@taskforcehq/taskforce 0.3.168

package/dist/server/cors.test.js

@@ -0,0 +1,71 @@
+import { describe, it, expect } from 'vitest';
+import { applyCorsHeaders, getAllowedOriginsFromEnv, resolveAllowedOrigin } from './cors';
+function mockReq(origin) {
+    return {
+        headers: origin ? { origin } : {}
+    };
+}
+function mockRes() {
+    const store = {};
+    return {
+        setHeader: (name, value) => {
+            store[name] = value;
+            return undefined;
+        },
+        getHeader: (name) => store[name]
+    };
+}
+describe('server cors helpers', () => {
+    it('parses allowed origins from env', () => {
+        const set = getAllowedOriginsFromEnv('https://a.test, https://b.test');
+        expect(set.has('https://a.test')).toBe(true);
+        expect(set.has('https://b.test')).toBe(true);
+    });
+    it('resolves allowed origin only when listed', () => {
+        const allowed = new Set(['https://taskforcehq.ai']);
+        expect(resolveAllowedOrigin('https://taskforcehq.ai', allowed)).toBe('https://taskforcehq.ai');
+        expect(resolveAllowedOrigin('https://evil.test', allowed)).toBeNull();
+    });
+    it('resolves localhost loopback origins when loopback token is present', () => {
+        const allowed = new Set(['__loopback__']);
+        expect(resolveAllowedOrigin('http://localhost:3000', allowed)).toBe('http://localhost:3000');
+        expect(resolveAllowedOrigin('https://127.0.0.1:4444', allowed)).toBe('https://127.0.0.1:4444');
+        expect(resolveAllowedOrigin('https://evil.test', allowed)).toBeNull();
+    });
+    it('resolves null origin when null token is present', () => {
+        const allowed = new Set(['__null__']);
+        expect(resolveAllowedOrigin('null', allowed)).toBe('null');
+        expect(resolveAllowedOrigin('https://evil.test', allowed)).toBeNull();
+    });
+    it('supports wildcard origin prefixes from env', () => {
+        const allowed = new Set(['https://preview.taskforcehq.ai:*']);
+        expect(resolveAllowedOrigin('https://preview.taskforcehq.ai:8787', allowed)).toBe('https://preview.taskforcehq.ai:8787');
+        expect(resolveAllowedOrigin('https://preview.taskforcehq.ai', allowed)).toBeNull();
+    });
+    it('allows non-CORS request without origin header', () => {
+        const allowed = new Set(['https://taskforcehq.ai']);
+        const req = mockReq();
+        const res = mockRes();
+        const result = applyCorsHeaders(req, res, allowed);
+        expect(result.allowed).toBe(true);
+        expect(res.getHeader('Access-Control-Allow-Origin')).toBeUndefined();
+        expect(res.getHeader('Vary')).toBe('Origin');
+    });
+    it('allows request with approved origin and sets allow-origin header', () => {
+        const allowed = new Set(['https://taskforcehq.ai']);
+        const req = mockReq('https://taskforcehq.ai');
+        const res = mockRes();
+        const result = applyCorsHeaders(req, res, allowed);
+        expect(result.allowed).toBe(true);
+        expect(res.getHeader('Access-Control-Allow-Origin')).toBe('https://taskforcehq.ai');
+        expect(res.getHeader('Access-Control-Allow-Credentials')).toBe('true');
+    });
+    it('rejects disallowed origin', () => {
+        const allowed = new Set(['https://taskforcehq.ai']);
+        const req = mockReq('https://evil.test');
+        const res = mockRes();
+        const result = applyCorsHeaders(req, res, allowed);
+        expect(result.allowed).toBe(false);
+        expect(res.getHeader('Access-Control-Allow-Origin')).toBeUndefined();
+    });
+});

package/dist/server/email.d.ts

@@ -0,0 +1,28 @@
+export type TaskforceEmailProvider = 'console' | 'resend' | 'google-workspace';
+export interface TaskforceEmailConfig {
+    provider: TaskforceEmailProvider;
+    from: string;
+    replyTo?: string;
+    providerApiKey?: string;
+}
+export interface TaskforceEmailSettingsInput {
+    provider?: string;
+    from?: string;
+    replyTo?: string;
+    providerApiKey?: string;
+}
+export interface SendEmailInput {
+    to: string;
+    subject: string;
+    text: string;
+    html?: string;
+}
+export interface SendEmailResult {
+    ok: boolean;
+    provider: TaskforceEmailProvider;
+    messageId?: string;
+    error?: string;
+}
+export declare function resolveEmailConfig(env?: NodeJS.ProcessEnv): TaskforceEmailConfig;
+export declare function resolveEffectiveEmailConfig(env?: NodeJS.ProcessEnv, settings?: TaskforceEmailSettingsInput | null): TaskforceEmailConfig;
+export declare function sendEmail(input: SendEmailInput, config: TaskforceEmailConfig): Promise<SendEmailResult>;

package/dist/server/email.js

@@ -0,0 +1,138 @@
+import { createSmtpTransport } from './smtpTransport.js';
+const RESEND_MAX_ATTEMPTS = 3;
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isResendRetryableStatus(status) {
+    return status === 429 || (status >= 500 && status <= 599);
+}
+export function resolveEmailConfig(env = process.env) {
+    const rawProvider = String(env.TASKFORCE_EMAIL_PROVIDER || 'console').trim().toLowerCase();
+    const provider = rawProvider === 'resend'
+        ? 'resend'
+        : rawProvider === 'google-workspace'
+            ? 'google-workspace'
+            : 'console';
+    const from = String(env.TASKFORCE_EMAIL_FROM || 'Taskforce <no-reply@taskforcehq.ai>').trim();
+    const replyTo = String(env.TASKFORCE_EMAIL_REPLY_TO || '').trim() || undefined;
+    const providerApiKey = String(env.TASKFORCE_EMAIL_PROVIDER_API_KEY
+        || (provider === 'resend' ? env.TASKFORCE_EMAIL_RESEND_API_KEY : '')
+        || (provider === 'google-workspace' ? env.TASKFORCE_EMAIL_GOOGLE_APP_PASSWORD : '')
+        || '').trim() || undefined;
+    return { provider, from, replyTo, providerApiKey };
+}
+export function resolveEffectiveEmailConfig(env = process.env, settings) {
+    const base = resolveEmailConfig(env);
+    const provider = settings?.provider === 'resend'
+        || settings?.provider === 'console'
+        || settings?.provider === 'google-workspace'
+        ? settings.provider
+        : base.provider;
+    const from = typeof settings?.from === 'string' && settings.from.trim().length > 0
+        ? settings.from.trim()
+        : base.from;
+    const replyTo = typeof settings?.replyTo === 'string'
+        ? (settings.replyTo.trim() || undefined)
+        : base.replyTo;
+    const providerApiKey = typeof settings?.providerApiKey === 'string' && settings.providerApiKey.trim().length > 0
+        ? settings.providerApiKey.trim()
+        : base.providerApiKey;
+    return {
+        provider,
+        from,
+        replyTo,
+        providerApiKey
+    };
+}
+async function sendWithResend(input, config) {
+    if (!config.providerApiKey) {
+        return { ok: false, provider: 'resend', error: 'Missing provider API key. Set it in Admin > Settings > Email.' };
+    }
+    for (let attempt = 1; attempt <= RESEND_MAX_ATTEMPTS; attempt += 1) {
+        try {
+            const response = await fetch('https://api.resend.com/emails', {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${config.providerApiKey}`,
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({
+                    from: config.from,
+                    to: [input.to],
+                    reply_to: config.replyTo,
+                    subject: input.subject,
+                    text: input.text,
+                    html: input.html || `<p>${input.text.replace(/\n/g, '<br/>')}</p>`
+                })
+            });
+            const payload = await response.json().catch(() => ({}));
+            if (response.ok) {
+                return { ok: true, provider: 'resend', messageId: String(payload?.id || '') || undefined };
+            }
+            const error = String(payload?.message || `Resend request failed with ${response.status}`);
+            if (!isResendRetryableStatus(response.status) || attempt >= RESEND_MAX_ATTEMPTS) {
+                return { ok: false, provider: 'resend', error };
+            }
+        }
+        catch (error) {
+            if (attempt >= RESEND_MAX_ATTEMPTS) {
+                return { ok: false, provider: 'resend', error: String(error?.message || 'Resend request failed') };
+            }
+        }
+        const delayMs = attempt * 200;
+        await sleep(delayMs);
+    }
+    return { ok: false, provider: 'resend', error: 'Resend request failed after retries.' };
+}
+function extractEmailAddress(fromValue) {
+    const from = fromValue.trim();
+    const bracketMatch = from.match(/<([^>]+)>/);
+    if (bracketMatch && bracketMatch[1])
+        return bracketMatch[1].trim();
+    return from;
+}
+async function sendWithGoogleWorkspace(input, config) {
+    if (!config.providerApiKey) {
+        return { ok: false, provider: 'google-workspace', error: 'Missing Google app password. Set it in Admin > Settings > Email.' };
+    }
+    const smtpUser = extractEmailAddress(config.from);
+    if (!smtpUser || !smtpUser.includes('@')) {
+        return { ok: false, provider: 'google-workspace', error: 'Email "From" must include a valid email address for Google Workspace SMTP.' };
+    }
+    try {
+        const transporter = await createSmtpTransport({
+            host: 'smtp.gmail.com',
+            port: 465,
+            secure: true,
+            auth: {
+                user: smtpUser,
+                pass: config.providerApiKey
+            }
+        });
+        const info = await transporter.sendMail({
+            from: config.from,
+            to: input.to,
+            replyTo: config.replyTo,
+            subject: input.subject,
+            text: input.text,
+            html: input.html || `<p>${input.text.replace(/\n/g, '<br/>')}</p>`
+        });
+        return { ok: true, provider: 'google-workspace', messageId: String(info?.messageId || '') || undefined };
+    }
+    catch (error) {
+        return { ok: false, provider: 'google-workspace', error: String(error?.message || 'Google Workspace SMTP request failed') };
+    }
+}
+function sendToConsole(input) {
+    console.info(`[Taskforce Email] to=${input.to} subject="${input.subject}"\n${input.text}`);
+    return { ok: true, provider: 'console' };
+}
+export async function sendEmail(input, config) {
+    if (config.provider === 'resend') {
+        return sendWithResend(input, config);
+    }
+    if (config.provider === 'google-workspace') {
+        return sendWithGoogleWorkspace(input, config);
+    }
+    return sendToConsole(input);
+}

package/dist/server/email.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/email.test.js

@@ -0,0 +1,113 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { resolveEffectiveEmailConfig, resolveEmailConfig, sendEmail } from './email';
+import * as smtpTransport from './smtpTransport';
+vi.mock('./smtpTransport', () => ({
+    createSmtpTransport: vi.fn()
+}));
+describe('server/email', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('resolves google-workspace provider from env with alias app password', () => {
+        const config = resolveEmailConfig({
+            TASKFORCE_EMAIL_PROVIDER: 'google-workspace',
+            TASKFORCE_EMAIL_FROM: 'Taskforce <ops@example.com>',
+            TASKFORCE_EMAIL_GOOGLE_APP_PASSWORD: 'google-app-password'
+        });
+        expect(config.provider).toBe('google-workspace');
+        expect(config.providerApiKey).toBe('google-app-password');
+    });
+    it('prefers admin-stored provider key over env key', () => {
+        const config = resolveEffectiveEmailConfig({
+            TASKFORCE_EMAIL_PROVIDER: 'google-workspace',
+            TASKFORCE_EMAIL_GOOGLE_APP_PASSWORD: 'env-key'
+        }, {
+            provider: 'google-workspace',
+            providerApiKey: 'admin-key'
+        });
+        expect(config.providerApiKey).toBe('admin-key');
+    });
+    it('returns actionable error when google-workspace key is missing', async () => {
+        const result = await sendEmail({
+            to: 'qa@example.com',
+            subject: 'test',
+            text: 'hello'
+        }, {
+            provider: 'google-workspace',
+            from: 'Taskforce <ops@example.com>'
+        });
+        expect(result.ok).toBe(false);
+        expect(result.provider).toBe('google-workspace');
+        expect(result.error).toContain('Missing Google app password');
+    });
+    it('sends via nodemailer for google-workspace provider', async () => {
+        const sendMail = vi.fn().mockResolvedValue({ messageId: 'smtp-123' });
+        vi.mocked(smtpTransport.createSmtpTransport).mockResolvedValue({ sendMail });
+        const result = await sendEmail({
+            to: 'qa@example.com',
+            subject: 'test',
+            text: 'hello'
+        }, {
+            provider: 'google-workspace',
+            from: 'Taskforce <ops@example.com>',
+            providerApiKey: 'app-password'
+        });
+        expect(smtpTransport.createSmtpTransport).toHaveBeenCalledWith({
+            host: 'smtp.gmail.com',
+            port: 465,
+            secure: true,
+            auth: {
+                user: 'ops@example.com',
+                pass: 'app-password'
+            }
+        });
+        expect(sendMail).toHaveBeenCalled();
+        expect(result.ok).toBe(true);
+        expect(result.provider).toBe('google-workspace');
+        expect(result.messageId).toBe('smtp-123');
+    });
+    it('preserves resend provider behavior', async () => {
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({ id: 'resend-123' })
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const result = await sendEmail({
+            to: 'qa@example.com',
+            subject: 'test',
+            text: 'hello'
+        }, {
+            provider: 'resend',
+            from: 'Taskforce <no-reply@example.com>',
+            providerApiKey: 'resend-key'
+        });
+        expect(result.ok).toBe(true);
+        expect(result.provider).toBe('resend');
+        expect(result.messageId).toBe('resend-123');
+    });
+    it('retries transient resend failures and succeeds', async () => {
+        const fetchMock = vi.fn()
+            .mockResolvedValueOnce({
+            ok: false,
+            status: 429,
+            json: async () => ({ message: 'rate limited' })
+        })
+            .mockResolvedValueOnce({
+            ok: true,
+            json: async () => ({ id: 'resend-after-retry' })
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const result = await sendEmail({
+            to: 'qa@example.com',
+            subject: 'test',
+            text: 'hello'
+        }, {
+            provider: 'resend',
+            from: 'Taskforce <no-reply@example.com>',
+            providerApiKey: 'resend-key'
+        });
+        expect(fetchMock).toHaveBeenCalledTimes(2);
+        expect(result.ok).toBe(true);
+        expect(result.messageId).toBe('resend-after-retry');
+    });
+});

package/dist/server/index.cookieProxy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/index.cookieProxy.test.js

@@ -0,0 +1,19 @@
+import { describe, it, expect } from 'vitest';
+import { rewriteProxySetCookieForLocalHost, shouldRewriteSetCookieForLocalDevHost } from './index';
+describe('proxy cookie rewrite helpers', () => {
+    it('detects local dev hosts', () => {
+        expect(shouldRewriteSetCookieForLocalDevHost('localhost:5174')).toBe(true);
+        expect(shouldRewriteSetCookieForLocalDevHost('127.0.0.1:8080')).toBe(true);
+        expect(shouldRewriteSetCookieForLocalDevHost('[::1]:3000')).toBe(true);
+        expect(shouldRewriteSetCookieForLocalDevHost('performance-app.taskforcehq.ai')).toBe(false);
+    });
+    it('removes domain attribute for locally proxied cookies', () => {
+        const rewritten = rewriteProxySetCookieForLocalHost('taskforce_session=abc123; Path=/; HttpOnly; Secure; SameSite=None; Domain=.taskforcehq.ai');
+        expect(rewritten).toContain('taskforce_session=abc123');
+        expect(rewritten).toContain('Path=/');
+        expect(rewritten).toContain('HttpOnly');
+        expect(rewritten).toContain('Secure');
+        expect(rewritten).toContain('SameSite=None');
+        expect(rewritten.toLowerCase()).not.toContain('domain=');
+    });
+});

package/dist/server/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Taskforce Standalone Server
+ *
+ * Lightweight HTTP server with WebSocket support for live updates.
+ * Serves pre-built static UI and provides API endpoints.
+ */
+import * as http from 'http';
+export interface StandaloneServerOptions {
+    projectRoot: string;
+    port: number;
+}
+export declare function shouldRewriteSetCookieForLocalDevHost(hostHeader: string | undefined): boolean;
+export declare function rewriteProxySetCookieForLocalHost(cookie: string): string;
+export declare function shouldApplyAuthRateLimitForPath(pathname: string): boolean;
+export declare function ensureBillingWebhookAuthExclusion(excludedPaths: string[]): string[];
+export declare function isBillingWebhookPath(pathname: string): boolean;
+export declare function createStandaloneServer(options: StandaloneServerOptions): http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>;