@robodev-ai/tenant-host 0.0.0-stage → 0.1.0

package/src/web-well-known.test.ts

@@ -0,0 +1,166 @@
+import assert from "node:assert/strict";
+import { existsSync } from "node:fs";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { resolveProjectResource, type ResolveRuntime, type ResourceKind } from "./resolve.js";
+import { webFileHeaders, webFileResponse } from "./web.js";
+
+/** A Fetch server on a free loopback port, and requests against it in an inject-like shape. */
+function serve(handler: (request: Request) => Promise<Response>) {
+  const server = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: handler });
+  return {
+    async inject(input: { method: string; url: string; headers?: Record<string, string> }) {
+      const response = await fetch(new URL(input.url, server.url), {
+        method: input.method,
+        headers: input.headers,
+      });
+      const rawPayload = Buffer.from(await response.arrayBuffer());
+      return {
+        statusCode: response.status,
+        headers: Object.fromEntries(response.headers) as Record<string, string | undefined>,
+        rawPayload,
+        body: rawPayload.toString("utf8"),
+      };
+    },
+    close: () => server.stop(true),
+  };
+}
+
+/** `rel` from `root` as the tenant core serves it, or null when the file is absent. */
+async function serveFile(
+  root: string,
+  rel: string,
+  kind: ResourceKind,
+  request: Request,
+): Promise<Response | null> {
+  const sent = await webFileResponse(
+    root,
+    rel,
+    kind,
+    { method: request.method, range: request.headers.get("range") ?? undefined },
+    "frame-ancestors 'self'",
+  );
+  return sent?.response ?? null;
+}
+
+const notFound = () => Response.json({ error: "not_found" }, { status: 404 });
+
+const AASA =
+  '{"applinks":{"details":[{"appIDs":["7G58AP3AJX.com.povio.graize"],"components":[{"/":"/tip/*"}]}]}}';
+
+function spaRuntime(has: (rel: string) => boolean): ResolveRuntime {
+  return { routes: [], frontendKind: "react", webHas: has };
+}
+
+/** Same static / SPA / 404 branches as the tenant core, over a temp web root. */
+function hostOver(root: string) {
+  return serve(async (request) => {
+    const resolved = resolveProjectResource(
+      new URL(request.url).pathname,
+      request.method,
+      spaRuntime((rel) => existsSync(join(root, rel))),
+    );
+    if (resolved.kind === "static" || resolved.kind === "spa") {
+      const sent = await serveFile(root, resolved.rel ?? "index.html", resolved.kind, request);
+      if (sent) return sent;
+    }
+    return notFound();
+  });
+}
+
+test("app association paths resolve to static files, never the SPA fallback", () => {
+  const withFiles = spaRuntime((rel) =>
+    [
+      "index.html",
+      ".well-known/apple-app-site-association",
+      ".well-known/assetlinks.json",
+      "apple-app-site-association",
+    ].includes(rel),
+  );
+  for (const [pathname, rel] of [
+    ["/.well-known/apple-app-site-association", ".well-known/apple-app-site-association"],
+    ["/.well-known/apple-app-site-association/", ".well-known/apple-app-site-association"],
+    ["/apple-app-site-association", "apple-app-site-association"],
+    ["/.well-known/assetlinks.json", ".well-known/assetlinks.json"],
+  ] as const) {
+    assert.deepEqual(resolveProjectResource(pathname, "GET", withFiles), { kind: "static", rel });
+  }
+
+  const spaOnly = spaRuntime((rel) => rel === "index.html");
+  for (const pathname of [
+    "/.well-known/apple-app-site-association",
+    "/apple-app-site-association",
+    "/.well-known/assetlinks.json",
+    "/.well-known/anything",
+  ]) {
+    assert.equal(resolveProjectResource(pathname, "GET", spaOnly).kind, "not_found", pathname);
+  }
+  assert.equal(resolveProjectResource("/tip/abc", "GET", spaOnly).kind, "spa");
+  // The project's MCP OAuth discovery still wins over static files.
+  assert.equal(
+    resolveProjectResource("/.well-known/oauth-protected-resource", "GET", spaOnly).kind,
+    "oauth",
+  );
+});
+
+test("app association files are JSON with a one-hour cache", () => {
+  for (const rel of [
+    ".well-known/apple-app-site-association",
+    "apple-app-site-association",
+    ".well-known/assetlinks.json",
+  ]) {
+    assert.deepEqual(webFileHeaders(rel, "static"), {
+      type: "application/json",
+      cache: "public, max-age=3600",
+    });
+  }
+  assert.equal(
+    webFileHeaders("assets/apple-app-site-association", "static").type,
+    "application/octet-stream",
+  );
+  assert.equal(webFileHeaders("index.html", "spa").cache, "no-store");
+});
+
+test("serves apple-app-site-association as 200 JSON without a redirect, 404 when absent", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-web-"));
+  const server = hostOver(root);
+  try {
+    await writeFile(join(root, "index.html"), "<html>spa</html>");
+
+    const missing = await server.inject({
+      method: "GET",
+      url: "/.well-known/apple-app-site-association",
+    });
+    assert.equal(missing.statusCode, 404);
+    assert.match(String(missing.headers["content-type"]), /^application\/json/);
+    assert.doesNotMatch(missing.body, /<html/);
+
+    await mkdir(join(root, ".well-known"), { recursive: true });
+    await writeFile(join(root, ".well-known/apple-app-site-association"), AASA);
+    await writeFile(join(root, ".well-known/assetlinks.json"), "[]");
+    await writeFile(join(root, "apple-app-site-association"), AASA);
+
+    for (const url of [
+      "/.well-known/apple-app-site-association",
+      "/.well-known/apple-app-site-association/",
+      "/apple-app-site-association",
+    ]) {
+      const response = await server.inject({ method: "GET", url });
+      assert.equal(response.statusCode, 200, url);
+      assert.equal(response.headers["content-type"], "application/json", url);
+      assert.equal(response.headers["cache-control"], "public, max-age=3600", url);
+      assert.equal(response.headers.location, undefined, url);
+      assert.equal(response.body, AASA, url);
+    }
+
+    const assetlinks = await server.inject({ method: "GET", url: "/.well-known/assetlinks.json" });
+    assert.equal(assetlinks.statusCode, 200);
+    assert.equal(assetlinks.headers["content-type"], "application/json");
+    assert.equal(assetlinks.body, "[]");
+  } finally {
+    await server.close();
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/web.ts

@@ -0,0 +1,129 @@
+import { createReadStream, existsSync } from "node:fs";
+import { stat } from "node:fs/promises";
+import { extname, relative, resolve } from "node:path";
+import { parseByteRange } from "@robodev-ai/runtime";
+import { makeResponse } from "./response.js";
+import type { ResourceKind } from "./resolve.js";
+
+/** App-association files fetched by exact path: iOS Universal Links and Android App Links. */
+const APP_ASSOCIATION_RELS = new Set([
+  ".well-known/apple-app-site-association",
+  "apple-app-site-association",
+  ".well-known/assetlinks.json",
+]);
+
+const MIME: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain; charset=utf-8",
+  ".md": "text/plain; charset=utf-8",
+  ".map": "application/json",
+  ".woff2": "font/woff2",
+  ".woff": "font/woff",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".ico": "image/x-icon",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime",
+  ".pdf": "application/pdf",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".ogg": "audio/ogg",
+};
+
+function mimeFor(rel: string): string {
+  // Apple requires JSON for the extensionless apple-app-site-association file.
+  if (APP_ASSOCIATION_RELS.has(rel)) return "application/json";
+  return MIME[extname(rel).toLowerCase()] ?? "application/octet-stream";
+}
+
+function cacheFor(kind: ResourceKind, rel: string): string {
+  if (kind === "asset") return "public, max-age=31536000, immutable";
+  if (APP_ASSOCIATION_RELS.has(rel)) return "public, max-age=3600";
+  if (kind === "spa" || rel === "index.html") return "no-store";
+  return "no-cache";
+}
+
+/** Content-Type and Cache-Control for a file served from a project's web root. */
+export function webFileHeaders(rel: string, kind: ResourceKind): { type: string; cache: string } {
+  return { type: mimeFor(rel), cache: cacheFor(kind, rel) };
+}
+
+/** `relPath` inside `root`, or null when it escapes the root or does not exist. */
+export function safeFileIn(root: string, relPath: string): string | null {
+  if (!relPath || relPath.includes("\0")) return null;
+  const abs = resolve(root, relPath);
+  const inside = relative(root, abs);
+  if (inside.startsWith("..") || inside.includes("\0")) return null;
+  return existsSync(abs) ? abs : null;
+}
+
+/**
+ * `rel` from `root` as a response, or null when it is absent so the caller can 404. Sent
+ * from disk with single-range support, so a 31MB video is never buffered and Safari (which
+ * refuses to play mp4 without Range) can seek. `frameAncestors` goes on HTML as the CSP.
+ */
+export async function webFileResponse(
+  root: string,
+  rel: string,
+  kind: ResourceKind,
+  request: { method: string; range?: string },
+  frameAncestors: string,
+): Promise<{ response: Response; bytes: number } | null> {
+  const abs = safeFileIn(root, rel);
+  if (!abs) return null;
+  const info = await stat(abs);
+  if (!info.isFile()) return null;
+  const size = info.size;
+  const { type, cache } = webFileHeaders(rel, kind);
+  const headers = new Headers({
+    "content-type": type,
+    "cache-control": cache,
+    "accept-ranges": "bytes",
+  });
+  if (type.startsWith("text/html")) headers.set("content-security-policy", frameAncestors);
+  const range = parseByteRange(request.range, size);
+  if (range === "unsatisfiable") {
+    headers.set("content-range", `bytes */${size}`);
+    return { response: makeResponse(416, headers, undefined), bytes: 0 };
+  }
+  const start = range ? range.start : 0;
+  const end = range ? range.end : size - 1;
+  const length = size === 0 ? 0 : end - start + 1;
+  const status = range ? 206 : 200;
+  if (range) headers.set("content-range", `bytes ${start}-${end}/${size}`);
+  headers.set("content-length", String(length));
+  if (length === 0 || request.method === "HEAD") {
+    return { response: makeResponse(status, headers, length === 0 ? "" : undefined), bytes: 0 };
+  }
+  return { response: fileSliceResponse(abs, start, end, status, headers), bytes: length };
+}
+
+type BunFile = { file(path: string): Blob };
+
+/**
+ * Bytes `start..end` of `abs`. On Bun the body is a file slice, which Bun.serve sends with this
+ * Content-Length (a stream body would go out chunked, and Safari will not seek a video without
+ * a length); elsewhere it is a read stream.
+ */
+function fileSliceResponse(
+  abs: string,
+  start: number,
+  end: number,
+  status: number,
+  headers: Headers,
+): Response {
+  const bun = (globalThis as { Bun?: BunFile }).Bun;
+  if (bun) return new Response(bun.file(abs).slice(start, end + 1), { status, headers });
+  return makeResponse(status, headers, createReadStream(abs, { start, end }));
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.