@rubytech/create-maxy-code 0.1.113 → 0.1.114

package/payload/server/server.js

@@ -12134,6 +12134,55 @@ app34.get("/:rel{.*}", (c) => {
 });
 var sites_default = app34;
 
+// server/routes/listings.ts
+var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
+var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
+var app35 = new Hono();
+app35.get("/:slug/click", async (c) => {
+  const slug = c.req.param("slug") ?? "";
+  const rawSession = c.req.query("session") ?? "";
+  const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
+  if (!SAFE_SLUG_RE.test(slug)) {
+    console.error(`[property-card-click] reject reason=bad-slug-shape slug=${JSON.stringify(slug)} status=400`);
+    return c.text("Bad Request", 400);
+  }
+  const account = resolveAccount();
+  if (!account) {
+    console.error(`[property-card-click] reject reason=no-account slug=${slug} status=404`);
+    return c.text("Not Found", 404);
+  }
+  let pageUrl = null;
+  const session = getSession();
+  try {
+    const result = await session.run(
+      `MATCH (l:Listing {accountId: $accountId, slug: $slug})
+       WHERE l.scope = 'public'
+       RETURN l.pageUrl AS pageUrl
+       LIMIT 1`,
+      { accountId: account.accountId, slug }
+    );
+    const record = result.records[0];
+    const raw = record?.get("pageUrl");
+    pageUrl = typeof raw === "string" && raw.length > 0 ? raw : null;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[property-card-click] reject reason=neo4j-error slug=${slug} sessionKey=${sessionKey} err=${JSON.stringify(message)} status=503`);
+    await session.close().catch(() => {
+    });
+    return c.text("Service Unavailable", 503);
+  } finally {
+    await session.close().catch(() => {
+    });
+  }
+  if (!pageUrl) {
+    console.error(`[property-card-click] reject reason=listing-not-found slug=${slug} sessionKey=${sessionKey} accountId=${account.accountId} status=404`);
+    return c.text("Not Found", 404);
+  }
+  console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
+  return c.redirect(pageUrl, 302);
+});
+var listings_default = app35;
+
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
 var timer = null;
@@ -12567,9 +12616,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app35 = new Hono();
-app35.use("*", clientIpMiddleware);
-app35.use("*", async (c, next) => {
+var app36 = new Hono();
+app36.use("*", clientIpMiddleware);
+app36.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -12579,7 +12628,7 @@ app35.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app35.use("*", async (c, next) => {
+app36.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -12612,7 +12661,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app35.use("*", async (c, next) => {
+app36.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -12652,7 +12701,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app35.post("/__remote-auth/login", async (c) => {
+app36.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -12697,7 +12746,7 @@ app35.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app35.get("/__remote-auth/logout", (c) => {
+app36.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -12710,7 +12759,7 @@ app35.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app35.post("/__remote-auth/change-password", async (c) => {
+app36.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -12761,13 +12810,13 @@ app35.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app35.get("/__remote-auth/setup", (c) => {
+app36.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app35.post("/__remote-auth/set-initial-password", async (c) => {
+app36.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -12805,10 +12854,10 @@ app35.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app35.get("/api/remote-auth/status", (c) => {
+app36.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app35.post("/api/remote-auth/set-password", async (c) => {
+app36.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12839,9 +12888,9 @@ app35.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app35.route("/api/_client-error", client_error_default);
+app36.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app35.use("*", async (c, next) => {
+app36.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -12874,12 +12923,12 @@ app35.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app35.route("/api/health", health_default);
-app35.route("/api/chat", chat_default);
-app35.route("/api/whatsapp", whatsapp_default);
-app35.route("/api/onboarding", onboarding_default);
-app35.route("/api/admin", admin_default);
-var SAFE_SLUG_RE = /^[a-z][a-z0-9-]{2,49}$/;
+app36.route("/api/health", health_default);
+app36.route("/api/chat", chat_default);
+app36.route("/api/whatsapp", whatsapp_default);
+app36.route("/api/onboarding", onboarding_default);
+app36.route("/api/admin", admin_default);
+var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
   ".png": "image/png",
@@ -12890,10 +12939,10 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app35.get("/agent-assets/:slug/:filename", (c) => {
+app36.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
-  if (!SAFE_SLUG_RE.test(slug)) {
+  if (!SAFE_SLUG_RE2.test(slug)) {
     console.error(`[agent-assets] invalid-slug slug=${slug}`);
     return c.text("Not found", 404);
   }
@@ -12925,7 +12974,7 @@ app35.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app35.get("/generated/:filename", (c) => {
+app36.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -12955,7 +13004,8 @@ app35.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app35.route("/sites", sites_default);
+app36.route("/sites", sites_default);
+app36.route("/listings", listings_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -13092,7 +13142,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app35.get("/", (c) => {
+app36.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -13100,12 +13150,12 @@ app35.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app35.get("/public", (c) => {
+app36.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app35.get("/chat", (c) => {
+app36.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -13124,9 +13174,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app35.use("/vnc-viewer.html", logViewerFetch);
-app35.use("/vnc-popout.html", logViewerFetch);
-app35.get("/vnc-popout.html", (c) => {
+app36.use("/vnc-viewer.html", logViewerFetch);
+app36.use("/vnc-popout.html", logViewerFetch);
+app36.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync19(resolve21(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -13139,7 +13189,7 @@ app35.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app35.post("/api/vnc/client-event", async (c) => {
+app36.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13160,25 +13210,25 @@ app35.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app35.get("/g/:slug", (c) => {
+app36.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app35.get("/graph", (c) => {
+app36.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app35.get("/sessions", (c) => {
+app36.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app35.get("/data", (c) => {
+app36.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app35.get("/:slug", async (c, next) => {
+app36.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -13188,15 +13238,15 @@ app35.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app35.get("/favicon.ico", (c) => {
+  app36.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app35.use("/*", serveStatic({ root: "./public" }));
+app36.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app35.fetch, port, hostname });
+var httpServer = serve({ fetch: app36.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -13220,7 +13270,8 @@ var SUBAPP_MANIFEST = [
   { prefix: "/api/whatsapp", file: "server/routes/whatsapp.ts", subapp: whatsapp_default },
   { prefix: "/api/onboarding", file: "server/routes/onboarding.ts", subapp: onboarding_default },
   { prefix: "/api/admin", file: "server/routes/admin/index.ts", subapp: admin_default },
-  { prefix: "/api/_client-error", file: "server/routes/client-error.ts", subapp: client_error_default }
+  { prefix: "/api/_client-error", file: "server/routes/client-error.ts", subapp: client_error_default },
+  { prefix: "/listings", file: "server/routes/listings.ts", subapp: listings_default }
 ];
 for (const m of SUBAPP_MANIFEST) {
   const routeCount = Array.isArray(m.subapp.routes) ? m.subapp.routes.length : 0;
@@ -13228,7 +13279,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app35.routes ?? []) {
+  for (const r of app36.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });