@snagset/server 0.0.1

package/dist/routes/sessions.js

@@ -0,0 +1,349 @@
+import { Hono } from "hono";
+import { randomUUID, randomBytes, createHash } from "node:crypto";
+import { ID_PREFIX } from "../vendor/types/names.js";
+import { ProjectUnavailable } from "../projectCache.js";
+import { mintSession, verifySession, withinRefreshWindow } from "../session.js";
+function fail(c, status, code, message) {
+    return c.json({ error: { code, message, requestId: c.get("requestId") } }, status);
+}
+/** Every secret in this product: 32 bytes, unpadded base64url, 43 chars. The
+ *  hash is taken over the string that arrived on the wire, never a re-decode. */
+const sha256 = (s) => createHash("sha256").update(s, "utf8").digest();
+const mintSecret = () => randomBytes(32).toString("base64url");
+/** `prj_…`/`rev_…` — the row id is bare, the wire form is prefixed (§2.10). */
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function rowId(wire, prefix) {
+    if (typeof wire !== "string")
+        return null;
+    const bare = wire.startsWith(prefix) ? wire.slice(prefix.length) : wire;
+    return UUID.test(bare) ? bare.toLowerCase() : null;
+}
+/** §3.4's default: what an ordinary client link may do. */
+const CLIENT_PERMISSIONS = ["thread:create", "comment:create", "thread:resolve"];
+/**
+ * 05 §4.2's read-time downgrade. There is no jobs engine yet (05 §3.11 item
+ * 12, the reaper), so `write_mode = 'open'` past its `write_mode_downgrade_at`
+ * is evaluated HERE, on every session mint, rather than flipped by a
+ * background pass. When M2-31's `runDueJobs` lands it should ALSO persist the
+ * downgrade (`UPDATE projects SET write_mode = 'link-required', … WHERE …`) so
+ * this stays a fallback rather than the only enforcement — but a session
+ * request must never trust a `write_mode` column that could be 24 hours
+ * stale, which is why this function exists independently of that job.
+ */
+export function effectiveWriteMode(row, at) {
+    if (row.write_mode === "open" &&
+        row.write_mode_downgrade_at &&
+        row.write_mode_downgrade_at.getTime() <= at.getTime()) {
+        return "link-required";
+    }
+    return row.write_mode;
+}
+/**
+ * `perm` is computed ONCE, from the credential, here — §4.4's table.
+ *
+ * *"Nothing about visibility is ever taken from the request. Not a header, not
+ * a query parameter, not a field on the body, not the reviewer's own claim
+ * about themselves."* `thread:private` and `thread:assign` decide whether a
+ * session sees team-only threads, so the only route by which a widget session
+ * gets them is a review link whose stored `permissions` already contain them —
+ * the "team link" of §3.4.
+ */
+function permissionsFor(kind, link) {
+    if (kind === "guest")
+        return CLIENT_PERMISSIONS.filter((p) => p !== "thread:resolve");
+    if (kind === "link" && link) {
+        const stored = link.permissions.filter((p) => ["thread:create", "comment:create", "thread:resolve", "thread:delete:own", "thread:private", "thread:assign"].includes(p));
+        return stored.length ? stored : CLIENT_PERMISSIONS;
+    }
+    return CLIENT_PERMISSIONS;
+}
+export function sessionRoutes(deps) {
+    const app = new Hono();
+    const { sql, keys, projects, ttls } = deps;
+    const now = deps.now ?? (() => new Date());
+    app.post("/api/v1/projects/:uid/sessions", async (c) => {
+        const uid = c.req.param("uid");
+        let project;
+        try {
+            project = await projects.get(uid);
+        }
+        catch (e) {
+            // Fail closed. A stale cache entry is a stale session_epoch, and that
+            // means a revoked reviewer keeps working (projectCache.ts).
+            if (e instanceof ProjectUnavailable) {
+                c.header("Retry-After", "5");
+                return fail(c, 503, "database_unavailable", "The server cannot reach its database right now.");
+            }
+            throw e;
+        }
+        if (!project)
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        // §6.9's codes, not §4.5.1's blanket 401: a paused project is 403 and a
+        // disabled one 410 everywhere else in this API, and a client branches on
+        // the status class. "Your token is wrong" and "this project is switched
+        // off" are different problems with different next steps.
+        if (project.status === "paused") {
+            return fail(c, 403, "project_paused", "This project is paused. Its owner can resume it.");
+        }
+        if (project.status === "disabled" || project.status === "deleting") {
+            return fail(c, 410, "project_disabled", "This project is no longer accepting comments.");
+        }
+        // Computed once, up front, from the row the cache just gave us — see
+        // `effectiveWriteMode`'s own comment for why this can't wait for a reaper.
+        const writeMode = effectiveWriteMode(project, now());
+        const body = (await c.req.json().catch(() => null));
+        if (!body)
+            return fail(c, 400, "validation_failed", "A JSON body is required.");
+        // §4.4, and A31's shape of rule: a request that tries to grant itself
+        // visibility is refused rather than ignored, because silently dropping the
+        // field teaches the caller it worked.
+        for (const forbidden of ["role", "isTeam", "includePrivate", "permissions", "perm"]) {
+            if (forbidden in body || (body.identity && forbidden in body.identity)) {
+                return fail(c, 422, "field_not_permitted", `"${forbidden}" is not accepted here. What a session may see is decided by its credential, never by the request.`);
+            }
+        }
+        const bearer = /^Bearer (.+)$/i.exec(c.req.header("Authorization") ?? "")?.[1];
+        const identity = body.identity;
+        // ── REFRESH: a bearer and no identity (§4.4). Silent, and the whole reason
+        //    a reviewer is not asked to re-open their link four times an afternoon.
+        if (bearer && !identity) {
+            const v = await verifySession(keys, bearer, {
+                projectUid: uid,
+                expectedEpoch: project.session_epoch,
+                allowExpired: true,
+                absoluteTtlS: ttls.absoluteS,
+                now,
+            });
+            if (!v.ok) {
+                const code = v.reason === "session_revoked" ? "session_revoked" : "unauthorized";
+                return fail(c, 401, code, "That session is no longer valid. Re-open your review link to continue.");
+            }
+            // A link session re-checks the link on refresh (§4.4): revocation is
+            // instant at exchange AND on every refresh, which is what bounds how long
+            // a revoked link keeps working to one sliding window.
+            let linkExpiresAt;
+            if (v.claims.lnk) {
+                const [link] = await sql `
+          SELECT expires_at, revoked_at FROM review_links WHERE id = ${v.claims.lnk}
+        `;
+                if (!link || link.revoked_at || link.expires_at <= now()) {
+                    return fail(c, 401, "token_revoked", "This review link has been turned off.");
+                }
+                linkExpiresAt = Math.floor(link.expires_at.getTime() / 1000);
+            }
+            if (!withinRefreshWindow(v.claims, ttls, linkExpiresAt, now)) {
+                return fail(c, 401, "session_expired", "This review session has reached its limit. Re-open your review link.");
+            }
+            const [reviewer] = await sql `
+        SELECT identity_valid_after FROM reviewers WHERE id = ${v.claims.sub}
+      `;
+            if (reviewer?.identity_valid_after && v.claims.iat * 1000 < reviewer.identity_valid_after.getTime()) {
+                return fail(c, 401, "session_revoked", "This reviewer has been signed out.");
+            }
+            const minted = await mintSession(keys, {
+                projectUid: uid,
+                reviewerId: v.claims.sub,
+                environmentKey: v.claims.env,
+                kind: v.claims.kind,
+                reviewLinkId: v.claims.lnk,
+                permissions: v.claims.perm,
+                sessionEpoch: project.session_epoch,
+                // Carried forward — the cap does not slide (session.ts).
+                sid: v.claims.sid,
+                iat: v.claims.iat,
+                ...(v.claims.iex ? { iex: v.claims.iex } : {}),
+                ...(linkExpiresAt ? { linkExpiresAt } : {}),
+            }, ttls, now);
+            return c.json({
+                sessionToken: minted.token,
+                expiresAt: minted.expiresAt.toISOString(),
+                refreshableUntil: minted.refreshableUntil.toISOString(),
+                serverTime: now().toISOString(),
+            });
+        }
+        if (!identity || typeof identity.kind !== "string") {
+            return fail(c, 400, "validation_failed", "identity.kind is required (guest or link).");
+        }
+        if (identity.kind === "verified") {
+            // §4.6's HMAC handshake is M2-19. Saying so beats a 500.
+            return fail(c, 501, "not_implemented", "Verified identity is not available on this build yet.");
+        }
+        if (identity.kind !== "guest" && identity.kind !== "link") {
+            return fail(c, 400, "validation_failed", `Unknown identity kind "${identity.kind}".`);
+        }
+        // ── §4.2's write-mode gate. This is what closed the hole: a project past
+        //    `open`'s grace window (or minted `link-required`/`verified-only`)
+        //    used to mint a guest session anyway, because nothing here ever read
+        //    `write_mode`. `verified-only` is checked FIRST: neither a `guest`
+        //    identity (no credential at all) nor a `link` identity is ever
+        //    `verified`, so both must be refused before the guest/link check
+        //    below gets a chance to mislabel a verified-only rejection as
+        //    "get a link" (specs/05-api-data.md §6.9 registers the two codes
+        //    this way, and §4.2's table maps mode -> code the same way; a
+        //    guest-first ordering here made a verified-only project answer
+        //    guests with 403 link_required instead of verified_identity_required
+        //    — a link would not have helped them). Only once verified-only is
+        //    out of the way does a guest identity fall through to link_required
+        //    for anything short of `open`.
+        if (writeMode === "verified-only") {
+            return fail(c, 403, "verified_identity_required", "This project requires a verified identity to comment.");
+        }
+        if (identity.kind === "guest" && writeMode !== "open") {
+            return fail(c, 403, "link_required", "This project needs a review link to comment. Ask the studio for one.");
+        }
+        // ── The environment. Absent means the project's default (the widget only
+        //    knows a name if the host put one on the script tag).
+        const envKey = typeof body.environment === "string" && body.environment ? body.environment : null;
+        const [environment] = await sql `
+      SELECT id, key, label FROM environments
+      WHERE project_id = ${project.id} AND deleted_at IS NULL
+        AND ${envKey ? sql `key = ${envKey}` : sql `is_default`}
+      LIMIT 1
+    `;
+        if (!environment) {
+            return fail(c, 400, "environment_not_found", envKey ? `This project has no environment called "${envKey}".` : "This project has no default environment.");
+        }
+        // ── §4.5.1's validation table, IN ORDER.
+        let link = null;
+        if (identity.kind === "link") {
+            if (typeof identity.token !== "string" || !identity.token) {
+                return fail(c, 401, "token_invalid", "That review link is not valid.");
+            }
+            // Looked up BY HASH, so an unknown token and a wrong one take the same
+            // path — there is no row to compare against and therefore nothing to
+            // compare in variable time.
+            // T8: LEFT JOIN rounds so a round-pinned link can report the round
+            // NUMBER (what a reviewer and the widget both mean by "round"), not
+            // just its opaque id -- rounds.id never left the server before this.
+            const [found] = await sql `
+        SELECT rl.id, rl.round_id, rd.number AS round_number, rl.permissions, rl.environments,
+               rl.allow_name_override, rl.name, rl.email,
+               rl.max_uses, rl.use_count, rl.expires_at, rl.revoked_at
+        FROM review_links rl
+        LEFT JOIN rounds rd ON rd.id = rl.round_id
+        WHERE rl.project_id = ${project.id} AND rl.token_hash = ${sha256(identity.token)}
+      `;
+            if (!found)
+                return fail(c, 401, "token_invalid", "That review link is not valid.");
+            if (found.revoked_at)
+                return fail(c, 401, "token_revoked", "This review link has been turned off.");
+            if (found.expires_at <= now()) {
+                return fail(c, 401, "token_expired", "This review link has expired. Ask for a new one.");
+            }
+            if (!found.environments.includes("*") && !found.environments.includes(environment.key)) {
+                return fail(c, 401, "token_wrong_environment", "This review link is not for this environment.");
+            }
+            link = found;
+        }
+        const kind = identity.kind;
+        const permissions = permissionsFor(kind, link);
+        // ── The reviewer. §4.4.1: the SERVER mints the holder secret and returns
+        //    it once; later exchanges present it back.
+        const presented = typeof identity.holderSecret === "string" ? identity.holderSecret : null;
+        const presentedId = rowId(identity.holderId, ID_PREFIX.reviewer);
+        let holderSecret = null;
+        let reviewerId = null;
+        let reviewerName;
+        // `allow_name_override = false` ⇒ the link's own name is authoritative and
+        // a typed one is silently IGNORED, never a 422: the reviewer then sees the
+        // name they will be posting under rather than the one they asked for.
+        const typedName = typeof identity.name === "string" ? identity.name.trim().slice(0, 80) : "";
+        reviewerName = link && !link.allow_name_override ? link.name : typedName || link?.name || "Anonymous";
+        if (presented && presentedId) {
+            const [existing] = await sql `
+        SELECT id, name FROM reviewers
+        WHERE id = ${presentedId} AND project_id = ${project.id}
+          AND holder_secret_hash = ${sha256(presented)}
+          AND blocked_at IS NULL AND erased_at IS NULL
+      `;
+            // §4.4.1: "a mismatch does NOT error — it silently mints a new guest
+            // identity, because a stale storage entry must never lock a reviewer
+            // out." So this is an `if`, not a guard clause.
+            if (existing) {
+                reviewerId = existing.id;
+                if (typedName && (!link || link.allow_name_override)) {
+                    await sql `UPDATE reviewers SET name = ${reviewerName}, last_seen_at = now() WHERE id = ${reviewerId}`;
+                }
+                else {
+                    await sql `UPDATE reviewers SET last_seen_at = now() WHERE id = ${reviewerId}`;
+                }
+            }
+        }
+        if (!reviewerId) {
+            // §4.5.1's `max_uses` check happens HERE, not above, because it counts
+            // PEOPLE: a holder who already has a row is readmitted even on an
+            // exhausted link, and only a genuinely new person is refused.
+            if (link && link.max_uses !== null && link.use_count >= link.max_uses) {
+                return fail(c, 401, "token_exhausted", "This review link has reached its limit.");
+            }
+            holderSecret = mintSecret();
+            const id = randomUUID();
+            const inserted = await sql.begin(async (tx) => {
+                await tx `SELECT set_config('app.org_id', ${project.org_id}, true)`;
+                const rows = await tx `
+          INSERT INTO reviewers (id, org_id, project_id, kind, name, email, review_link_id, holder_secret_hash)
+          VALUES (${id}, ${project.org_id}, ${project.id}, ${kind}, ${reviewerName},
+                  ${link?.email ?? null}, ${link?.id ?? null}, ${sha256(holderSecret)})
+          ON CONFLICT (project_id, review_link_id, holder_secret_hash) WHERE kind = 'link'
+          DO NOTHING
+          RETURNING id
+        `;
+                // §4.5: use_count increments ONLY on a returned id — that is what makes
+                // it count people rather than exchanges. `last_used_at` rides along, so
+                // an exchange is one extra statement rather than two.
+                if (rows[0] && link) {
+                    await tx `
+            UPDATE review_links SET use_count = use_count + 1, last_used_at = now() WHERE id = ${link.id}
+          `;
+                }
+                else if (link) {
+                    await tx `UPDATE review_links SET last_used_at = now() WHERE id = ${link.id}`;
+                }
+                return rows[0]?.id ?? null;
+            });
+            reviewerId = inserted;
+            if (!reviewerId) {
+                // The conflict fired: this holder already has a row on this link.
+                const [again] = await sql `
+          SELECT id FROM reviewers
+          WHERE project_id = ${project.id} AND review_link_id = ${link?.id ?? null}
+            AND holder_secret_hash = ${sha256(holderSecret)} AND kind = 'link'
+        `;
+                reviewerId = again?.id ?? null;
+                holderSecret = null;
+            }
+            if (!reviewerId)
+                return fail(c, 500, "internal_error", "Could not create a reviewer.");
+        }
+        const linkExpiresAt = link ? Math.floor(link.expires_at.getTime() / 1000) : undefined;
+        const minted = await mintSession(keys, {
+            projectUid: uid,
+            reviewerId,
+            environmentKey: environment.key,
+            kind,
+            reviewLinkId: link?.id ?? null,
+            permissions,
+            sessionEpoch: project.session_epoch,
+            ...(linkExpiresAt ? { linkExpiresAt } : {}),
+        }, ttls, now);
+        return c.json({
+            sessionToken: minted.token,
+            expiresAt: minted.expiresAt.toISOString(),
+            refreshableUntil: minted.refreshableUntil.toISOString(),
+            reviewer: { id: ID_PREFIX.reviewer + reviewerId, name: reviewerName, kind },
+            // Returned ONCE, on first creation of this person (§4.4.1). Absent on
+            // every later exchange, which is how the client knows to keep the one
+            // it has.
+            ...(holderSecret ? { holderSecret } : {}),
+            environment,
+            permissions,
+            // T8: `number` alongside `id` -- the widget stores the NUMBER beside
+            // the bearer and passes `?round=<number>` on `GET …/threads`; the
+            // internal `rounds.id` is never a query param anywhere in 05.
+            ...(link?.round_id ? { round: { id: link.round_id, number: link.round_number } } : {}),
+            serverTime: now().toISOString(),
+        }, 201);
+    });
+    return app;
+}
+//# sourceMappingURL=sessions.js.map

package/dist/routes/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAgD,MAAM,eAAe,CAAC;AAsB9H,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;IACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,MAAa,CAAC,CAAC;AAC5F,CAAC;AAED;iFACiF;AACjF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACtF,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEvE,+EAA+E;AAC/E,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,SAAS,KAAK,CAAC,IAAa,EAAE,MAAc;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,2DAA2D;AAC3D,MAAM,kBAAkB,GAAiB,CAAC,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;AAE/F;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAiE,EACjE,EAAQ;IAER,IACE,GAAG,CAAC,UAAU,KAAK,MAAM;QACzB,GAAG,CAAC,uBAAuB;QAC3B,GAAG,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EACrD,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC,UAAwD,CAAC;AACtE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,IAAiB,EAAE,IAAsC;IAC/E,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;IACtF,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAC5D,CAAC,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC1H,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACrD,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAoBD,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE3C,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,OAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,sEAAsE;YACtE,4DAA4D;YAC5D,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;gBACpC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;gBAC7B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,iDAAiD,CAAC,CAAC;YACjG,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;QAEpF,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,yDAAyD;QACzD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,kDAAkD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,+CAA+C,CAAC,CAAC;QAC3F,CAAC;QAED,qEAAqE;QACrE,2EAA2E;QAC3E,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAErD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA+B,CAAC;QAClF,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,0BAA0B,CAAC,CAAC;QAEhF,sEAAsE;QACtE,2EAA2E;QAC3E,sCAAsC;QACtC,KAAK,MAAM,SAAS,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;YACpF,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvE,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,qBAAqB,EACrB,IAAI,SAAS,oGAAoG,CAClH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA2C,CAAC;QAElE,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE;gBAC1C,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,IAAI,CAAC,SAAS;gBAC5B,GAAG;aACJ,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC;gBACjF,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,wEAAwE,CAAC,CAAC;YACtG,CAAC;YAED,qEAAqE;YACrE,0EAA0E;YAC1E,sDAAsD;YACtD,IAAI,aAAiC,CAAC;YACtC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAiD;uEACV,CAAC,CAAC,MAAM,CAAC,GAAG;SAC1E,CAAC;gBACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,CAAC;oBACzD,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,uCAAuC,CAAC,CAAC;gBAChF,CAAC;gBACD,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7D,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,sEAAsE,CAAC,CAAC;YACjH,CAAC;YAED,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,GAAG,CAAyC;gEACX,CAAC,CAAC,MAAM,CAAC,GAAG;OACrE,CAAC;YACF,IAAI,QAAQ,EAAE,oBAAoB,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,QAAQ,CAAC,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpG,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;YAC/E,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,IAAI,EACJ;gBACE,UAAU,EAAE,GAAG;gBACf,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG;gBACxB,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG;gBAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;gBACnB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG;gBAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;gBAC1B,YAAY,EAAE,OAAO,CAAC,aAAa;gBACnC,yDAAyD;gBACzD,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG;gBACjB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG;gBACjB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,EACD,IAAI,EACJ,GAAG,CACJ,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,YAAY,EAAE,MAAM,CAAC,KAAK;gBAC1B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;gBACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE;gBACvD,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,4CAA4C,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjC,yDAAyD;YACzD,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,uDAAuD,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,0BAA0B,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;QACxF,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,qEAAqE;QACrE,kEAAkE;QAClE,qEAAqE;QACrE,kEAAkE;QAClE,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,4BAA4B,EAC5B,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YACtD,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,eAAe,EACf,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,0DAA0D;QAC1D,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAClG,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,GAAG,CAA8C;;2BAEtD,OAAO,CAAC,EAAE;cACvB,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA,YAAY;;KAExD,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,MAAM,CAAC,CAAC,CAAC,2CAA2C,MAAM,IAAI,CAAC,CAAC,CAAC,0CAA0C,CAC5G,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,IAAI,GAAmB,IAAI,CAAC;QAChC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC1D,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;YACzE,CAAC;YACD,uEAAuE;YACvE,qEAAqE;YACrE,4BAA4B;YAC5B,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,CAAW;;;;;;gCAMV,OAAO,CAAC,EAAE,wBAAwB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;OACjF,CAAC;YACF,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;YACnF,IAAI,KAAK,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,uCAAuC,CAAC,CAAC;YACpG,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,kDAAkD,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvF,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,yBAAyB,EAAE,+CAA+C,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAgB,QAAQ,CAAC,IAAI,CAAC;QACxC,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE/C,0EAA0E;QAC1E,+CAA+C;QAC/C,MAAM,SAAS,GAAG,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,YAAoB,CAAC;QAEzB,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,SAAS,GAAG,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,IAAI,IAAI,WAAW,CAAC;QAEtG,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,GAAG,CAAgC;;qBAE7C,WAAW,qBAAqB,OAAO,CAAC,EAAE;qCAC1B,MAAM,CAAC,SAAS,CAAC;;OAE/C,CAAC;YACF,qEAAqE;YACrE,qEAAqE;YACrE,gDAAgD;YAChD,IAAI,QAAQ,EAAE,CAAC;gBACb,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAC;gBACzB,IAAI,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;oBACrD,MAAM,GAAG,CAAA,+BAA+B,YAAY,qCAAqC,UAAU,EAAE,CAAC;gBACxG,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAA,wDAAwD,UAAU,EAAE,CAAC;gBAChF,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,uEAAuE;YACvE,kEAAkE;YAClE,8DAA8D;YAC9D,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;YACpF,CAAC;YAED,YAAY,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC5C,MAAM,EAAE,CAAA,mCAAmC,OAAO,CAAC,MAAM,SAAS,CAAC;gBACnE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;oBAE3B,EAAE,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,KAAK,IAAI,KAAK,YAAY;oBAC9D,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,IAAI,IAAI,KAAK,MAAM,CAAC,YAAa,CAAC;;;;SAI7E,CAAC;gBACF,wEAAwE;gBACxE,wEAAwE;gBACxE,sDAAsD;gBACtD,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;oBACpB,MAAM,EAAE,CAAA;iGAC+E,IAAI,CAAC,EAAE;WAC7F,CAAC;gBACJ,CAAC;qBAAM,IAAI,IAAI,EAAE,CAAC;oBAChB,MAAM,EAAE,CAAA,2DAA2D,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC/E,CAAC;gBACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,UAAU,GAAG,QAAQ,CAAC;YAEtB,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,kEAAkE;gBAClE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,CAAkB;;+BAEpB,OAAO,CAAC,EAAE,yBAAyB,IAAI,EAAE,EAAE,IAAI,IAAI;uCAC3C,MAAM,CAAC,YAAa,CAAC;SACnD,CAAC;gBACF,UAAU,GAAG,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC;gBAC/B,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,IAAI,EACJ;YACE,UAAU,EAAE,GAAG;YACf,UAAU;YACV,cAAc,EAAE,WAAW,CAAC,GAAG;YAC/B,IAAI;YACJ,YAAY,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YAC9B,WAAW;YACX,YAAY,EAAE,OAAO,CAAC,aAAa;YACnC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,EACD,IAAI,EACJ,GAAG,CACJ,CAAC;QAEF,OAAO,CAAC,CAAC,IAAI,CACX;YACE,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;YACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE;YACvD,QAAQ,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,QAAQ,GAAG,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;YAC3E,sEAAsE;YACtE,sEAAsE;YACtE,UAAU;YACV,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,WAAW;YACX,WAAW;YACX,qEAAqE;YACrE,kEAAkE;YAClE,8DAA8D;YAC9D,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;SAChC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/sites.js

@@ -0,0 +1,192 @@
+import { Hono } from "hono";
+import { createProject, validateOrigins } from "../projects.js";
+/**
+ * NO CACHE INVALIDATION HOOK, deliberately.
+ *
+ * The obvious next line here is "bust the project cache so the new site is live
+ * at once", and it would be dead code. A new project was never cached — the
+ * cache is a miss and loads it. And `cors.ts`'s origin cache is a self-expiring
+ * 10 s window whose own comment already made this call: *"a NEWLY allowed
+ * origin waits up to ten seconds to work, which reads as 'it took a moment'"*.
+ * A hook that fires and changes nothing is worse than none, because the next
+ * person reading it believes invalidation is handled.
+ */
+function fail(c, status, code, message) {
+    return c.json({ error: { code, message, requestId: c.get("requestId") } }, status);
+}
+export function siteRoutes(deps) {
+    const app = new Hono();
+    const { sql } = deps;
+    /**
+     * `POST /api/v1/projects` — add a site.
+     *
+     * Unscoped, because there is no project to scope it to yet; the ORG comes
+     * from the owner cookie and never from the body. A body-supplied `orgId`
+     * would be the whole authorisation model, handed to the caller.
+     */
+    app.post("/api/v1/projects", async (c) => {
+        const owner = c.get("owner");
+        if (!owner)
+            return fail(c, 401, "unauthorized", "Sign in to the dashboard first.");
+        const body = (await c.req.json().catch(() => null));
+        const name = typeof body?.["name"] === "string" ? body["name"].trim() : "";
+        if (!name)
+            return fail(c, 400, "validation_failed", "A site needs a name.");
+        if (name.length > 120) {
+            return fail(c, 400, "validation_failed", "That name is too long — 120 characters at most.");
+        }
+        // Accepts an array or the comma-separated string a text input produces, so
+        // the dashboard does not have to split it and the CLI does not have to
+        // build an array. One shape on the wire is not worth a parsing rule in two
+        // clients.
+        const raw = body?.["origins"];
+        const origins = Array.isArray(raw)
+            ? raw.map(String)
+            : typeof raw === "string"
+                ? raw.split(",")
+                : [];
+        try {
+            validateOrigins(origins);
+        }
+        catch (e) {
+            return fail(c, 400, "validation_failed", e instanceof Error ? e.message : String(e));
+        }
+        // A site with no allowed origin cannot be talked to by anything — CORS
+        // refuses every request from the tag the operator is about to paste. It is
+        // ALLOWED (an origin can be added later, and `snagset allow-origin`
+        // exists) but the response says so, because the alternative is a tag that
+        // is installed correctly and silently does nothing.
+        const created = await sql.begin(async (tx) => {
+            await tx `SELECT set_config('app.org_id', ${owner.orgId}, true)`;
+            return createProject(tx, {
+                orgId: owner.orgId,
+                name,
+                createdBy: owner.userId,
+                origins,
+                graceHours: deps.graceHours,
+            });
+        });
+        return c.json({
+            uid: created.uid,
+            name: created.name,
+            origins: validateOrigins(origins),
+            ...(origins.length
+                ? {}
+                : {
+                    warning: "No origins allowed yet, so no site can talk to this project. " +
+                        "Add one before pasting the tag.",
+                }),
+        }, 201);
+    });
+    /**
+     * `POST /api/v1/projects/:uid/origins` — allow another origin.
+     *
+     * Here rather than in a route file of its own because it is the other half
+     * of adding a site: you get it wrong, or you add staging first and
+     * production later, and the alternative is the CLI on a machine the person
+     * who noticed does not have.
+     */
+    app.post("/api/v1/projects/:uid/origins", async (c) => {
+        const owner = c.get("owner");
+        if (!owner)
+            return fail(c, 401, "unauthorized", "Sign in to the dashboard first.");
+        const [project] = await sql `
+      SELECT id, org_id FROM projects WHERE uid = ${c.req.param("uid")} AND deleted_at IS NULL
+    `;
+        // A project in another org is reported as absent, not as forbidden — the
+        // same rule the comment route follows, so a uid's validity leaks nothing
+        // about somebody else's org.
+        if (!project || project.org_id !== owner.orgId) {
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        }
+        const body = (await c.req.json().catch(() => null));
+        const raw = body?.["origin"] ?? body?.["origins"];
+        let origins;
+        try {
+            origins = validateOrigins(Array.isArray(raw) ? raw.map(String) : typeof raw === "string" ? raw.split(",") : []);
+        }
+        catch (e) {
+            return fail(c, 400, "validation_failed", e instanceof Error ? e.message : String(e));
+        }
+        if (!origins.length)
+            return fail(c, 400, "validation_failed", "An origin is required.");
+        await sql.begin(async (tx) => {
+            await tx `SELECT set_config('app.org_id', ${owner.orgId}, true)`;
+            for (const origin of origins) {
+                // Adding an origin that is already allowed is a no-op, not an error:
+                // the operator's intent is satisfied either way, and a 409 here would
+                // make "make sure staging is allowed" a two-step operation.
+                await tx `
+          INSERT INTO project_origins (id, org_id, project_id, pattern, is_wildcard)
+          VALUES (gen_random_uuid(), ${owner.orgId}, ${project.id}, ${origin}, ${origin.includes("*.")})
+          ON CONFLICT (project_id, pattern) DO NOTHING
+        `;
+            }
+        });
+        const all = await sql `
+      SELECT pattern FROM project_origins WHERE project_id = ${project.id} ORDER BY pattern
+    `;
+        return c.json({ origins: all.map((r) => r.pattern) }, 201);
+    });
+    /**
+     * `PATCH /api/v1/projects/:uid` — who sees the toolbar. D66.
+     *
+     * ONE knob, and it is the knob that already existed: `write_mode`. Who can
+     * WRITE is who the toolbar is for — showing a comment bar to somebody whose
+     * comments would be refused is a form the product fills in and then tears
+     * up. `open` = everyone on the allow-listed addresses sees it and may
+     * comment; `link-required` = only somebody who opened a review link (and,
+     * thereafter, whenever they come back).
+     *
+     * Choosing `open` here CLEARS the D1 grace timer. The 24-hour downgrade
+     * exists so a site somebody set up and forgot does not stay a public comment
+     * box; an owner choosing "everyone" in the dashboard is the opposite of
+     * forgetting, and having the toolbar silently vanish a day later would be
+     * this product's most mysterious bug report.
+     */
+    app.patch("/api/v1/projects/:uid", async (c) => {
+        const owner = c.get("owner");
+        if (!owner)
+            return fail(c, 401, "unauthorized", "Sign in to the dashboard first.");
+        const [project] = await sql `
+      SELECT id, org_id FROM projects WHERE uid = ${c.req.param("uid")} AND deleted_at IS NULL
+    `;
+        if (!project || project.org_id !== owner.orgId) {
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        }
+        const body = (await c.req.json().catch(() => null));
+        const mode = body?.["writeMode"];
+        if (mode !== "open" && mode !== "link-required" && mode !== "verified-only") {
+            return fail(c, 400, "validation_failed", "writeMode must be open, link-required or verified-only.");
+        }
+        await sql.begin(async (tx) => {
+            await tx `SELECT set_config('app.org_id', ${owner.orgId}, true)`;
+            await tx `
+        UPDATE projects
+           SET write_mode = ${mode}::snag_write_mode,
+               write_mode_downgrade_at = ${mode === "open" ? null : tx `write_mode_downgrade_at`},
+               config_version = config_version + 1
+         WHERE id = ${project.id}::uuid
+      `;
+        });
+        return c.json({ uid: c.req.param("uid"), writeMode: mode });
+    });
+    /** The origins on a site — what the dashboard shows beside the script tag. */
+    app.get("/api/v1/projects/:uid/origins", async (c) => {
+        const owner = c.get("owner");
+        if (!owner)
+            return fail(c, 401, "unauthorized", "Sign in to the dashboard first.");
+        const [project] = await sql `
+      SELECT id, org_id FROM projects WHERE uid = ${c.req.param("uid")} AND deleted_at IS NULL
+    `;
+        if (!project || project.org_id !== owner.orgId) {
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        }
+        const all = await sql `
+      SELECT pattern FROM project_origins WHERE project_id = ${project.id} ORDER BY pattern
+    `;
+        return c.json({ origins: all.map((r) => r.pattern) });
+    });
+    return app;
+}
+//# sourceMappingURL=sites.js.map

package/dist/routes/sites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sites.js","sourceRoot":"","sources":["../../src/routes/sites.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAwChE;;;;;;;;;;GAUG;AAEH,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;IACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,MAAa,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAErB;;;;;;OAMG;IACH,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;QAEnF,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACtF,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,iDAAiD,CAAC,CAAC;QAC9F,CAAC;QAED,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,WAAW;QACX,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YACjB,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ;gBACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;gBAChB,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,CAAC;YACH,eAAe,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QAED,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3C,MAAM,EAAE,CAAA,mCAAmC,KAAK,CAAC,KAAK,SAAS,CAAC;YAChE,OAAO,aAAa,CAAC,EAAE,EAAE;gBACvB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI;gBACJ,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,OAAO;gBACP,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CACX;YACE,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;YACjC,GAAG,CAAC,OAAO,CAAC,MAAM;gBAChB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,OAAO,EACL,+DAA+D;wBAC/D,iCAAiC;iBACpC,CAAC;SACP,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;QAEnF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,CAAkC;oDACb,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;KACjE,CAAC;QACF,yEAAyE;QACzE,yEAAyE;QACzE,6BAA6B;QAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACtF,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,eAAe,CACvB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;QAExF,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3B,MAAM,EAAE,CAAA,mCAAmC,KAAK,CAAC,KAAK,SAAS,CAAC;YAChE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,qEAAqE;gBACrE,sEAAsE;gBACtE,4DAA4D;gBAC5D,MAAM,EAAE,CAAA;;uCAEuB,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,EAAE,KAAK,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;;SAE7F,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAuB;+DACe,OAAO,CAAC,EAAE;KACpE,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;;;;OAeG;IACH,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;QACnF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,CAAkC;oDACb,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;KACjE,CAAC;QACF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACtF,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,yDAAyD,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3B,MAAM,EAAE,CAAA,mCAAmC,KAAK,CAAC,KAAK,SAAS,CAAC;YAChE,MAAM,EAAE,CAAA;;8BAEgB,IAAI;2CACS,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA,yBAAyB;;sBAEzE,OAAO,CAAC,EAAE;OACzB,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,GAAG,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;QACnF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,CAAkC;oDACb,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;KACjE,CAAC;QACF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAuB;+DACe,OAAO,CAAC,EAAE;KACpE,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}