@softr/sdk 0.0.11 → 0.0.13

package/dist/session-GUEI96C8.js

@@ -1,360 +0,0 @@
-import { getRequestHeader, getRequestProtocol, getResponseHeaders, setResponseHeader } from "@tanstack/react-start/server";
-import { z } from "zod";
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
-
-//#region src/assertions.ts
-function assert(condition, message) {
-	if (!condition) throwAtCaller(assert, new AssertionError(unwrapErrorMessage(message)));
-}
-/**
-* Shorthand for throw new AssertionError("Error message")
-* Useful because it is an expression instead of a statement.
-* Can be assigned to any value, because it never returns.
-*/
-function panic(message) {
-	throwAtCaller(panic, new AssertionError(unwrapErrorMessage(message)));
-}
-function todo(message) {
-	throwAtCaller(todo, new UnimplementedError(unwrapErrorMessage(message)));
-}
-/**
-* A soft assertion that throws an error in non prod environments, including
-* staging, but logs an error in production mode.
-* This is useful for cases where something unexpected happens, but you can still
-* continue in a slightly broken state.
-* For example, if a block has defined a style control with a hardcoded id and
-* that style control is not found, this is definitely a bug, but it's still
-* possible to go on rendering with a fallback value for this style.
-* It is recommended to liberally use soft assertions so that we fail loudly in
-* staging and local environments.
-*
-* A hard assertion would be more appropriate if we wanted to display some data
-* from an object but that object is null. It's better to throw an assertion
-* error at the place we detect this, instead of continuing and potentially
-* causing an exception in an unrelated part of the code.
-*/
-function softAssert(condition, message) {
-	if (!condition) if (process.env.NODE_ENV !== "production") throwAtCaller(softAssert, new SoftAssertionError(unwrapErrorMessage(message)));
-	else console.error(`Assertion failed: ${unwrapErrorMessage(message)}`);
-}
-var AssertionError = class extends Error {
-	name = "AssertionError";
-};
-var SoftAssertionError = class extends Error {
-	name = "SoftAssertionError";
-};
-var UnimplementedError = class extends Error {
-	name = "UnimplementedError";
-};
-function unwrapErrorMessage(message) {
-	return typeof message === "function" ? message() : message ?? "";
-}
-/**
-* Uses chrome's non-standard Error.captureStackTrace to set the top of the stack
-* trace to start from the caller of the supplied function {@param f}.
-* Useful in assertion functions to make sure that the stack trace shows the spot
-* where the assertion failed, not the place where the assertion was thrown.
-*/
-function throwAtCaller(f, ex) {
-	if (Error.captureStackTrace) Error.captureStackTrace(ex, f);
-	throw ex;
-}
-
-//#endregion
-//#region src/cookies.ts
-function parseCookieHeader(header) {
-	const cookies = {};
-	if (!header) return cookies;
-	for (const pair of header.split(";")) {
-		const separator = pair.indexOf("=");
-		if (separator === -1) continue;
-		const name = pair.slice(0, separator).trim();
-		if (name.length === 0) continue;
-		cookies[name] = decode(pair.slice(separator + 1).trim());
-	}
-	return cookies;
-}
-function decode(value) {
-	try {
-		return decodeURIComponent(value);
-	} catch {
-		return value;
-	}
-}
-function readRequestCookies() {
-	return parseCookieHeader(getRequestHeader("cookie"));
-}
-function serializeCookie(name, value, { maxAge, secure }) {
-	if (name.startsWith("__Host-") && !secure) throw new Error(`Refusing to write ${name} without Secure: a __Host- cookie is only valid when Secure, Path=/ and free of Domain, and a browser silently discards one that is not.`);
-	const parts = [
-		`${name}=${encodeURIComponent(value)}`,
-		"Path=/",
-		"HttpOnly"
-	];
-	if (secure) parts.push("Secure");
-	parts.push("SameSite=Lax", `Max-Age=${maxAge}`);
-	return parts.join("; ");
-}
-function writeCookies(cookies) {
-	if (cookies.length === 0) return;
-	setResponseHeader("Set-Cookie", [...getResponseHeaders().getSetCookie(), ...cookies]);
-}
-
-//#endregion
-//#region src/auth/config.ts
-const DEFAULT_SESSION_MAX_AGE = 2160 * 60 * 60;
-function loadSessionConfig() {
-	const missing = [];
-	const applicationId = process.env.SOFTR_APPLICATION_ID;
-	if (!applicationId) missing.push("SOFTR_APPLICATION_ID");
-	const sessionSecret = process.env.SOFTR_SESSION_SECRET;
-	if (!sessionSecret) missing.push("SOFTR_SESSION_SECRET");
-	if (missing.length > 0) throw new Error(`Softr auth is not configured: missing ${missing.join(", ")}.`);
-	assert(applicationId && sessionSecret);
-	const rawMaxAge = process.env.SOFTR_SESSION_MAX_AGE;
-	let sessionMaxAge = DEFAULT_SESSION_MAX_AGE;
-	if (rawMaxAge) {
-		sessionMaxAge = Number(rawMaxAge);
-		if (!Number.isInteger(sessionMaxAge) || sessionMaxAge <= 0) throw new Error(`SOFTR_SESSION_MAX_AGE must be a positive whole number of seconds, got "${rawMaxAge}".`);
-	}
-	return {
-		applicationId,
-		sessionSecret,
-		sessionMaxAge
-	};
-}
-let cached;
-function sessionConfig() {
-	cached ??= loadSessionConfig();
-	return cached;
-}
-
-//#endregion
-//#region src/auth/platform.ts
-const contextSchema = z.object({ platformApiUrl: z.string() });
-/** Calls one of this app's user endpoints on the Softr platform. */
-async function platformFetch(path, init) {
-	const { applicationId } = sessionConfig();
-	const origin = await platformApiUrl();
-	return fetch(`${origin}/v1/applications/${applicationId}/users/${path}`, init);
-}
-/** Origin of the Softr platform API, with no trailing slash. */
-async function platformApiUrl() {
-	const pinned = process.env.SOFTR_PLATFORM_API_URL;
-	if (pinned) return withoutTrailingSlash(pinned);
-	const studioApiUrl = process.env.SOFTR_STUDIO_API_URL;
-	if (!studioApiUrl || process.env.NODE_ENV === "production") panic("Softr auth is not configured: SOFTR_PLATFORM_API_URL is not set.");
-	const { applicationId } = sessionConfig();
-	const url = `${withoutTrailingSlash(studioApiUrl)}/v1/api/applications/${applicationId}/context/public`;
-	let response;
-	try {
-		response = await fetch(url, { headers: { accept: "application/json" } });
-	} catch {
-		panic(`Could not reach studio-api: ${url}`);
-	}
-	if (response.status === 404) panic(`studio-api does not know application ${applicationId}`);
-	if (!response.ok) panic(`studio-api answered ${response.status} for ${url}`);
-	const body = contextSchema.safeParse(await response.json().catch(() => null));
-	if (!body.success) panic(`studio-api returned no platformApiUrl: ${url}`);
-	return withoutTrailingSlash(body.data.platformApiUrl);
-}
-function withoutTrailingSlash(url) {
-	return url.replace(/\/+$/, "");
-}
-
-//#endregion
-//#region src/auth/me.ts
-/**
-* `null` means the platform refused the token — any 4xx, because `/me` answers
-* 400 rather than 401 for an expired one, so only the class of the status is
-* informative. Anything else that is not a 200 throws.
-*/
-async function fetchVisitor(token) {
-	const response = await platformFetch("me", {
-		method: "GET",
-		headers: {
-			authorization: `Bearer ${token}`,
-			accept: "application/json"
-		}
-	});
-	if (response.status >= 400 && response.status < 500) return null;
-	if (!response.ok) throw new Error(`Softr platform did not answer /me: ${response.status} ${response.statusText}`.trim());
-	return toUser(await response.json());
-}
-const meSchema = z.object({
-	id: z.string(),
-	full_name: z.string().nullish(),
-	credentials: z.object({ email: z.string().nullish() }).nullish()
-});
-function toUser(body) {
-	const me = meSchema.safeParse(body);
-	if (!me.success) throw new Error(`Softr platform answered /me with something that is not a user: ${z.prettifyError(me.error)}`);
-	return {
-		id: me.data.id,
-		email: me.data.credentials?.email ?? "",
-		name: me.data.full_name ?? "",
-		userGroupIds: []
-	};
-}
-
-//#endregion
-//#region src/auth/session.ts
-const SESSION_TOKEN = "session_token";
-const SESSION_DATA = "session_data";
-const SESSION_DATA_TTL_SECONDS = 300;
-/**
-* A browser refuses a `__Host-` cookie unless it is `Secure`, `Path=/` and free
-* of `Domain` — that last clause is the one worth having, since it stops a
-* sibling host planting a cookie of this name for us to honour.
-*/
-const HOST_PREFIX = "__Host-";
-function requestIsSecure() {
-	return getRequestProtocol() === "https";
-}
-function sessionCookie(base) {
-	const secure = requestIsSecure();
-	return {
-		name: secure ? HOST_PREFIX + base : base,
-		secure
-	};
-}
-/** The platform token this request carries, or `null`. */
-function readSessionToken() {
-	const { name } = sessionCookie(SESSION_TOKEN);
-	return openEnvelope(readRequestCookies()[name], SESSION_TOKEN);
-}
-/** The cached visitor for `sessionToken`, or `null` on any kind of miss. */
-function readSessionData(sessionToken) {
-	const { name } = sessionCookie(SESSION_DATA);
-	const payload = parseSessionData(openEnvelope(readRequestCookies()[name], SESSION_DATA));
-	if (payload === null) return null;
-	if (payload.exp <= Math.floor(Date.now() / 1e3)) return null;
-	if (payload.tb !== tokenBinding(sessionToken)) return null;
-	return {
-		id: payload.id,
-		email: payload.email,
-		name: payload.name,
-		userGroupIds: payload.userGroupIds
-	};
-}
-function makeSessionTokenCookie(token) {
-	const { name, secure } = sessionCookie(SESSION_TOKEN);
-	return serializeCookie(name, sealEnvelope(token, SESSION_TOKEN), {
-		maxAge: sessionConfig().sessionMaxAge,
-		secure
-	});
-}
-function makeSessionDataCookie(user, sessionToken) {
-	const { name, secure } = sessionCookie(SESSION_DATA);
-	const payload = {
-		id: user.id,
-		email: user.email,
-		name: user.name,
-		userGroupIds: user.userGroupIds,
-		exp: Math.floor(Date.now() / 1e3) + SESSION_DATA_TTL_SECONDS,
-		tb: tokenBinding(sessionToken)
-	};
-	return serializeCookie(name, sealEnvelope(JSON.stringify(payload), SESSION_DATA), {
-		maxAge: SESSION_DATA_TTL_SECONDS,
-		secure
-	});
-}
-/**
-* Writes rather than returns: a forgotten list would leave the session live.
-*/
-function clearSession() {
-	clearCookies([SESSION_TOKEN, SESSION_DATA]);
-}
-const sessionDataSchema = z.object({
-	id: z.string(),
-	email: z.string(),
-	name: z.string(),
-	userGroupIds: z.array(z.string()),
-	exp: z.number(),
-	tb: z.string()
-});
-/**
-* Both spellings on https: a jar can hold both pairs across a move between
-* schemes, and the one left behind would revive if the scheme changed back.
-*/
-function clearCookies(bases) {
-	const secure = requestIsSecure();
-	writeCookies(bases.flatMap((base) => secure ? [HOST_PREFIX + base, base] : [base]).map((name) => serializeCookie(name, "", {
-		maxAge: 0,
-		secure
-	})));
-}
-/**
-* Over the plaintext token, never the cookie value: that is resealed with a
-* fresh iv on every write, so a binding over its bytes would be a permanent
-* cache miss.
-*/
-function tokenBinding(sessionToken) {
-	return createHash("sha256").update(sessionToken).digest("base64url");
-}
-function parseSessionData(json) {
-	if (json === null) return null;
-	let payload;
-	try {
-		payload = JSON.parse(json);
-	} catch {
-		return null;
-	}
-	const data = sessionDataSchema.safeParse(payload);
-	return data.success ? data.data : null;
-}
-const IV_BYTES = 12;
-const TAG_BYTES = 16;
-/** Iv + one byte of ciphertext + tag. Anything shorter is not ours. */
-const MIN_ENVELOPE_BYTES = IV_BYTES + TAG_BYTES + 1;
-/**
-* `Buffer.from(…, "base64url")` skips stray characters rather than throwing.
-*/
-const BASE64URL = /^[A-Za-z0-9_-]+$/;
-/**
-* One key for both cookies. The application id goes in with the secret so a
-* cookie from staging is inert in production even when the two share a secret.
-*/
-function sessionKey() {
-	const { applicationId, sessionSecret } = sessionConfig();
-	return createHash("sha256").update(Buffer.from(sessionSecret, "hex")).update(applicationId).digest();
-}
-/**
-* `base64url(iv ‖ ct ‖ tag)`, sealed with AES-256-GCM — an AEAD, so opening
-* throws on a single flipped bit and needs no separate signature. The iv must
-* be fresh per seal: nonce reuse under one key leaks the payloads and the
-* authentication subkey.
-*
-* The purpose is bound in as additional authenticated data rather than by
-* giving each cookie a key of its own: one key, and a `session_data` value
-* moved into the token slot then fails to open at all instead of opening into
-* a later field check.
-*/
-function sealEnvelope(payload, purpose) {
-	const iv = randomBytes(IV_BYTES);
-	const cipher = createCipheriv("aes-256-gcm", sessionKey(), iv);
-	cipher.setAAD(Buffer.from(purpose));
-	const sealed = Buffer.concat([cipher.update(payload, "utf8"), cipher.final()]);
-	return Buffer.concat([
-		iv,
-		sealed,
-		cipher.getAuthTag()
-	]).toString("base64url");
-}
-/** `null` for anything that is not one of ours, with no reason attached. */
-function openEnvelope(raw, purpose) {
-	if (!raw || !BASE64URL.test(raw)) return null;
-	try {
-		const bytes = Buffer.from(raw, "base64url");
-		if (bytes.length < MIN_ENVELOPE_BYTES) return null;
-		const decipher = createDecipheriv("aes-256-gcm", sessionKey(), bytes.subarray(0, IV_BYTES));
-		decipher.setAAD(Buffer.from(purpose));
-		decipher.setAuthTag(bytes.subarray(bytes.length - TAG_BYTES));
-		return Buffer.concat([decipher.update(bytes.subarray(IV_BYTES, bytes.length - TAG_BYTES)), decipher.final()]).toString("utf8");
-	} catch {
-		return null;
-	}
-}
-
-//#endregion
-export { readSessionToken as a, writeCookies as c, softAssert as d, todo as f, readSessionData as i, assert as l, makeSessionDataCookie as n, fetchVisitor as o, makeSessionTokenCookie as r, platformFetch as s, clearSession as t, panic as u };