@scalemule/news-publication 0.0.47 → 0.0.49

package/dist/pets-auth-server.cjs

@@ -0,0 +1,212 @@
+'use strict';
+
+var crypto = require('crypto');
+var sdk = require('@scalemule/sdk');
+
+// src/pets-auth-server.ts
+
+// src/pets.ts
+var PET_SLUG = /^[a-z0-9][a-z0-9-]{0,190}$/;
+
+// src/pets-server.ts
+var PetRequestError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+var petPrivateHeaders = {
+  "cache-control": "private, no-store",
+  "x-robots-tag": "noindex, nofollow",
+  "referrer-policy": "no-referrer",
+  "x-content-type-options": "nosniff"
+};
+function config(scope) {
+  const url = new URL(scope.gatewayUrl);
+  if (!scope.apiKey || !PET_SLUG.test(scope.collectionSlug) || url.username || url.password || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1"].includes(url.hostname)))
+    throw new PetRequestError(503, "The pet community is not available yet.");
+  return url.origin;
+}
+async function petRequest(scope, path, init = {}, fetcher = fetch) {
+  const gateway = config(scope);
+  if (!path.startsWith("/v1/") || path.includes("..") || /[\\\r\n]/.test(path))
+    throw new Error("Invalid platform path");
+  const response = await fetcher(gateway + path, {
+    method: init.method || "GET",
+    headers: {
+      ...sdk.buildClientContextHeaders(scope.clientContext),
+      "x-api-key": scope.apiKey,
+      "content-type": "application/json",
+      ...scope.accessToken ? { authorization: `Bearer ${scope.accessToken}` } : {}
+    },
+    body: init.body === void 0 ? void 0 : JSON.stringify(init.body),
+    cache: "no-store",
+    redirect: "error",
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!response.ok)
+    throw new PetRequestError(
+      response.status,
+      response.status === 401 ? "Please sign in to continue." : response.status === 404 ? "This pet resource is not available." : response.status === 409 ? "This contribution changed. Reload before saving." : response.status === 429 ? "Please wait before trying again." : "We couldn\u2019t complete that request. Please try again."
+    );
+  const json = await response.json();
+  return json?.data ?? json;
+}
+
+// src/pets-auth-server.ts
+var PAW_SESSION_COOKIE = "__Host-paw-reader";
+var FLOW = "__Host-paw-signin";
+var attrs = "Path=/; HttpOnly; Secure; SameSite=Lax";
+function pawCookie(request, name = PAW_SESSION_COOKIE) {
+  return request.headers.get("cookie")?.split(";").map((v) => v.trim()).find((v) => v.startsWith(name + "="))?.slice(name.length + 1);
+}
+function digest(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+function returnPath(value) {
+  return typeof value === "string" && value.startsWith("/") && !value.startsWith("//") && value.length <= 500 && !/[\\\r\n]/.test(value) ? value : "/account";
+}
+function sealPawFlow(state, next, key, now = Date.now()) {
+  const payload = Buffer.from(
+    JSON.stringify({
+      state: digest(state),
+      next: returnPath(next),
+      expires: now + 6e5
+    })
+  ).toString("base64url");
+  return payload + "." + crypto.createHmac("sha256", key).update("paw-signin:v1:" + payload).digest("hex");
+}
+function openPawFlow(raw, state, key, now = Date.now()) {
+  if (!key || !raw || raw.length > 2048 || !state || state.length > 2048)
+    return null;
+  const [payload, signature, extra] = raw.split(".");
+  if (!payload || extra || !/^[a-f0-9]{64}$/.test(signature || "")) return null;
+  if (!crypto.timingSafeEqual(
+    Buffer.from(signature, "hex"),
+    crypto.createHmac("sha256", key).update("paw-signin:v1:" + payload).digest()
+  ))
+    return null;
+  try {
+    const flow = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!Number.isFinite(flow.expires) || flow.expires <= now || !/^[a-f0-9]{64}$/.test(flow.state) || !crypto.timingSafeEqual(
+      Buffer.from(flow.state, "hex"),
+      Buffer.from(digest(state), "hex")
+    ))
+      return null;
+    return returnPath(flow.next);
+  } catch {
+    return null;
+  }
+}
+function createPawAuthHandler(options) {
+  return async (request, action) => {
+    const json = (body, status = 200) => Response.json(body, { status, headers: petPrivateHeaders });
+    try {
+      if (!options.enabled)
+        return json({ error: "Community sign-in is not available yet." }, 503);
+      const scope = await options.resolve(request), origin = new URL(scope.origin).origin;
+      if (!origin.startsWith("https://") || !scope.apiKey)
+        return json({ error: "Sign-in is not configured." }, 503);
+      const redirect = (path) => new Response(null, {
+        status: 303,
+        headers: {
+          ...petPrivateHeaders,
+          location: origin + returnPath(path)
+        }
+      });
+      if (action === "start" && request.method === "POST") {
+        if (request.headers.get("origin") !== origin)
+          return json({ error: "Sign in from this website." }, 403);
+        const callback = origin + "/api/paw-auth/callback";
+        const result = await petRequest(
+          scope,
+          "/v1/auth/oauth/ledvery/authorize?" + new URLSearchParams({ redirect_uri: callback }),
+          {},
+          options.fetch
+        );
+        const url = new URL(result.url);
+        if (url.origin !== new URL(options.issuerOrigin).origin || url.pathname !== "/authorize" || url.username || url.password || url.searchParams.get("state") !== result.state || url.searchParams.get("redirect_uri") !== callback || url.searchParams.get("code_challenge_method") !== "S256" || !url.searchParams.get("code_challenge"))
+          throw new Error("Invalid authorization response");
+        const response = json({ url: url.href });
+        response.headers.append(
+          "set-cookie",
+          `${FLOW}=${sealPawFlow(result.state, returnPath(new URL(request.url).searchParams.get("next")), scope.apiKey)}; ${attrs}; Max-Age=600`
+        );
+        return response;
+      }
+      if (action === "callback" && request.method === "GET") {
+        const query = new URL(request.url).searchParams, code = query.get("code"), state = query.get("state");
+        const next = openPawFlow(pawCookie(request, FLOW), state, scope.apiKey);
+        const response = redirect(next || "/account?signin=retry");
+        response.headers.append("set-cookie", `${FLOW}=; ${attrs}; Max-Age=0`);
+        if (!next || !code || code.length > 4096 || query.has("error"))
+          return response;
+        try {
+          const session = await petRequest(
+            scope,
+            "/v1/auth/oauth/ledvery/callback?" + new URLSearchParams({ code, state }),
+            {},
+            options.fetch
+          );
+          const expiry = Date.parse(session.expires_at);
+          if (!session.session_token || !/^[A-Za-z0-9._~-]{1,2048}$/.test(session.session_token) || !Number.isFinite(expiry) || expiry <= Date.now())
+            throw new Error("Invalid session");
+          const me = await petRequest(
+            { ...scope, accessToken: session.session_token },
+            "/v1/auth/me",
+            {},
+            options.fetch
+          );
+          if (!me.id || !me.email_verified)
+            throw new Error("Verified reader required");
+          response.headers.append(
+            "set-cookie",
+            `${PAW_SESSION_COOKIE}=${session.session_token}; ${attrs}; Expires=${new Date(expiry).toUTCString()}`
+          );
+          return response;
+        } catch {
+          response.headers.set("location", origin + "/account?signin=retry");
+          return response;
+        }
+      }
+      if (action === "session" && request.method === "GET") {
+        if (!scope.accessToken) return json({ authenticated: false });
+        const me = await petRequest(scope, "/v1/auth/me", {}, options.fetch);
+        return json({
+          authenticated: Boolean(me.id && me.email_verified),
+          name: me.full_name || "Neighbor"
+        });
+      }
+      if (action === "logout" && request.method === "POST") {
+        if (request.headers.get("origin") !== origin)
+          return json({ error: "Continue from this website." }, 403);
+        if (scope.accessToken)
+          await petRequest(
+            scope,
+            "/v1/auth/logout",
+            { method: "POST", body: { session_token: scope.accessToken } },
+            options.fetch
+          );
+        const response = json({ authenticated: false });
+        response.headers.append(
+          "set-cookie",
+          `${PAW_SESSION_COOKIE}=; ${attrs}; Max-Age=0`
+        );
+        return response;
+      }
+      return json({ error: "Route not found" }, 404);
+    } catch {
+      return json(
+        { error: "Sign-in is temporarily unavailable. Please try again." },
+        503
+      );
+    }
+  };
+}
+
+exports.PAW_SESSION_COOKIE = PAW_SESSION_COOKIE;
+exports.createPawAuthHandler = createPawAuthHandler;
+exports.openPawFlow = openPawFlow;
+exports.pawCookie = pawCookie;
+exports.sealPawFlow = sealPawFlow;

package/dist/pets-auth-server.d.cts

@@ -0,0 +1,17 @@
+import { PetScope } from './pets-server.cjs';
+import '@scalemule/sdk';
+import './sponsorships-CtnBe3S8.cjs';
+import './pets.cjs';
+
+declare const PAW_SESSION_COOKIE = "__Host-paw-reader";
+declare function pawCookie(request: Request, name?: string): string | undefined;
+declare function sealPawFlow(state: string, next: string, key: string, now?: number): string;
+declare function openPawFlow(raw: string | undefined, state: string | null, key: string, now?: number): string | null;
+declare function createPawAuthHandler(options: {
+    resolve(request: Request): Promise<PetScope>;
+    enabled: boolean;
+    issuerOrigin: string;
+    fetch?: typeof fetch;
+}): (request: Request, action: string) => Promise<Response>;
+
+export { PAW_SESSION_COOKIE, createPawAuthHandler, openPawFlow, pawCookie, sealPawFlow };

package/dist/pets-auth-server.d.ts

@@ -0,0 +1,17 @@
+import { PetScope } from './pets-server.js';
+import '@scalemule/sdk';
+import './sponsorships-CtnBe3S8.js';
+import './pets.js';
+
+declare const PAW_SESSION_COOKIE = "__Host-paw-reader";
+declare function pawCookie(request: Request, name?: string): string | undefined;
+declare function sealPawFlow(state: string, next: string, key: string, now?: number): string;
+declare function openPawFlow(raw: string | undefined, state: string | null, key: string, now?: number): string | null;
+declare function createPawAuthHandler(options: {
+    resolve(request: Request): Promise<PetScope>;
+    enabled: boolean;
+    issuerOrigin: string;
+    fetch?: typeof fetch;
+}): (request: Request, action: string) => Promise<Response>;
+
+export { PAW_SESSION_COOKIE, createPawAuthHandler, openPawFlow, pawCookie, sealPawFlow };

package/dist/pets-auth-server.js

@@ -0,0 +1,155 @@
+import { petPrivateHeaders, petRequest } from './chunk-ZXH3O537.js';
+import './chunk-MBBPEFDA.js';
+import { createHmac, timingSafeEqual, createHash } from 'crypto';
+
+var PAW_SESSION_COOKIE = "__Host-paw-reader";
+var FLOW = "__Host-paw-signin";
+var attrs = "Path=/; HttpOnly; Secure; SameSite=Lax";
+function pawCookie(request, name = PAW_SESSION_COOKIE) {
+  return request.headers.get("cookie")?.split(";").map((v) => v.trim()).find((v) => v.startsWith(name + "="))?.slice(name.length + 1);
+}
+function digest(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function returnPath(value) {
+  return typeof value === "string" && value.startsWith("/") && !value.startsWith("//") && value.length <= 500 && !/[\\\r\n]/.test(value) ? value : "/account";
+}
+function sealPawFlow(state, next, key, now = Date.now()) {
+  const payload = Buffer.from(
+    JSON.stringify({
+      state: digest(state),
+      next: returnPath(next),
+      expires: now + 6e5
+    })
+  ).toString("base64url");
+  return payload + "." + createHmac("sha256", key).update("paw-signin:v1:" + payload).digest("hex");
+}
+function openPawFlow(raw, state, key, now = Date.now()) {
+  if (!key || !raw || raw.length > 2048 || !state || state.length > 2048)
+    return null;
+  const [payload, signature, extra] = raw.split(".");
+  if (!payload || extra || !/^[a-f0-9]{64}$/.test(signature || "")) return null;
+  if (!timingSafeEqual(
+    Buffer.from(signature, "hex"),
+    createHmac("sha256", key).update("paw-signin:v1:" + payload).digest()
+  ))
+    return null;
+  try {
+    const flow = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!Number.isFinite(flow.expires) || flow.expires <= now || !/^[a-f0-9]{64}$/.test(flow.state) || !timingSafeEqual(
+      Buffer.from(flow.state, "hex"),
+      Buffer.from(digest(state), "hex")
+    ))
+      return null;
+    return returnPath(flow.next);
+  } catch {
+    return null;
+  }
+}
+function createPawAuthHandler(options) {
+  return async (request, action) => {
+    const json = (body, status = 200) => Response.json(body, { status, headers: petPrivateHeaders });
+    try {
+      if (!options.enabled)
+        return json({ error: "Community sign-in is not available yet." }, 503);
+      const scope = await options.resolve(request), origin = new URL(scope.origin).origin;
+      if (!origin.startsWith("https://") || !scope.apiKey)
+        return json({ error: "Sign-in is not configured." }, 503);
+      const redirect = (path) => new Response(null, {
+        status: 303,
+        headers: {
+          ...petPrivateHeaders,
+          location: origin + returnPath(path)
+        }
+      });
+      if (action === "start" && request.method === "POST") {
+        if (request.headers.get("origin") !== origin)
+          return json({ error: "Sign in from this website." }, 403);
+        const callback = origin + "/api/paw-auth/callback";
+        const result = await petRequest(
+          scope,
+          "/v1/auth/oauth/ledvery/authorize?" + new URLSearchParams({ redirect_uri: callback }),
+          {},
+          options.fetch
+        );
+        const url = new URL(result.url);
+        if (url.origin !== new URL(options.issuerOrigin).origin || url.pathname !== "/authorize" || url.username || url.password || url.searchParams.get("state") !== result.state || url.searchParams.get("redirect_uri") !== callback || url.searchParams.get("code_challenge_method") !== "S256" || !url.searchParams.get("code_challenge"))
+          throw new Error("Invalid authorization response");
+        const response = json({ url: url.href });
+        response.headers.append(
+          "set-cookie",
+          `${FLOW}=${sealPawFlow(result.state, returnPath(new URL(request.url).searchParams.get("next")), scope.apiKey)}; ${attrs}; Max-Age=600`
+        );
+        return response;
+      }
+      if (action === "callback" && request.method === "GET") {
+        const query = new URL(request.url).searchParams, code = query.get("code"), state = query.get("state");
+        const next = openPawFlow(pawCookie(request, FLOW), state, scope.apiKey);
+        const response = redirect(next || "/account?signin=retry");
+        response.headers.append("set-cookie", `${FLOW}=; ${attrs}; Max-Age=0`);
+        if (!next || !code || code.length > 4096 || query.has("error"))
+          return response;
+        try {
+          const session = await petRequest(
+            scope,
+            "/v1/auth/oauth/ledvery/callback?" + new URLSearchParams({ code, state }),
+            {},
+            options.fetch
+          );
+          const expiry = Date.parse(session.expires_at);
+          if (!session.session_token || !/^[A-Za-z0-9._~-]{1,2048}$/.test(session.session_token) || !Number.isFinite(expiry) || expiry <= Date.now())
+            throw new Error("Invalid session");
+          const me = await petRequest(
+            { ...scope, accessToken: session.session_token },
+            "/v1/auth/me",
+            {},
+            options.fetch
+          );
+          if (!me.id || !me.email_verified)
+            throw new Error("Verified reader required");
+          response.headers.append(
+            "set-cookie",
+            `${PAW_SESSION_COOKIE}=${session.session_token}; ${attrs}; Expires=${new Date(expiry).toUTCString()}`
+          );
+          return response;
+        } catch {
+          response.headers.set("location", origin + "/account?signin=retry");
+          return response;
+        }
+      }
+      if (action === "session" && request.method === "GET") {
+        if (!scope.accessToken) return json({ authenticated: false });
+        const me = await petRequest(scope, "/v1/auth/me", {}, options.fetch);
+        return json({
+          authenticated: Boolean(me.id && me.email_verified),
+          name: me.full_name || "Neighbor"
+        });
+      }
+      if (action === "logout" && request.method === "POST") {
+        if (request.headers.get("origin") !== origin)
+          return json({ error: "Continue from this website." }, 403);
+        if (scope.accessToken)
+          await petRequest(
+            scope,
+            "/v1/auth/logout",
+            { method: "POST", body: { session_token: scope.accessToken } },
+            options.fetch
+          );
+        const response = json({ authenticated: false });
+        response.headers.append(
+          "set-cookie",
+          `${PAW_SESSION_COOKIE}=; ${attrs}; Max-Age=0`
+        );
+        return response;
+      }
+      return json({ error: "Route not found" }, 404);
+    } catch {
+      return json(
+        { error: "Sign-in is temporarily unavailable. Please try again." },
+        503
+      );
+    }
+  };
+}
+
+export { PAW_SESSION_COOKIE, createPawAuthHandler, openPawFlow, pawCookie, sealPawFlow };