@raclettejs/core 0.1.18 → 0.1.20

package/services/backend/src/modules/authentication/index.ts

@@ -3,6 +3,214 @@ import jwt from "@fastify/jwt"
 import fastifyPlugin from "fastify-plugin"
 import type { User } from "@shared/types"
 import configService from "@c/config/configService"
+import type { WorkSessionDoc } from "@/corePlugins/raclette__core/backend/datatypes/workSession/workSession.schema"
+import { ForbiddenError } from "@/utils/errors"
+
+const WORK_SESSION_COLLECTION = "raclette__core-worksession"
+const WORK_SESSION_HEADER = "x-work-session-id"
+
+/**
+ * Middleware: allow either authenticated user (JWT) or valid work session (X-Work-Session-Id).
+ * When using this, the route states that it handles permission checks itself (e.g. compare req.workSession with query).
+ * - If JWT present and valid: sets req.user (normal auth).
+ * - If no/invalid JWT but X-Work-Session-Id present: loads work session, validates (active, not expired),
+ *   optionally checks that workSession.pluginData includes the given pluginKey, then sets req.workSession and req.isWorkSession.
+ */
+export const authenticatedOrWorksession = async (
+  req: FastifyRequest,
+  res: FastifyReply,
+  fastify: FastifyInstance,
+  pluginKey: string,
+) => {
+  fastify.log.debug(
+    `[Auth] authenticatedOrWorksession: ${pluginKey} ${req.method} ${req.url}`,
+  )
+
+  const { requireAuthentication } = configService.getConfig()?.global ?? {
+    requireAuthentication: true,
+  }
+  const isAdminTagRequired = configService.isAdminTagRequired()
+
+  if (!requireAuthentication) {
+    const mockUser: Partial<User> = { _id: "SYSTEM" }
+    req.user = mockUser as User
+    return
+  }
+
+  // 1) Try JWT first
+  try {
+    await req.jwtVerify()
+    const payload = req.user as {
+      type?: string
+      sessionId?: string
+      _id?: string
+    }
+    fastify.log.debug(
+      `[Auth] JWT verified, payload type: ${payload.type || "user"}, sessionId: ${payload.sessionId || "none"}, _id: ${payload._id || "none"}`,
+    )
+
+    if (payload.type === "workSession" && payload.sessionId) {
+      fastify.log.info(
+        `[Auth] Work session JWT detected, sessionId: ${payload.sessionId}, pluginKey: ${pluginKey}`,
+      )
+      // Work session JWT: load session and validate
+      const workSession = await loadAndValidateWorkSession(
+        fastify,
+        payload.sessionId,
+        pluginKey,
+      )
+      if (!workSession) {
+        fastify.log.warn(
+          `[Auth] Work session validation failed for sessionId: ${payload.sessionId}`,
+        )
+        return res
+          .status(401)
+          .send({ message: "Invalid or expired work session" })
+      }
+      fastify.log.info(
+        `[Auth] Work session authenticated: sessionId=${payload.sessionId}, pluginKey=${pluginKey}`,
+      )
+      req.workSession = workSession
+      req.isWorkSession = true
+
+      // Set projectId from workSession.project if available
+      if (workSession.project) {
+        req.projectId = workSession.project
+        fastify.log.debug(`[Auth] Work session projectId: ${req.projectId}`)
+      }
+      return
+    }
+    // Normal user JWT: fetch user and set req.user
+    fastify.log.debug(
+      `[Auth] Normal user JWT, fetching user: ${(req.user as any)?._id}`,
+    )
+    const { _id } = req.user
+    const adminTag = await fastify.database
+      .collection("raclette__core-tag")
+      .findOne({ title: "ADMIN", locked: true, type: "system" })
+    let isAdmin = false
+    const user = await fastify.database
+      .collection("raclette__core-user")
+      .findOne({ _id }, { projection: { password: 0, resetKey: 0 } })
+    if (user && user.tags && adminTag) {
+      user.tags.forEach((tag: string) => {
+        if (adminTag._id === tag) isAdmin = true
+      })
+    }
+    if (isAdminTagRequired && !isAdmin) {
+      fastify.log.error("User not allowed in workbench")
+      return res.status(403).send({ message: "User not allowed in workbench" })
+    }
+    if (isAdmin) user.isAdmin = true
+    if (!user) {
+      fastify.log.error("User not found")
+      return res.status(401).send({ message: "User not found" })
+    }
+    const account = await fastify.database
+      .collection("raclette__core-account")
+      .findOne({ _id: user.account })
+    user.account = account
+    req.user = user
+    // Set projectId from user's lastProjectId (for requestData.project in payload wrappers)
+    if (user.ux?.lastProjectId) {
+      req.projectId = user.ux.lastProjectId
+      fastify.log.debug(`[Auth] User projectId: ${req.projectId}`)
+    }
+    return
+  } catch (error: any) {
+    // JWT missing or invalid: try work session via header
+    fastify.log.debug(
+      `[Auth] JWT verification failed: ${error.message}, trying work session header`,
+    )
+  }
+
+  // 2) Try X-Work-Session-Id header
+  const sessionId = req.headers[WORK_SESSION_HEADER] as string | undefined
+  if (sessionId) {
+    const workSession = await loadAndValidateWorkSession(
+      fastify,
+      sessionId,
+      pluginKey,
+    )
+    if (workSession) {
+      req.workSession = workSession
+      req.isWorkSession = true
+
+      // Set projectId from workSession.project if available
+      // workaround for how projects/spaces are currently handled - tbd
+      if (workSession.project) {
+        req.projectId = workSession.project
+      }
+      return
+    } else {
+      fastify.log.warn(
+        `[Auth] Work session validation failed for header sessionId: ${sessionId}`,
+      )
+    }
+  }
+
+  return res.status(401).send({ message: "Authentication required" })
+}
+
+async function loadAndValidateWorkSession(
+  fastify: FastifyInstance,
+  sessionId: string,
+  pluginKey: string,
+): Promise<WorkSessionDoc | null> {
+  fastify.log.debug(
+    `[WorkSession Auth] Loading and validating work session: sessionId=${sessionId}, pluginKey=${pluginKey}`,
+  )
+
+  if (!sessionId || typeof sessionId !== "string") {
+    fastify.log.warn(`[WorkSession Auth] Invalid sessionId: ${sessionId}`)
+    return null
+  }
+
+  fastify.log.debug(`[WorkSession Auth] Querying database for work session`)
+  const doc = await fastify.database
+    .collection(WORK_SESSION_COLLECTION)
+    .findOne({ _id: sessionId })
+
+  if (!doc) {
+    fastify.log.warn(`[WorkSession Auth] Work session not found: ${sessionId}`)
+    return null
+  }
+
+  if (!doc.isActive) {
+    fastify.log.warn(
+      `[WorkSession Auth] Work session is not active: ${sessionId}`,
+    )
+    return null
+  }
+
+  const expiry = doc.expiryDate ? new Date(doc.expiryDate) : null
+  if (expiry && expiry.getTime() < Date.now()) {
+    fastify.log.warn(
+      `[WorkSession Auth] Work session expired: ${sessionId}, expiryDate: ${expiry.toISOString()}`,
+    )
+    return null
+  }
+
+  // Check that this plugin is part of the work session (pluginData keys are "pluginKey:widgetName")
+  const pluginData = doc.pluginData || {}
+  const pluginKeys = Object.keys(pluginData)
+
+  const hasPlugin =
+    pluginKeys.some((k) => k.startsWith(pluginKey + ":")) ||
+    Object.prototype.hasOwnProperty.call(pluginData, pluginKey)
+
+  if (!hasPlugin) {
+    fastify.log.warn(
+      `[WorkSession Auth] Plugin ${pluginKey} not found in work session pluginData: ${pluginKeys.join(", ")}`,
+    )
+    return null
+  }
+
+  fastify.log.info(
+    `[WorkSession Auth] Work session validated successfully: sessionId=${sessionId}, pluginKey=${pluginKey}`,
+  )
+  return doc as WorkSessionDoc
+}
 
 export const authenticate = async (
   req: FastifyRequest,
@@ -20,12 +228,18 @@ export const authenticate = async (
         _id: "SYSTEM",
       }
 
-      req.user = mockUser
+      req.user = mockUser as User
       return
     }
 
     try {
       await req.jwtVerify()
+      const payload = req.user as { type?: string }
+      if (payload.type === "workSession") {
+        return res
+          .status(401)
+          .send({ message: "Work session token not allowed on this route" })
+      }
       // fetch current user data from the db
       const { _id } = req.user
       const adminTag = await fastify.database
@@ -73,17 +287,42 @@ export const authenticate = async (
     }
   }
 }
-
+export const checkPermissions = async (
+  req: FastifyRequest,
+  res: FastifyReply,
+  fastify: FastifyInstance,
+  permissions: Array<String>,
+) => {
+  {
+    try {
+      if (!permissions.length) {
+        fastify.log.error("No permissions given for permission check")
+        throw new Error("No Permissions")
+      }
+      // TODO implement proper Permission lookup here
+      permissions.forEach((permissionStr) => {
+        if (permissionStr === "user.isAdmin") {
+          if (!req.user.isAdmin) {
+            throw new ForbiddenError("User not permitted to action")
+          }
+        }
+      })
+    } catch (error: any) {
+      fastify.log.error(error.message)
+      return res.send(error.message)
+    }
+  }
+}
 export default fastifyPlugin(async (fastify: FastifyInstance, opts = {}) => {
   // provide some sensible options
   const defaults = {
     secret: false,
     decode: { complete: true },
     sign: {
-      iss: "api.projectjournal.pacifico.info",
+      iss: "api.raclettejs.info",
       expiresIn: "30d",
     },
-    verify: { allowedIss: "api.projectjournal.pacifico.info" },
+    verify: { allowedIss: "api.raclettejs.info" },
   }
 
   // merge proved opts with defaults
@@ -96,4 +335,16 @@ export default fastifyPlugin(async (fastify: FastifyInstance, opts = {}) => {
   fastify.decorate("authenticate", (req, res) => {
     return authenticate(req, res, fastify)
   })
+
+  fastify.decorate(
+    "authenticatedOrWorksession",
+    (pluginKey: string) => (req: FastifyRequest, res: FastifyReply) =>
+      authenticatedOrWorksession(req, res, fastify, pluginKey),
+  )
+  fastify.decorate(
+    "checkPermissions",
+    (permissionsArr: Array<String>) =>
+      (req: FastifyRequest, res: FastifyReply) =>
+        checkPermissions(req, res, fastify, permissionsArr),
+  )
 })

package/services/backend/src/modules/hooks/rate-limiter.ts

@@ -0,0 +1,21 @@
+import type { FastifyInstance } from "fastify"
+import fastifyPlugin from "fastify-plugin"
+import rateLimit from "@fastify/rate-limit"
+import configService from "@c/config/configService"
+
+export default fastifyPlugin(async (fastify: FastifyInstance) => {
+  const opts = configService.getFastifyRateLimits()
+  fastify.log.info("Fastify Ratelimiter with opts " + JSON.stringify(opts))
+  await fastify.register(rateLimit, opts)
+  fastify.setNotFoundHandler(
+    {
+      preHandler: fastify.rateLimit({
+        max: 4,
+        timeWindow: 500,
+      }),
+    },
+    function (request, reply) {
+      reply.code(404).send({ why: "you do dat?" })
+    },
+  )
+})

package/services/backend/src/types/custom-fastify.d.ts

@@ -12,11 +12,22 @@ import { HttpService } from "../core/http/httpTypes"
 import { UserDoc } from "@c/user/user.schema"
 import { FrontendPayloadRequestData } from "@/utils/request.utils"
 import { FastifyRequest, FastifyReply } from "fastify"
+import type RateLimit from "@fastify/rate-limit"
+import type { RequestWorkSession } from "@/corePlugins/raclette__core/backend/datatypes/workSession/workSession.schema"
+
+export type { RequestWorkSession }
 
 declare module "fastify" {
   interface FastifyInstance {
     database: Connection
+    rateLimit: RateLimit
     authenticate: (req: FastifyRequest, res: FastifyReply) => Promise<void>
+    authenticatedOrWorksession: (
+      pluginKey: string,
+    ) => (req: FastifyRequest, res: FastifyReply) => Promise<void>
+    checkPermissions: (
+      permissions: string,
+    ) => (req: FastifyRequest, res: FastifyReply) => Promise<void>
     wss: Socket<DefaultEventsMap, DefaultEventsMap, DefaultEventsMap, any>
     eventbus: EventEmitter
     cache: ValkeyService
@@ -32,6 +43,12 @@ declare module "fastify" {
     database: Connection
     user: UserDoc
     requestParams: FrontendPayloadRequestData
+    /** Set by authenticatedOrWorksession when request is via work session */
+    workSession?: RequestWorkSession
+    /** Set by authenticatedOrWorksession when request is via work session */
+    isWorkSession?: boolean
+    /** Project ID from user (lastProjectId) or workSession.project */
+    projectId?: string
   }
 
   interface RouteOptions {

package/services/backend/src/utils/request.utils.ts

@@ -11,13 +11,16 @@ export const createRequestParams = (
   req: RequestWithCommonHeaders,
   config: FastifyContextConfig,
 ): FrontendPayloadRequestData => {
+  // Get project from req.projectId (set by auth middleware), header, or empty string
+  const projectId = (req as any).projectId ?? req.headers["current-project"] ?? ""
+  
   const requestParams = {
     appSessionId: req.headers["app-session-id"] ?? "",
     appRequestCode: req.headers["app-request-code"] ?? "",
     requestId: req.id ?? "",
     type: "",
     broadcast: req.headers["app-broadcast-channels"] ?? false,
-    project: req.headers["current-project"] ?? "",
+    project: projectId,
     userId: req.user?.id,
     options: {},
     ...config,

package/services/backend/types/index.d.ts

@@ -1 +1,15 @@
-export * from "../src/types"
+export { 
+    RacletteAppMode,
+    RacletteConfig,
+    WorkbenchConfig,
+    ServiceFrontendConfig,
+    ServiceBackendConfig,
+    EnvironmentVariables,
+    VolumeDefinition,
+    CacheConfig,
+    SocketConfig,
+    RacletteModule,
+    PluginMetadata,
+    PackageSourceConfig,
+    PackageTargetsTuple,
+    PackageTarget } from "../src/types"

package/services/backend/yarn.lock

@@ -268,6 +268,15 @@
     "@fastify/forwarded" "^3.0.0"
     ipaddr.js "^2.1.0"
 
+"@fastify/rate-limit@10.3.0":
+  version "10.3.0"
+  resolved "https://registry.yarnpkg.com/@fastify/rate-limit/-/rate-limit-10.3.0.tgz#3cf6a56c0e3dd18fc0a56727675d7ba1d9a9bd7b"
+  integrity sha512-eIGkG9XKQs0nyynatApA3EVrojHOuq4l6fhB4eeCk4PIOeadvOJz9/4w3vGI44Go17uaXOWEcPkaD8kuKm7g6Q==
+  dependencies:
+    "@lukeed/ms" "^2.0.2"
+    fastify-plugin "^5.0.0"
+    toad-cache "^3.7.0"
+
 "@fastify/schedule@6.0.0":
   version "6.0.0"
   resolved "https://registry.yarnpkg.com/@fastify/schedule/-/schedule-6.0.0.tgz#0a82d2c49e9f2411b9aee312c5eb178b1dceb3fc"
@@ -760,10 +769,10 @@ avvio@^9.0.0:
     "@fastify/error" "^4.0.0"
     fastq "^1.17.1"
 
-axios@1.12.2:
-  version "1.12.2"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-1.12.2.tgz#6c307390136cf7a2278d09cec63b136dfc6e6da7"
-  integrity sha512-vMJzPewAlRyOgxV2dU0Cuz2O8zzzx9VYtbJOaBgXFeLc4IV/Eg50n4LowmehOOR61S8ZMpc2K5Sa7g6A4jfkUw==
+axios@1.13.2:
+  version "1.13.2"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.13.2.tgz#9ada120b7b5ab24509553ec3e40123521117f687"
+  integrity sha512-VPk9ebNqPcy5lRGuSlKx752IlDatOjT9paPlm8A7yOuW2Fbvp4X3JznJtT4f0GzGLLiWE9W8onz51SqLYwzGaA==
   dependencies:
     follow-redirects "^1.15.6"
     form-data "^4.0.4"

package/services/frontend/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <link rel="icon" href="/favicon.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>raclette - Come in and have some Cheese</title>
+    <title>racletteJS - Come in and have some Cheese</title>
     <link rel="manifest" href="./manifest.json" accept-version="*" />
     <script>
       window.configs = false

package/services/frontend/src/core/lib/configService.ts

@@ -59,7 +59,7 @@ export class ConfigService {
   public getConfig() {
     if (!this.config) {
       if (!cachedConfig) {
-        console.error("Failed to load Raclette configuration")
+        console.error("Failed to load racletteJS configuration")
       }
       this.config = cachedConfig
     }

package/services/frontend/src/core/lib/data/dataApi.ts

@@ -29,7 +29,16 @@ const $writeDataApi = (
       const _executeParams = clone(executeParams)
       errorSubject$.next(null)
       responseSubject$.next({})
-      const queryParams = mergeDeepRight(_params, _executeParams)
+      let queryParams
+      if (Array.isArray(_executeParams)) {
+        if (Array.isArray(_params)) {
+          queryParams = _params.concat(_executeParams)
+        }
+        queryParams = _executeParams
+      } else {
+        queryParams = mergeDeepRight(_params, _executeParams)
+      }
+
       if (options.responseType === "stream") {
         return writeData(actionId, operationDefinition, queryParams, options)
       }

package/services/frontend/src/core/lib/dataHelper.ts

@@ -389,7 +389,7 @@ const addItemDefaulAttributes = (item, user) => {
  * Will store the current time to the localStorage to determine the last time we had contact with the backend
  */
 const rememberLastDataUpdateRetrieval = (projectId) => {
-  const currentProject = projectId || globalApplicationName
+  const currentProject = projectId
 
   log.api("rememberLastDataUpdateRetrieval", currentProject)
   localStorage.setItem(`lastUpdate_${currentProject}`, new Date().toISOString())

package/services/frontend/src/core/lib/eggs/snow.ts

@@ -1,5 +1,6 @@
 export default () => {
-  let snowflakes_count = 100
+  // Reduced default count for better performance
+  let snowflakes_count = 20
 
   if (typeof total !== "undefined") {
     snowflakes_count = total
@@ -7,11 +8,13 @@ export default () => {
 
   // This function allows you to turn on and off the snow
   const toggle_snow = () => {
-    const check_box = document.getElementById("toggle_snow")
+    const check_box = document.getElementById(
+      "toggle_snow",
+    ) as HTMLInputElement | null
     const snowEl = document.getElementById("snow")
 
     if (snowEl) {
-      snowEl.style.display = check_box.checked ? "block" : "none"
+      snowEl.style.display = check_box?.checked ? "block" : "none"
     }
   }
 
@@ -25,91 +28,106 @@ export default () => {
 
       // Set CSS custom properties for each snowflake
       const randomX = Math.random() * 100
-      const randomScale = 0.3 + Math.random() * 0.7 // Scale between 0.3 and 1
-      const randomDuration = 8 + Math.random() * 15 // Duration between 8-23s
-      const randomDelay = Math.random() * 10 // Delay between 0-10s
-      const randomOpacity = 0.3 + Math.random() * 0.7 // Opacity between 0.3-1
-      const randomAnimation = Math.floor(Math.random() * 5) + 1 // Choose from 5 animations
-
-      snowflake.style.setProperty("--start-x", `${randomX}vw`)
-      snowflake.style.setProperty("--scale", randomScale)
+      const randomScale = 0.3 + Math.random() * 0.7
+      const randomDuration = 10 + Math.random() * 15 // Slower = less GPU work
+      const randomDelay = Math.random() * 15
+      const randomOpacity = 0.4 + Math.random() * 0.6
+      const randomAnimation = Math.floor(Math.random() * 3) + 1
+
+      snowflake.style.setProperty("--start-x", `${randomX}%`)
+      snowflake.style.setProperty("--scale", randomScale.toString())
       snowflake.style.setProperty("--duration", `${randomDuration}s`)
       snowflake.style.setProperty("--delay", `${randomDelay}s`)
-      snowflake.style.setProperty("--opacity", randomOpacity)
+      snowflake.style.setProperty("--opacity", randomOpacity.toString())
       snowflake.style.setProperty("--animation-name", `fall-${randomAnimation}`)
 
       fragment.appendChild(snowflake)
     }
 
-    document.getElementById("snow").appendChild(fragment)
+    document.getElementById("snow")?.appendChild(fragment)
   }
 
-  // Optimized CSS with reusable animations and CSS custom properties
+  // Highly optimized CSS with maximum performance settings
   const createOptimizedCSS = () => {
     const css = `
       #snow {
         position: fixed;
         top: 0;
         left: 0;
-        width: 100%;
-        height: 100%;
+        right: 0;
+        bottom: 0;
         pointer-events: none;
         z-index: 1000;
+        overflow: hidden;
+        /* Contain layout calculations */
+        contain: layout style paint;
       }
 
       .snowflake {
         position: absolute;
-        width: 8px;
-        height: 8px;
-        background: white;
+        top: -10px;
+        width: 6px;
+        height: 6px;
+        background: rgba(255, 255, 255, 0.9);
         border-radius: 50%;
-        filter: drop-shadow(0 0 6px rgba(255, 255, 255, 0.8));
+        
+        /* Critical GPU optimizations */
         will-change: transform;
+        transform: translateZ(0);
+        backface-visibility: hidden;
+        
+        /* REMOVED box-shadow - this is a major performance killer */
+        /* Even lightweight shadows are expensive with many elements */
         
         /* Use CSS custom properties for individual variations */
         left: var(--start-x);
         opacity: var(--opacity);
-        transform: scale(var(--scale));
         animation: var(--animation-name) var(--duration) var(--delay) linear infinite;
+        
+        /* Reduce repaints by using contain */
+        contain: layout style paint;
       }
 
-      /* 5 different falling patterns for variety */
+      /* Ultra-optimized animations - only transform property */
+      /* Grouped transforms reduce compositing work */
       @keyframes fall-1 {
-        0% { transform: translateY(-10px) translateX(0) scale(var(--scale)); }
-        25% { transform: translateY(25vh) translateX(10px) scale(var(--scale)); }
-        50% { transform: translateY(50vh) translateX(-5px) scale(var(--scale)); }
-        75% { transform: translateY(75vh) translateX(8px) scale(var(--scale)); }
-        100% { transform: translateY(100vh) translateX(0) scale(var(--scale)); }
+        0% { 
+          transform: translate3d(0, 0, 0) scale(var(--scale));
+        }
+        100% { 
+          transform: translate3d(20px, 100vh, 0) scale(var(--scale));
+        }
       }
 
       @keyframes fall-2 {
-        0% { transform: translateY(-10px) translateX(0) scale(var(--scale)); }
-        30% { transform: translateY(30vh) translateX(-15px) scale(var(--scale)); }
-        60% { transform: translateY(60vh) translateX(10px) scale(var(--scale)); }
-        100% { transform: translateY(100vh) translateX(-5px) scale(var(--scale)); }
+        0% { 
+          transform: translate3d(0, 0, 0) scale(var(--scale));
+        }
+        100% { 
+          transform: translate3d(-20px, 100vh, 0) scale(var(--scale));
+        }
       }
 
       @keyframes fall-3 {
-        0% { transform: translateY(-10px) translateX(0) scale(var(--scale)); }
-        20% { transform: translateY(20vh) translateX(5px) scale(var(--scale)); }
-        40% { transform: translateY(40vh) translateX(-10px) scale(var(--scale)); }
-        70% { transform: translateY(70vh) translateX(15px) scale(var(--scale)); }
-        100% { transform: translateY(100vh) translateX(0) scale(var(--scale)); }
+        0% { 
+          transform: translate3d(0, 0, 0) scale(var(--scale));
+        }
+        100% { 
+          transform: translate3d(0, 100vh, 0) scale(var(--scale));
+        }
       }
 
-      @keyframes fall-4 {
-        0% { transform: translateY(-10px) translateX(0) scale(var(--scale)); }
-        35% { transform: translateY(35vh) translateX(20px) scale(var(--scale)); }
-        65% { transform: translateY(65vh) translateX(-8px) scale(var(--scale)); }
-        100% { transform: translateY(100vh) translateX(12px) scale(var(--scale)); }
+      /* Pause animations when snow container is hidden to save resources */
+      #snow[style*="display: none"] .snowflake {
+        animation-play-state: paused;
       }
 
-      @keyframes fall-5 {
-        0% { transform: translateY(-10px) translateX(0) scale(var(--scale)); }
-        15% { transform: translateY(15vh) translateX(-5px) scale(var(--scale)); }
-        45% { transform: translateY(45vh) translateX(12px) scale(var(--scale)); }
-        80% { transform: translateY(80vh) translateX(-7px) scale(var(--scale)); }
-        100% { transform: translateY(100vh) translateX(3px) scale(var(--scale)); }
+      /* Reduce motion for users who prefer it */
+      @media (prefers-reduced-motion: reduce) {
+        .snowflake {
+          animation: none;
+          display: none;
+        }
       }
     `
 
@@ -142,7 +160,7 @@ export default () => {
     } else {
       // Remove existing snow
       snowEl.remove()
-      // Optionally remove styles as well
+      // Remove styles as well
       const styles = document.getElementById("snow-styles")
       if (styles) {
         styles.remove()

package/services/frontend/src/core/lib/helpers/index.ts

@@ -0,0 +1 @@
+export * from "./removeEmpty"