat, which counts conversations per visitor per day (10) and keeps only a daily hash
+//   of it. pmeweb-chat trusts that header because only service bindings reach it.
+//   Only named fields go on; `sms` is sent only as `voipms` (pmeweb-chat refuses any other value),
+//   `photos` only as true. pmeweb-chat's status and JSON pass through (426 rpc_version, 503
+//   not_configured, ...): the widget reads them.
+// - ws: rate-limited, then forwarded with the conversation id and the visitor key only, the
+//   Upgrade and RPC headers, and none of the visitor's cookies. The socket is never read here.
+//   A refusal past this point is pmeweb-chat's: an accepted socket closed with a 44xx code.
+// - photo (config `photos: true` only): rate-limited like a message, capped at 5 MB (the declared
+//   length first, then a counted read), forwarded as bytes with the conversation id, the visitor key
+//   and the message id only. pmeweb-chat checks the key, the signature and the count, re-encodes and
+//   stores; its status and JSON pass through. The bytes are never logged or looked at here.
+// - Nothing throws: every failure is a JSON answer with a status.
+
+import { isCanonicalHost } from '@pmeweb/plugin-kit'
+import { verifyTurnstile } from '@pmeweb/turnstile/worker'
+import { RPC_HEADER, RPC_VERSION } from './protocol.js'
+
+/** This package's version, reported by the health route (a test holds it equal to package.json). */
+export const VERSION = '1.1.0'
+export { RPC_VERSION }
+
+const SERVICE = 'https://pmeweb-chat.internal'
+const PING_TIMEOUT_MS = 3000
+const MAX_BODY = 8192
+const LIMITS = { name: 100, contact: 200, need: 2000 }
+/** pmeweb-chat's cap (src/photos.ts MAX_PHOTO_BYTES); the browser sends ~300 KB at 1600 px. */
+export const MAX_PHOTO_BYTES = 5 * 1024 * 1024
+
+function json(body, status = 200, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      'content-type': 'application/json; charset=utf-8',
+      'x-content-type-options': 'nosniff',
+      'cache-control': 'no-store',
+      ...headers,
+    },
+  })
+}
+
+const langOf = (v) => (v === 'en' || v === 'fr' ? v : null)
+
+const VISITOR_IP_HEADER = 'x-pmw-visitor-ip'
+
+/** CHAT_LIMIT by default (sockets, photos, the contact form); `start` uses CHAT_START_LIMIT when bound. */
+async function allowed(request, env, { start = false } = {}) {
+  const [limiter, prefix] = start && env.CHAT_START_LIMIT ? [env.CHAT_START_LIMIT, 'chat-start'] : [env.CHAT_LIMIT, 'chat']
+  if (!limiter) return true
+  try {
+    return (await limiter.limit({ key: `${prefix}:${request.headers.get('cf-connecting-ip') ?? 'unknown'}` })).success
+  } catch (e) {
+    // The limiter is approximate by design; a failure of it lets a Turnstile-verified visitor
+    // through, and pmeweb-chat still caps turns and the day's spend.
+    console.error('[chat] rate limiter failed', e)
+    return true
+  }
+}
+
+/** The fallback form's three fields, trimmed; null when one is missing or too long. */
+function fallbackLead(v) {
+  if (typeof v !== 'object' || v === null) return null
+  const out = {}
+  for (const [k, max] of Object.entries(LIMITS)) {
+    const s = typeof v[k] === 'string' ? v[k].trim() : ''
+    if (s === '' || s.length > max) return null
+    out[k] = s
+  }
+  return out
+}
+
+async function start(request, url, env, { config, lang }) {
+  if (!env.TURNSTILE_SECRET) {
+    console.error('[chat] TURNSTILE_SECRET not set, refusing the conversation')
+    return json({ ok: false, error: 'not_configured' }, 503)
+  }
+  if (Number(request.headers.get('content-length') ?? '0') > MAX_BODY) return json({ ok: false, error: 'too_large' }, 413)
+  let b
+  try {
+    const text = await request.text()
+    if (text.length > MAX_BODY) return json({ ok: false, error: 'too_large' }, 413)
+    b = JSON.parse(text)
+  } catch {
+    return json({ ok: false, error: 'invalid_json' }, 400)
+  }
+  if (!b || typeof b !== 'object' || typeof b.token !== 'string' || b.token === '') return json({ ok: false, error: 'bad_request' }, 400)
+  let lead
+  if (b.fallbackLead !== undefined) {
+    lead = fallbackLead(b.fallbackLead)
+    if (!lead) return json({ ok: false, error: 'bad_request' }, 400)
+  }
+
+  const verdict = await verifyTurnstile(request, { secret: env.TURNSTILE_SECRET, token: b.token, action: 'chat' })
+  if (!verdict.ok) {
+    console.warn(`[chat] turnstile refused: ${verdict.reason}`)
+    return json({ ok: false, error: 'turnstile' }, 403)
+  }
+  if (!(await allowed(request, env, { start: !lead }))) return json({ ok: false, error: 'too_many' }, 429)
+
+  const page = typeof b.page === 'string' && b.page.startsWith('/') && !b.page.startsWith('//') && b.page.length <= 512 ? b.page : null
+  const body = { host: url.hostname.toLowerCase(), lang: langOf(b.lang) ?? langOf(lang) ?? 'fr', page }
+  if (config?.sms === 'voipms') body.sms = 'voipms'
+  if (config?.photos === true) body.photos = true
+  if (lead) body.fallbackLead = lead
+
+  const headers = { 'content-type': 'application/json', [RPC_HEADER]: String(RPC_VERSION) }
+  const ip = request.headers.get('cf-connecting-ip')
+  if (ip) headers[VISITOR_IP_HEADER] = ip
+  let res
+  try {
+    res = await env.CHAT.fetch(`${SERVICE}/start`, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(body),
+    })
+  } catch {
+    return json({ ok: false, error: 'unavailable' }, 503)
+  }
+  let answer
+  try {
+    answer = await res.json()
+  } catch {
+    return json({ ok: false, error: 'unavailable' }, 503)
+  }
+  return json(answer, res.status)
+}
+
+async function socket(request, url, env) {
+  if (request.headers.get('upgrade')?.toLowerCase() !== 'websocket') return json({ ok: false, error: 'expected_websocket' }, 426)
+  if (!(await allowed(request, env))) return json({ ok: false, error: 'too_many' }, 429)
+  const q = new URLSearchParams()
+  for (const k of ['c', 'k']) q.set(k, url.searchParams.get(k) ?? '')
+  const headers = new Headers(request.headers)
+  for (const h of ['cookie', 'authorization', VISITOR_IP_HEADER]) headers.delete(h)
+  headers.set(RPC_HEADER, String(RPC_VERSION))
+  try {
+    return await env.CHAT.fetch(new Request(`${SERVICE}/ws?${q}`, { method: 'GET', headers }))
+  } catch {
+    return json({ ok: false, error: 'unavailable' }, 503)
+  }
+}
+
+/** The body, at most `max` bytes: a declared length over it is refused unread, the read is counted. */
+async function readCapped(request, max) {
+  const declared = Number(request.headers.get('content-length') ?? '')
+  if (Number.isFinite(declared) && declared > max) return null
+  if (!request.body) return new Uint8Array()
+  const reader = request.body.getReader()
+  const chunks = []
+  let size = 0
+  for (;;) {
+    const { done, value } = await reader.read()
+    if (done) break
+    size += value.byteLength
+    if (size > max) {
+      await reader.cancel().catch(() => {})
+      return null
+    }
+    chunks.push(value)
+  }
+  const out = new Uint8Array(size)
+  let o = 0
+  for (const c of chunks) { out.set(c, o); o += c.byteLength }
+  return out
+}
+
+async function photo(request, url, env, { config }) {
+  if (config?.photos !== true) return json({ ok: false, error: 'photos_off' }, 403)
+  if (!(await allowed(request, env))) return json({ ok: false, error: 'too_many' }, 429)
+  let bytes
+  try {
+    bytes = await readCapped(request, MAX_PHOTO_BYTES)
+  } catch {
+    return json({ ok: false, error: 'bad_request' }, 400)
+  }
+  if (!bytes) return json({ ok: false, error: 'too_large' }, 413)
+  const q = new URLSearchParams()
+  for (const k of ['c', 'k', 'id']) q.set(k, url.searchParams.get(k) ?? '')
+  let res
+  try {
+    res = await env.CHAT.fetch(`${SERVICE}/photo?${q}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/octet-stream', [RPC_HEADER]: String(RPC_VERSION) },
+      body: bytes,
+    })
+  } catch {
+    return json({ ok: false, error: 'unavailable' }, 503)
+  }
+  let answer
+  try {
+    answer = await res.json()
+  } catch {
+    return json({ ok: false, error: 'unavailable' }, 503)
+  }
+  return json(answer, res.status)
+}
+
+/**
+ * Route every `/api/chat/*` request here from the site Worker, before the assets. `hosts` are the
+ * site's real hosts (src/data/hosts.ts); `config` is pmeweb.json `plugins.chat` (every route answers
+ * 403 `disabled` unless `config.enabled === true`); `lang` the site's default language.
+ */
+export async function handleChat(request, env, ctx, { hosts, config = {}, lang = 'fr' } = {}) {
+  const url = new URL(request.url)
+  if (!isCanonicalHost(url.host, Array.isArray(hosts) ? hosts : [])) return json({ ok: false, error: 'disabled' }, 403)
+  // Switched off (pmeweb.json plugins.chat.enabled not true): paused, nothing reaches pmeweb-chat.
+  if (config?.enabled !== true) return json({ ok: false, error: 'disabled' }, 403)
+  if (url.pathname === '/api/chat/start') {
+    if (request.method !== 'POST') return json({ ok: false, error: 'method' }, 405, { allow: 'POST' })
+    return start(request, url, env, { config, lang })
+  }
+  if (url.pathname === '/api/chat/ws') {
+    if (request.method !== 'GET') return json({ ok: false, error: 'method' }, 405, { allow: 'GET' })
+    return socket(request, url, env)
+  }
+  if (url.pathname === '/api/chat/photo') {
+    if (request.method !== 'POST') return json({ ok: false, error: 'method' }, 405, { allow: 'POST' })
+    return photo(request, url, env, { config })
+  }
+  return json({ ok: false, error: 'not_found' }, 404)
+}
+
+/**
+ * For the site's /api/plugins/sante (pluginHealth): booleans only, the ping bounded by a timeout.
+ * `host` is the site's canonical host (CANONICAL_HOSTS[0]): pmeweb-chat reads the client's settings
+ * by host, so without it `settings` is false. `config` is pmeweb.json `plugins.chat`: given and not
+ * `enabled: true`, the answer is `{ checks: { disabled: true } }` (ok, « Désactivé » in the portal).
+ */
+export async function health(env, { host, config } = {}) {
+  // Switched off: ok, and one check the portal reads as « Désactivé ». No ping: nothing to check.
+  if (config !== undefined && config?.enabled !== true) return { version: VERSION, rpc: RPC_VERSION, checks: { disabled: true } }
+  let answer = null
+  let timer
+  try {
+    if (env.CHAT?.ping) {
+      const ping = Promise.resolve(env.CHAT.ping(host ?? ''))
+      const timeout = new Promise((resolve) => { timer = setTimeout(() => resolve(null), PING_TIMEOUT_MS) })
+      answer = await Promise.race([ping, timeout])
+    }
+  } catch {
+    answer = null
+  }
+  clearTimeout(timer)
+  const rpc = answer?.ok === true && Array.isArray(answer.accepts) && answer.accepts.includes(RPC_VERSION)
+  return {
+    version: VERSION,
+    rpc: RPC_VERSION,
+    checks: {
+      secret: !!env.TURNSTILE_SECRET,
+      binding: !!env.CHAT,
+      limit: !!env.CHAT_LIMIT,
+      startLimit: !!env.CHAT_START_LIMIT,
+      rpc,
+      settings: rpc && !!host && answer.configured === true,
+    },
+  }
+}