@softr/sdk 0.0.22-alpha.1 → 0.0.22-alpha.2

package/dist/preview-identity/preview-identity.js

@@ -0,0 +1,141 @@
+import { makeSessionClearingCookies, makeSessionTokenCookie, sessionTokenCookieName } from "../auth/session.js";
+
+//#region src/preview-identity/preview-identity.ts
+const PREVIEW_REDEMPTION_PATH = "/__preview/identity";
+const PREVIEW_SIGNED_IN_PATH = "/__preview/signed-in";
+/**
+* Signs the preview in as one of the app's own users by spending the one-time grant studio-api put
+* in this URL. No cookie of its own is forwarded: the grant is the only credential, and studio-api
+* authorized the builder before it issued one.
+*/
+const redeemGrant = async (req, res) => {
+	res.setHeader("Cache-Control", "no-store");
+	res.setHeader("Referrer-Policy", "no-referrer");
+	if (req.method !== "GET") {
+		sendJson(res, 405, { error: `${PREVIEW_REDEMPTION_PATH} only supports GET` });
+		return;
+	}
+	const grant = searchParamsOf(req).get("grant");
+	if (!grant) {
+		sendJson(res, 400, { error: "no grant" });
+		return;
+	}
+	const landing = landingPath(searchParamsOf(req).get("next"));
+	let session;
+	try {
+		session = await redeemPreviewGrant(req, grant);
+	} catch (error) {
+		sendJson(res, statusOf(error), { error: messageOf(error) });
+		return;
+	}
+	const secure = requestIsHttps(req);
+	res.statusCode = 302;
+	res.setHeader("Location", landing);
+	res.setHeader("Set-Cookie", session.anonymous ? makeSessionClearingCookies(secure) : makeSessionTokenCookie(session.jwt, secure));
+	res.end();
+};
+/**
+* Whether the preview currently holds a session, and nothing else.
+*
+* Presence only, never decoded: whether anyone is signed in is all Studio's picker needs, and
+* decoding would put an app user's identity on a route the studio bundle can read. Asked under the
+* one name this scheme's app would read, so a cookie the app ignores reads as signed out here too
+* rather than as a session it cannot see.
+*/
+const reportSignedIn = (req, res) => {
+	res.setHeader("Cache-Control", "no-store");
+	if (req.method !== "GET") {
+		sendJson(res, 405, { error: `${PREVIEW_SIGNED_IN_PATH} only supports GET` });
+		return;
+	}
+	sendJson(res, 200, { signedIn: hasSessionCookie(req.headers.cookie, sessionTokenCookieName(requestIsHttps(req))) });
+};
+var RedemptionError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+function statusOf(error) {
+	return error instanceof RedemptionError ? error.status : 503;
+}
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+async function redeemPreviewGrant(req, grant) {
+	const applicationId = process.env.SOFTR_APPLICATION_ID;
+	const studioApiUrl = process.env.SOFTR_STUDIO_API_URL?.trim() || studioApiUrlFor(req);
+	if (!applicationId || !studioApiUrl) throw new RedemptionError(503, "studio-api is unavailable");
+	let response;
+	try {
+		response = await fetch(`${studioApiUrl}/v1/applications/${encodeURIComponent(applicationId)}/vibe-coding/preview-identity/redeem`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ grant })
+		});
+	} catch {
+		throw new RedemptionError(503, "studio-api is unreachable");
+	}
+	if (!response.ok) throw new RedemptionError(response.status, "studio-api refused the preview identity grant");
+	const body = await response.json().catch(() => null);
+	if (typeof body !== "object" || body === null) throw new RedemptionError(503, "studio-api returned no session");
+	const { anonymous, jwt } = body;
+	if (anonymous === true) return { anonymous: true };
+	if (typeof jwt !== "string" || jwt.length === 0) throw new RedemptionError(503, "studio-api returned no token");
+	return {
+		anonymous: false,
+		jwt
+	};
+}
+const STAGING_HOST_PATTERN = /(?:^|\.)staging(\d+)\.softr\.io$/;
+/**
+* The studio-api base URL of the environment this dev server runs in, read off the request's host.
+*
+* The host is the only per-environment signal the app has: it is served at
+* `<slug>-app.vibe-coding-preview.staging12.softr.io`, and staging 12's API is
+* `studio-api-staging12.softr.io`. Every other host gives `null` — localhost included.
+*/
+function studioApiUrlFor(req) {
+	const forwarded = req.headers["x-forwarded-host"];
+	const name = ((Array.isArray(forwarded) ? forwarded[0] : forwarded) ?? req.headers.host ?? "").split(",")[0].trim().split(":")[0];
+	const digits = STAGING_HOST_PATTERN.exec(name)?.[1];
+	if (!digits) return null;
+	return `https://studio-api-staging${digits.padStart(2, "0")}.softr.io`;
+}
+function hasSessionCookie(header, name) {
+	if (!header) return false;
+	return header.split(";").some((pair) => {
+		const separator = pair.indexOf("=");
+		return separator !== -1 && pair.slice(0, separator).trim() === name;
+	});
+}
+/**
+* Whether this request is https, by the same rule the session code reads the cookie back with.
+*
+* h3's `getRequestProtocol` compares `x-forwarded-proto` for exact equality, so it reads anything
+* else — `https, http` from a two-hop chain, or `HTTPS` — as not-https. Being more generous here
+* than it is writes `__Host-session_token` where the app then looks up `session_token`, and the
+* visitor is silently anonymous with no error on either side.
+*/
+function requestIsHttps(req) {
+	const forwarded = req.headers["x-forwarded-proto"];
+	if (forwarded === "https") return true;
+	if (forwarded === "http") return false;
+	return Boolean(req.socket?.encrypted);
+}
+function landingPath(next) {
+	if (!next || !next.startsWith("/") || next.startsWith("//") || next.includes("\\") || next.includes("://") || /[\u0000-\u001f\u007f]/.test(next)) return "/";
+	return next;
+}
+function searchParamsOf(req) {
+	return new URL(req.url ?? "", "http://request.invalid").searchParams;
+}
+function sendJson(res, status, body) {
+	res.statusCode = status;
+	res.setHeader("Content-Type", "application/json");
+	res.end(JSON.stringify(body));
+}
+
+//#endregion
+export { PREVIEW_REDEMPTION_PATH, PREVIEW_SIGNED_IN_PATH, redeemGrant, reportSignedIn };

package/dist/vite.js

@@ -31,7 +31,34 @@ async function generateManifest(root) {
 * edit engine when the pod supplies one.
 */
 function softr() {
-	return [routesManifest(), editEngine()];
+	return [
+		routesManifest(),
+		previewIdentity(),
+		editEngine()
+	];
+}
+/**
+* The routes that sign the preview in as one of the app's own users, and report whether it is.
+*
+* They live in this package, not in the edit engine, because signing the preview in means writing
+* the very cookie this app's own session code reads back — one implementation of the cookie format,
+* with no version to keep in step across a package seam.
+*
+* `SOFTR_APPLICATION_ID` is the gate: the pod sets it, and it is what binds a redemption to the
+* application the grant was issued for. An app running on a developer's machine has none, and
+* serves neither route.
+*/
+async function previewIdentity() {
+	if (!process.env.SOFTR_APPLICATION_ID) return false;
+	const { PREVIEW_REDEMPTION_PATH, PREVIEW_SIGNED_IN_PATH, redeemGrant, reportSignedIn } = await import("./preview-identity/preview-identity.js");
+	return {
+		name: "softr-preview-identity",
+		apply: "serve",
+		configureServer(server) {
+			server.middlewares.use(PREVIEW_REDEMPTION_PATH, redeemGrant);
+			server.middlewares.use(PREVIEW_SIGNED_IN_PATH, reportSignedIn);
+		}
+	};
 }
 /** Plugin order does not matter: this puts nothing into the module graph. */
 function routesManifest() {
@@ -61,21 +88,12 @@ async function editEngine() {
 	if (!dir) return false;
 	const entry = pathToFileURL(path.join(dir, "dist", "vite.js")).href;
 	try {
-		return (await import(entry)).editEngineStudio({ sessionCookies: await sessionCookies() });
+		return (await import(entry)).editEngineStudio();
 	} catch (error) {
 		console.error(`[softr] could not load the edit engine from ${entry}:`, error);
 		return false;
 	}
 }
-/** Imported only for a preview, so an ordinary build never loads the session machinery at all. */
-async function sessionCookies() {
-	const { makeSessionTokenCookie, makeSessionClearingCookies, sessionTokenCookieName } = await import("./auth/session.js");
-	return {
-		makeSessionTokenCookie,
-		makeSessionClearingCookies,
-		sessionTokenCookieName
-	};
-}
 
 //#endregion
 export { MANIFEST_RELATIVE_PATH, generateManifest, softr };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.22-alpha.1",
+  "version": "0.0.22-alpha.2",
   "type": "module",
   "exports": {
     ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },

package/skills/softr-sdk/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 metadata:
   type: core
   library: softr-sdk
-  library_version: 0.0.22-alpha.1
+  library_version: 0.0.22-alpha.2
 ---
 
 # Softr SDK core

package/skills/softr-sdk/auth/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.22-alpha.1
+  library_version: 0.0.22-alpha.2
 ---
 
 This skill builds on softr-sdk. Read it first for the entrypoints and the client/server boundary.

package/skills/softr-sdk/current-user/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.22-alpha.1
+  library_version: 0.0.22-alpha.2
 ---
 
 This skill builds on softr-sdk. Read it first for the entrypoints and the wiring that puts a visitor on route context.

package/skills/softr-sdk/data-mutations/SKILL.md

@@ -8,7 +8,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.22-alpha.1
+  library_version: 0.0.22-alpha.2
 ---
 
 This skill builds on softr-sdk. Read it first for the entrypoints and the client/server boundary.

package/skills/softr-sdk/reading-records/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.22-alpha.1
+  library_version: 0.0.22-alpha.2
 ---
 
 This skill builds on softr-sdk. Read it first for the entrypoints and the client/server boundary.

package/skills/softr-sdk/routes-and-visibility/SKILL.md

@@ -12,7 +12,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.22-alpha.1
+  library_version: 0.0.22-alpha.2
 ---
 
 This skill builds on softr-sdk. Read it first for the entrypoints and the wiring that puts a visitor on route context.