@scoutmesh/viewer 0.2.0

package/dist/server.js

@@ -0,0 +1,339 @@
+import { timingSafeEqual } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { createServer } from "node:http";
+                                                                 
+
+import { externalUrl, openExternalBrowser } from "./external-browser.js";
+import { InputError } from "./input-error.js";
+import { defaultStateFile } from "./state-file.js";
+import { ViewStore } from "./store.js";
+import { viewerVersion } from "./version.js";
+
+const assets = new Map                          ([
+  ["/", ["index.html", "text/html; charset=utf-8"]],
+  ["/app.js", ["app.js", "text/javascript; charset=utf-8"]],
+  ["/data.js", ["data.js", "text/javascript; charset=utf-8"]],
+  ["/auth.js", ["auth.js", "text/javascript; charset=utf-8"]],
+  ["/styles.css", ["styles.css", "text/css; charset=utf-8"]],
+]);
+
+function json(response                , status        , value         ) {
+  response.writeHead(status, { "Content-Type": "application/json" });
+  response.end(JSON.stringify(value));
+}
+
+async function body(request                 )                   {
+  if (request.headers["content-type"]?.split(";")[0] !== "application/json") {
+    throw new InputError("Use Content-Type: application/json.", 415);
+  }
+  const parts           = [];
+  let size = 0;
+  for await (const part of request) {
+    const chunk          = part;
+    if (!(chunk instanceof Uint8Array)) {
+      throw new InputError("Invalid request body.");
+    }
+    const buffer = Buffer.from(chunk);
+    size += buffer.length;
+    if (size > 2_000_000) {
+      throw new InputError("Request exceeds the 2 MB prototype limit.", 413);
+    }
+    parts.push(buffer);
+  }
+  try {
+    return JSON.parse(Buffer.concat(parts).toString("utf-8"));
+  } catch {
+    throw new InputError("Invalid JSON.");
+  }
+}
+
+function verifyOrigin(
+  request                 ,
+  server                                 
+) {
+  const address = server.address();
+  const port = address && typeof address !== "string" ? address.port : 0;
+  const hosts = new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
+  const host = request.headers.host ?? "";
+  if (
+    !hosts.has(host) ||
+    (request.headers.origin && request.headers.origin !== `http://${host}`) ||
+    request.headers["sec-fetch-site"] === "cross-site"
+  ) {
+    throw new InputError(
+      "Only requests from this local viewer are allowed.",
+      403
+    );
+  }
+  return host;
+}
+
+export function createViewerServer(
+  openBrowser = openExternalBrowser,
+  store = new ViewStore(),
+  options                                            = {}
+) {
+  function matches(value         ) {
+    if (!options.token) {
+      return true;
+    }
+    return (
+      typeof value === "string" &&
+      Buffer.byteLength(value) === Buffer.byteLength(options.token) &&
+      timingSafeEqual(Buffer.from(value), Buffer.from(options.token))
+    );
+  }
+
+  function authorized(request                 , cookieName        ) {
+    const cookie = request.headers.cookie
+      ?.split(";")
+      .map((part) => part.trim())
+      .find((part) => part.startsWith(`${cookieName}=`))
+      ?.slice(cookieName.length + 1);
+    return (
+      matches(request.headers.authorization?.replace(/^Bearer /u, "")) ||
+      matches(cookie)
+    );
+  }
+  const listeners = new Map                             ();
+  const notify = (id        ) => {
+    for (const client of listeners.get(id) ?? []) {
+      client.write('data: {"changed":true}\n\n');
+    }
+  };
+
+  function subscribe(id        , response                ) {
+    store.get(id);
+    response.writeHead(200, {
+      Connection: "keep-alive",
+      "Content-Type": "text/event-stream",
+    });
+    const clients = listeners.get(id) ?? new Set                ();
+    clients.add(response);
+    listeners.set(id, clients);
+    response.write('data: {"connected":true}\n\n');
+    const heartbeat = setInterval(() => {
+      response.write(": heartbeat\n\n");
+    }, 20_000);
+    response.on("close", () => {
+      clearInterval(heartbeat);
+      clients.delete(response);
+      if (clients.size === 0) {
+        listeners.delete(id);
+      }
+    });
+  }
+
+  async function routeView(
+    request                 ,
+    response                ,
+    id        ,
+    section                    
+  ) {
+    const { method } = request;
+    if (section === "events" && method === "GET") {
+      subscribe(id, response);
+      return;
+    }
+    if (section === "state" && method === "GET") {
+      const view = store.get(id);
+      json(response, 200, {
+        ...view.state,
+        connectedBrowsers: listeners.get(id)?.size ?? 0,
+        recordCount: view.records.length,
+        revision: view.revision,
+      });
+      return;
+    }
+    if (section === "state" && method === "PUT") {
+      const view = store.select(id, await body(request));
+      notify(id);
+      json(response, 200, view.state);
+      return;
+    }
+    if (!section && method === "GET") {
+      json(response, 200, store.get(id));
+      return;
+    }
+    if (!section && method === "PATCH") {
+      const view = store.update(id, await body(request));
+      notify(id);
+      json(response, 200, {
+        ...view,
+        connectedBrowsers: listeners.get(id)?.size ?? 0,
+        delivery: "saved",
+      });
+      return;
+    }
+    if (!section && method === "DELETE") {
+      store.delete(id);
+      notify(id);
+      for (const client of listeners.get(id) ?? []) {
+        client.end();
+      }
+      json(response, 200, { deleted: true });
+      return;
+    }
+    throw new InputError("Method not allowed.", 405);
+  }
+  async function access(
+    request                 ,
+    response                ,
+    url     
+  ) {
+    const { method } = request;
+    const address = server.address();
+    const cookieName = `scoutmesh_${address && typeof address !== "string" ? address.port : 0}`;
+    if (url.pathname === "/api/session") {
+      if (method === "GET") {
+        json(response, 200, { authorized: authorized(request, cookieName) });
+        return true;
+      }
+      if (method === "POST") {
+        const input = await body(request);
+        if (
+          !input ||
+          typeof input !== "object" ||
+          !("token" in input) ||
+          !matches(input.token)
+        ) {
+          throw new InputError("Invalid local access token.", 401);
+        }
+        if (options.token) {
+          response.setHeader(
+            "Set-Cookie",
+            `${cookieName}=${options.token}; HttpOnly; SameSite=Strict; Path=/`
+          );
+        }
+        json(response, 200, { authorized: true });
+        return true;
+      }
+      throw new InputError("Method not allowed.", 405);
+    }
+    if (url.pathname.startsWith("/api/") && !authorized(request, cookieName)) {
+      throw new InputError(
+        "Unlock this viewer with its local access token.",
+        401
+      );
+    }
+    if (url.pathname === "/api/health" && method === "GET") {
+      json(response, 200, {
+        pid: process.pid,
+        service: "scoutmesh-viewer",
+        version: viewerVersion,
+      });
+      return true;
+    }
+    if (
+      url.pathname === "/api/shutdown" &&
+      method === "POST" &&
+      options.shutdown
+    ) {
+      if (!matches(request.headers.authorization?.replace(/^Bearer /u, ""))) {
+        throw new InputError("Shutdown requires the local CLI.", 401);
+      }
+      json(response, 200, { stopping: true });
+      setImmediate(options.shutdown);
+      return true;
+    }
+    return false;
+  }
+  async function route(request                 , response                ) {
+    response.setHeader("Cache-Control", "no-store");
+    response.setHeader("X-Content-Type-Options", "nosniff");
+    response.setHeader("Referrer-Policy", "no-referrer");
+    response.setHeader(
+      "Content-Security-Policy",
+      "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' https:; frame-ancestors 'none'; base-uri 'none'; form-action 'none'"
+    );
+    try {
+      const host = verifyOrigin(request, server);
+      const url = new URL(request.url ?? "/", `http://${host}`);
+      const { method } = request;
+      if (await access(request, response, url)) {
+        return;
+      }
+      if (url.pathname === "/api/open-external") {
+        if (method !== "POST") {
+          throw new InputError("Method not allowed.", 405);
+        }
+        const input = await body(request);
+        const destination = externalUrl(
+          input && typeof input === "object" && "url" in input
+            ? input.url
+            : undefined
+        );
+        await openBrowser(destination);
+        json(response, 200, { opened: true });
+        return;
+      }
+      const asset = assets.get(url.pathname);
+      if (method === "GET" && asset) {
+        const [file, contentType] = asset;
+        response.writeHead(200, { "Content-Type": contentType });
+        response.end(
+          await readFile(new URL(`public/${file}`, import.meta.url))
+        );
+        return;
+      }
+      if (url.pathname === "/api/views" && method === "GET") {
+        json(response, 200, store.list());
+        return;
+      }
+      if (url.pathname === "/api/views" && method === "POST") {
+        const view = store.create(await body(request));
+        json(response, 201, {
+          ...view,
+          url: `http://${host}/?view=${view.id}`,
+        });
+        return;
+      }
+      const match =
+        /^\/api\/views\/(?<id>[\w-]+)(?:\/(?<section>events|state))?$/u.exec(
+          url.pathname
+        );
+      if (!match?.groups?.id) {
+        throw new InputError("Route not found.", 404);
+      }
+      const { id, section } = match.groups;
+      await routeView(request, response, id, section);
+    } catch (error) {
+      const known = error instanceof InputError;
+      json(response, known ? error.status : 500, {
+        error: known ? error.message : "Local viewer request failed.",
+      });
+    }
+  }
+  const server = createServer((request, response) => {
+    void route(request, response);
+  });
+  server.on("close", () => {
+    for (const clients of listeners.values()) {
+      for (const client of clients) {
+        client.end();
+      }
+    }
+  });
+  return server;
+}
+
+if (process.argv[1] === import.meta.filename) {
+  const port = Number(process.env.VIEWER_PORT ?? 4317);
+  if (!Number.isInteger(port) || port < 1024 || port > 65_535) {
+    throw new Error("VIEWER_PORT must be an integer between 1024 and 65535.");
+  }
+  const server = createViewerServer(
+    openExternalBrowser,
+    new ViewStore(defaultStateFile)
+  );
+  server.on("error", (error) => {
+    console.error(`Cannot start local viewer: ${error.message}`);
+    process.exitCode = 1;
+  });
+  server.listen(port, "127.0.0.1", () => {
+    console.info(`Scout Mesh local viewer: http://127.0.0.1:${port}`);
+    console.info(
+      `State saved locally to ${defaultStateFile}. Restarting restores saved views.`
+    );
+  });
+}

package/dist/state-file.js

@@ -0,0 +1,48 @@
+import { randomUUID } from "node:crypto";
+import {
+  closeSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const defaultStateFile = process.env.VIEWER_STATE_FILE
+  ? path.resolve(process.env.VIEWER_STATE_FILE)
+  : fileURLToPath(new URL(".data/state.json", import.meta.url));
+
+export function readStateFile(file        )          {
+  try {
+    return JSON.parse(readFileSync(file, "utf-8"));
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return undefined;
+    }
+    throw new Error(
+      `Cannot load viewer state from ${file}. The file has not been changed.`,
+      { cause: error }
+    );
+  }
+}
+
+export function writeStateFile(file        , value         ) {
+  mkdirSync(path.dirname(file), { mode: 0o700, recursive: true });
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  try {
+    const descriptor = openSync(temporary, "wx", 0o600);
+    try {
+      writeFileSync(descriptor, `${JSON.stringify(value, null, 2)}\n`);
+      fsyncSync(descriptor);
+    } finally {
+      closeSync(descriptor);
+    }
+    renameSync(temporary, file);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+}