@stacksjs/ts-analytics 0.1.6

package/src/handlers/oauth.ts

@@ -0,0 +1,233 @@
+/**
+ * OAuth/SSO sign-in — Google + GitHub (#53).
+ *
+ * Standard authorization-code flow, linking to the existing USER# accounts by
+ * verified email (created on first login). Email/password stays primary.
+ *
+ * Configuration (per provider; the start endpoint 503s when unset):
+ *   GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET
+ *   GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET
+ * The provider app's callback URL must be
+ *   {APP_BASE_URL}/api/auth/oauth/{provider}/callback
+ *
+ * CSRF: each start mints a single-use state record (OAUTH#{state}, 10min TTL)
+ * that the callback consumes; a mismatched or replayed state is rejected.
+ */
+import { dynamodb, TABLE_NAME, marshall, unmarshall } from '../lib/dynamodb'
+import { jsonResponse, errorResponse } from '../utils/response'
+import { getUserByEmail, createOAuthUser, createSession, sessionCookie, updateUserFields } from './auth'
+import { acceptInvites } from '../lib/membership'
+import { appBaseUrl } from '../lib/email'
+
+export type OAuthProvider = 'google' | 'github'
+
+interface ProviderConfig {
+  authorizeUrl: string
+  tokenUrl: string
+  scope: string
+  clientId: string
+  clientSecret: string
+}
+
+/** Provider endpoints + credentials; null when the env credentials are unset. */
+export function providerConfig(provider: string): ProviderConfig | null {
+  if (provider === 'google') {
+    const clientId = process.env.GOOGLE_CLIENT_ID || ''
+    const clientSecret = process.env.GOOGLE_CLIENT_SECRET || ''
+    if (!clientId || !clientSecret)
+      return null
+    return {
+      authorizeUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+      tokenUrl: 'https://oauth2.googleapis.com/token',
+      scope: 'openid email profile',
+      clientId,
+      clientSecret,
+    }
+  }
+  if (provider === 'github') {
+    const clientId = process.env.GITHUB_CLIENT_ID || ''
+    const clientSecret = process.env.GITHUB_CLIENT_SECRET || ''
+    if (!clientId || !clientSecret)
+      return null
+    return {
+      authorizeUrl: 'https://github.com/login/oauth/authorize',
+      tokenUrl: 'https://github.com/login/oauth/access_token',
+      scope: 'read:user user:email',
+      clientId,
+      clientSecret,
+    }
+  }
+  return null
+}
+
+/** The authorize redirect URL. Pure — unit tested. */
+export function buildAuthorizeUrl(cfg: Pick<ProviderConfig, 'authorizeUrl' | 'clientId' | 'scope'>, redirectUri: string, state: string): string {
+  const params = new URLSearchParams({
+    client_id: cfg.clientId,
+    redirect_uri: redirectUri,
+    response_type: 'code',
+    scope: cfg.scope,
+    state,
+  })
+  return `${cfg.authorizeUrl}?${params}`
+}
+
+function redirectUriFor(provider: string): string {
+  return `${appBaseUrl()}/api/auth/oauth/${provider}/callback`
+}
+
+// ── Single-use CSRF state ───────────────────────────────────────────────────
+async function createState(provider: string): Promise<string> {
+  const state = crypto.randomUUID()
+  await dynamodb.putItem({
+    TableName: TABLE_NAME,
+    Item: marshall({
+      pk: `OAUTH#${state}`,
+      sk: `OAUTH#${state}`,
+      provider,
+      ttl: Math.floor(Date.now() / 1000) + 600,
+    }),
+  })
+  return state
+}
+
+async function consumeState(state: string): Promise<string | null> {
+  const key = { pk: { S: `OAUTH#${state}` }, sk: { S: `OAUTH#${state}` } }
+  const r = await dynamodb.getItem({ TableName: TABLE_NAME, Key: key })
+  if (!r.Item)
+    return null
+  await dynamodb.deleteItem({ TableName: TABLE_NAME, Key: key })
+  const item = unmarshall(r.Item)
+  if (item.ttl && item.ttl < Math.floor(Date.now() / 1000))
+    return null
+  return item.provider || null
+}
+
+// ── Handlers ────────────────────────────────────────────────────────────────
+
+/** GET /api/auth/oauth/{provider} — redirect to the provider's consent page. */
+export async function handleOAuthStart(_request: Request, provider: string): Promise<Response> {
+  const cfg = providerConfig(provider)
+  if (!cfg) {
+    return jsonResponse({ error: `${provider} sign-in is not configured on this server` }, 503)
+  }
+  const state = await createState(provider)
+  const url = buildAuthorizeUrl(cfg, redirectUriFor(provider), state)
+  return new Response(null, { status: 302, headers: { Location: url } })
+}
+
+interface OAuthProfile {
+  email: string
+  emailVerified: boolean
+  name: string
+  providerId: string
+}
+
+async function exchangeCode(cfg: ProviderConfig, provider: string, code: string): Promise<string | null> {
+  const res = await fetch(cfg.tokenUrl, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'Accept': 'application/json' },
+    body: new URLSearchParams({
+      client_id: cfg.clientId,
+      client_secret: cfg.clientSecret,
+      code,
+      grant_type: 'authorization_code',
+      redirect_uri: redirectUriFor(provider),
+    }),
+  })
+  if (!res.ok)
+    return null
+  const data = await res.json() as { access_token?: string }
+  return data.access_token || null
+}
+
+async function fetchProfile(provider: string, accessToken: string): Promise<OAuthProfile | null> {
+  const auth = { Authorization: `Bearer ${accessToken}` }
+  if (provider === 'google') {
+    const res = await fetch('https://openidconnect.googleapis.com/v1/userinfo', { headers: auth })
+    if (!res.ok)
+      return null
+    const p = await res.json() as { sub?: string, email?: string, email_verified?: boolean, name?: string }
+    if (!p.email)
+      return null
+    return { email: p.email, emailVerified: !!p.email_verified, name: p.name || '', providerId: String(p.sub || '') }
+  }
+  if (provider === 'github') {
+    const res = await fetch('https://api.github.com/user', { headers: { ...auth, 'User-Agent': 'ts-analytics' } })
+    if (!res.ok)
+      return null
+    const p = await res.json() as { id?: number, name?: string, login?: string, email?: string | null }
+    let email = p.email || ''
+    let verified = false
+    const emailsRes = await fetch('https://api.github.com/user/emails', { headers: { ...auth, 'User-Agent': 'ts-analytics' } })
+    if (emailsRes.ok) {
+      const emails = await emailsRes.json() as Array<{ email: string, primary: boolean, verified: boolean }>
+      const primary = emails.find(e => e.primary && e.verified) || emails.find(e => e.verified)
+      if (primary) {
+        email = primary.email
+        verified = true
+      }
+    }
+    if (!email)
+      return null
+    return { email, emailVerified: verified, name: p.name || p.login || '', providerId: String(p.id || '') }
+  }
+  return null
+}
+
+function loginRedirect(reason: string): Response {
+  return new Response(null, { status: 302, headers: { Location: `/login?error=${encodeURIComponent(reason)}` } })
+}
+
+/** GET /api/auth/oauth/{provider}/callback — exchange, link/create, sign in. */
+export async function handleOAuthCallback(request: Request, provider: string): Promise<Response> {
+  try {
+    const cfg = providerConfig(provider)
+    if (!cfg)
+      return jsonResponse({ error: `${provider} sign-in is not configured on this server` }, 503)
+
+    const url = new URL(request.url)
+    const code = url.searchParams.get('code') || ''
+    const state = url.searchParams.get('state') || ''
+    if (!code || !state)
+      return loginRedirect('oauth')
+
+    const stateProvider = await consumeState(state)
+    if (stateProvider !== provider)
+      return loginRedirect('oauth')
+
+    const accessToken = await exchangeCode(cfg, provider, code)
+    if (!accessToken)
+      return loginRedirect('oauth')
+
+    const profile = await fetchProfile(provider, accessToken)
+    if (!profile)
+      return loginRedirect('oauth')
+
+    // Only trust provider-verified emails to link to an existing account —
+    // otherwise an attacker could claim someone's address on the provider and
+    // take over their account here.
+    let user = await getUserByEmail(profile.email)
+    if (user && !profile.emailVerified)
+      return loginRedirect('oauth-unverified-email')
+
+    if (!user) {
+      const created = await createOAuthUser(profile.email, profile.name, profile.emailVerified)
+      await acceptInvites(created.userId, created.email)
+      user = { userId: created.userId, email: created.email }
+    }
+
+    // Record the provider link (idempotent) so the account shows how it signs in.
+    await updateUserFields(user.userId, { [`${provider}Id`]: profile.providerId, updatedAt: new Date().toISOString() })
+
+    const token = await createSession(user.userId, user.email)
+    return new Response(null, {
+      status: 302,
+      headers: { 'Location': '/dashboard', 'Set-Cookie': sessionCookie(token) },
+    })
+  }
+  catch (error) {
+    console.error('OAuth callback error:', error)
+    return errorResponse('OAuth sign-in failed')
+  }
+}

package/src/handlers/performance.ts

@@ -0,0 +1,388 @@
+/**
+ * Performance & Web Vitals handlers
+ */
+
+import { generateId } from '../index'
+import { dynamodb, TABLE_NAME, unmarshall, marshall } from '../lib/dynamodb'
+import { parseDateRange } from '../utils/date'
+import { jsonResponse, errorResponse } from '../utils/response'
+import { getQueryParams } from '../../deploy/lambda-adapter'
+
+/**
+ * GET /api/sites/{siteId}/vitals
+ */
+export async function handleGetVitals(request: Request, siteId: string): Promise<Response> {
+  try {
+    const query = getQueryParams(request)
+    const { startDate, endDate } = parseDateRange(query)
+
+    const result = await dynamodb.query({
+      TableName: TABLE_NAME,
+      KeyConditionExpression: 'pk = :pk AND sk BETWEEN :start AND :end',
+      ExpressionAttributeValues: {
+        ':pk': { S: `SITE#${siteId}` },
+        ':start': { S: `VITAL#${startDate.toISOString()}` },
+        ':end': { S: `VITAL#${endDate.toISOString()}` },
+      },
+    }) as { Items?: any[] }
+
+    const vitals = (result.Items || []).map(unmarshall)
+
+    // Aggregate vitals by metric
+    const metrics: Record<string, { values: number[]; paths: Record<string, number[]> }> = {
+      LCP: { values: [], paths: {} },
+      FID: { values: [], paths: {} },
+      CLS: { values: [], paths: {} },
+      FCP: { values: [], paths: {} },
+      TTFB: { values: [], paths: {} },
+      INP: { values: [], paths: {} },
+    }
+
+    for (const vital of vitals) {
+      const metric = vital.metric || vital.name
+      if (metrics[metric]) {
+        // CLS travels x1000 on the wire (the tracker rounds values to ints,
+        // which would floor raw CLS to 0) — normalize back to the real
+        // unitless value at read time so percentiles/ratings are correct (#133).
+        const value = metric === 'CLS' ? (vital.value || 0) / 1000 : vital.value
+        metrics[metric].values.push(value)
+        const path = vital.path || '/'
+        if (!metrics[metric].paths[path]) {
+          metrics[metric].paths[path] = []
+        }
+        metrics[metric].paths[path].push(value)
+      }
+    }
+
+    // Calculate percentiles
+    const calculatePercentile = (arr: number[], p: number) => {
+      if (arr.length === 0) return 0
+      const sorted = [...arr].sort((a, b) => a - b)
+      const idx = Math.ceil((p / 100) * sorted.length) - 1
+      return sorted[Math.max(0, idx)]
+    }
+
+    const getRating = (metric: string, value: number): 'good' | 'needs-improvement' | 'poor' => {
+      const thresholds: Record<string, [number, number]> = {
+        LCP: [2500, 4000],
+        FID: [100, 300],
+        CLS: [0.1, 0.25],
+        FCP: [1800, 3000],
+        TTFB: [800, 1800],
+        INP: [200, 500],
+      }
+      const [good, poor] = thresholds[metric] || [0, 0]
+      if (value <= good) return 'good'
+      if (value <= poor) return 'needs-improvement'
+      return 'poor'
+    }
+
+    // Shape matches the Vital contract the tab binds (metric/samples/
+    // good/needsImprovement/poor, src/types/analytics.ts) — the old
+    // {name,count,rating} response left every card rendering "0 samples".
+    const summary = Object.entries(metrics).map(([name, data]) => {
+      const samples = data.values.length
+      const buckets = { 'good': 0, 'needs-improvement': 0, 'poor': 0 }
+      for (const v of data.values) buckets[getRating(name, v)]++
+      const pct = (n: number): number => samples > 0 ? Math.round((n / samples) * 100) : 0
+      return {
+        metric: name,
+        name,
+        p50: calculatePercentile(data.values, 50),
+        p75: calculatePercentile(data.values, 75),
+        p95: calculatePercentile(data.values, 95),
+        samples,
+        count: samples,
+        good: pct(buckets.good),
+        needsImprovement: pct(buckets['needs-improvement']),
+        poor: pct(buckets.poor),
+        rating: getRating(name, calculatePercentile(data.values, 75)),
+      }
+    })
+
+    // Get worst performing pages
+    const worstPages: Array<{ path: string; metric: string; p75: number; rating: string }> = []
+    for (const [metric, data] of Object.entries(metrics)) {
+      for (const [path, values] of Object.entries(data.paths)) {
+        const p75 = calculatePercentile(values, 75)
+        const rating = getRating(metric, p75)
+        if (rating === 'poor' || rating === 'needs-improvement') {
+          worstPages.push({ path, metric, p75, rating })
+        }
+      }
+    }
+    worstPages.sort((a, b) => (b.rating === 'poor' ? 1 : 0) - (a.rating === 'poor' ? 1 : 0))
+
+    return jsonResponse({
+      vitals: summary,
+      worstPages: worstPages.slice(0, 10),
+      totalMeasurements: vitals.length,
+      dateRange: {
+        start: startDate.toISOString(),
+        end: endDate.toISOString(),
+      },
+    })
+  }
+catch (error) {
+    console.error('Get vitals error:', error)
+    return errorResponse('Failed to fetch vitals')
+  }
+}
+
+/**
+ * GET /api/sites/{siteId}/vitals-trends
+ */
+export async function handleGetVitalsTrends(request: Request, siteId: string): Promise<Response> {
+  try {
+    const query = getQueryParams(request)
+    const { startDate, endDate } = parseDateRange(query)
+    const metric = query.metric || 'LCP'
+
+    const result = await dynamodb.query({
+      TableName: TABLE_NAME,
+      KeyConditionExpression: 'pk = :pk AND sk BETWEEN :start AND :end',
+      ExpressionAttributeValues: {
+        ':pk': { S: `SITE#${siteId}` },
+        ':start': { S: `VITAL#${startDate.toISOString()}` },
+        ':end': { S: `VITAL#${endDate.toISOString()}` },
+      },
+    }) as { Items?: any[] }
+
+    const vitals = (result.Items || []).map(unmarshall)
+      .filter(v => (v.metric || v.name) === metric)
+
+    // Group by day
+    const dailyData: Record<string, number[]> = {}
+    for (const vital of vitals) {
+      const day = vital.timestamp.slice(0, 10)
+      if (!dailyData[day]) dailyData[day] = []
+      // CLS travels x1000 on the wire — normalize at read time (#133).
+      dailyData[day].push(metric === 'CLS' ? (vital.value || 0) / 1000 : vital.value)
+    }
+
+    const calculatePercentile = (arr: number[], p: number) => {
+      if (arr.length === 0) return 0
+      const sorted = [...arr].sort((a, b) => a - b)
+      const idx = Math.ceil((p / 100) * sorted.length) - 1
+      return sorted[Math.max(0, idx)]
+    }
+
+    const trends = Object.entries(dailyData)
+      .map(([date, values]) => ({
+        date,
+        p50: calculatePercentile(values, 50),
+        p75: calculatePercentile(values, 75),
+        p95: calculatePercentile(values, 95),
+        count: values.length,
+      }))
+      .sort((a, b) => a.date.localeCompare(b.date))
+
+    return jsonResponse({
+      metric,
+      trends,
+      dateRange: {
+        start: startDate.toISOString(),
+        end: endDate.toISOString(),
+      },
+    })
+  }
+catch (error) {
+    console.error('Get vitals trends error:', error)
+    return errorResponse('Failed to fetch vitals trends')
+  }
+}
+
+/**
+ * POST /api/sites/{siteId}/performance-budgets
+ */
+export async function handleCreatePerformanceBudget(request: Request, siteId: string): Promise<Response> {
+  try {
+    const body = await request.json() as Record<string, any>
+
+    if (!body.metric || body.threshold === undefined) {
+      return jsonResponse({ error: 'Missing required fields: metric, threshold' }, 400)
+    }
+
+    const validMetrics = ['LCP', 'FID', 'CLS', 'FCP', 'TTFB', 'INP']
+    if (!validMetrics.includes(body.metric)) {
+      return jsonResponse({ error: `Invalid metric. Must be one of: ${validMetrics.join(', ')}` }, 400)
+    }
+
+    const budgetId = generateId()
+    const budget = {
+      pk: `SITE#${siteId}`,
+      sk: `BUDGET#${budgetId}`,
+      id: budgetId,
+      siteId,
+      metric: body.metric,
+      threshold: body.threshold,
+      path: body.path || '*',
+      alertOnViolation: body.alertOnViolation ?? true,
+      createdAt: new Date().toISOString(),
+    }
+
+    await dynamodb.putItem({
+      TableName: TABLE_NAME,
+      Item: marshall(budget),
+    })
+
+    return jsonResponse({ budget }, 201)
+  }
+catch (error) {
+    console.error('Create performance budget error:', error)
+    return errorResponse('Failed to create performance budget')
+  }
+}
+
+/**
+ * GET /api/sites/{siteId}/performance-budgets
+ */
+export async function handleGetPerformanceBudgets(_request: Request, siteId: string): Promise<Response> {
+  try {
+    const result = await dynamodb.query({
+      TableName: TABLE_NAME,
+      KeyConditionExpression: 'pk = :pk AND begins_with(sk, :prefix)',
+      ExpressionAttributeValues: {
+        ':pk': { S: `SITE#${siteId}` },
+        ':prefix': { S: 'BUDGET#' },
+      },
+    }) as { Items?: any[] }
+
+    const budgets = (result.Items || []).map(unmarshall)
+
+    return jsonResponse({ budgets })
+  }
+catch (error) {
+    console.error('Get performance budgets error:', error)
+    return errorResponse('Failed to fetch performance budgets')
+  }
+}
+
+/**
+ * DELETE /api/sites/{siteId}/performance-budgets/{budgetId}
+ */
+export async function handleDeletePerformanceBudget(_request: Request, siteId: string, budgetId: string): Promise<Response> {
+  try {
+    await dynamodb.deleteItem({
+      TableName: TABLE_NAME,
+      Key: marshall({
+        pk: `SITE#${siteId}`,
+        sk: `BUDGET#${budgetId}`,
+      }),
+    })
+
+    return jsonResponse({ success: true })
+  }
+catch (error) {
+    console.error('Delete performance budget error:', error)
+    return errorResponse('Failed to delete performance budget')
+  }
+}
+
+/**
+ * GET /api/sites/{siteId}/performance-budgets/check
+ */
+export async function handleCheckPerformanceBudgets(request: Request, siteId: string): Promise<Response> {
+  try {
+    const query = getQueryParams(request)
+    const { startDate, endDate } = parseDateRange(query)
+
+    // Get budgets
+    const budgetsResult = await dynamodb.query({
+      TableName: TABLE_NAME,
+      KeyConditionExpression: 'pk = :pk AND begins_with(sk, :prefix)',
+      ExpressionAttributeValues: {
+        ':pk': { S: `SITE#${siteId}` },
+        ':prefix': { S: 'BUDGET#' },
+      },
+    }) as { Items?: any[] }
+
+    const budgets = (budgetsResult.Items || []).map(unmarshall)
+
+    if (budgets.length === 0) {
+      return jsonResponse({ budgets: [], violations: [] })
+    }
+
+    // Get vitals
+    const vitalsResult = await dynamodb.query({
+      TableName: TABLE_NAME,
+      KeyConditionExpression: 'pk = :pk AND sk BETWEEN :start AND :end',
+      ExpressionAttributeValues: {
+        ':pk': { S: `SITE#${siteId}` },
+        ':start': { S: `VITAL#${startDate.toISOString()}` },
+        ':end': { S: `VITAL#${endDate.toISOString()}` },
+      },
+    }) as { Items?: any[] }
+
+    const vitals = (vitalsResult.Items || []).map(unmarshall)
+
+    // Check each budget
+    const violations: Array<{
+      budgetId: string
+      metric: string
+      threshold: number
+      currentValue: number
+      currentP75: number
+      exceededBy: number
+      path: string
+      violationCount: number
+    }> = []
+
+    const calculatePercentile = (arr: number[], p: number) => {
+      if (arr.length === 0) return 0
+      const sorted = [...arr].sort((a, b) => a - b)
+      const idx = Math.ceil((p / 100) * sorted.length) - 1
+      return sorted[Math.max(0, idx)]
+    }
+
+    for (const budget of budgets) {
+      const relevantVitals = vitals.filter(v => {
+        const metric = v.metric || v.name
+        if (metric !== budget.metric) return false
+        if (budget.path && budget.path !== '*') {
+          return v.path === budget.path
+        }
+        return true
+      })
+
+      if (relevantVitals.length === 0) continue
+
+      // CLS travels x1000 on the wire — normalize before comparing against
+      // user-entered unitless thresholds like 0.1 (#133).
+      const values = relevantVitals.map(v => budget.metric === 'CLS' ? (v.value || 0) / 1000 : v.value)
+      const p75 = calculatePercentile(values, 75)
+      const violatingValues = values.filter(v => v > budget.threshold)
+
+      if (p75 > budget.threshold) {
+        violations.push({
+          budgetId: budget.id,
+          metric: budget.metric,
+          threshold: budget.threshold,
+          // currentValue/exceededBy are the BudgetViolation contract the tab
+          // renders; currentP75 kept for back-compat.
+          currentValue: p75,
+          currentP75: p75,
+          exceededBy: Number((p75 - budget.threshold).toFixed(3)),
+          path: budget.path || '*',
+          violationCount: violatingValues.length,
+        })
+      }
+    }
+
+    return jsonResponse({
+      budgets: budgets.map(b => ({
+        ...b,
+        hasViolation: violations.some(v => v.budgetId === b.id),
+      })),
+      violations,
+      dateRange: {
+        start: startDate.toISOString(),
+        end: endDate.toISOString(),
+      },
+    })
+  }
+catch (error) {
+    console.error('Check performance budgets error:', error)
+    return errorResponse('Failed to check performance budgets')
+  }
+}