@tiddlywiki/mws 0.0.20 → 0.0.21

package/README.md

@@ -1,5 +1,9 @@
 # MultiWikiServer
 
+**This is not ready for primetime. Do not use it to protect feelings or intellectual property.**
+
+*You really shouldn't be using it to store anything important yet. It is still in the VERY early stages of development and we don't even have proper tests verifying the security mechanisms yet. So please try it out, kick the tires, import your multi-gigabyte wikis and play around with it, but don't actually store anything you want to keep. We'll hopefully get there soon, but even the database schema itself is still in flux as we figure out what the best layout is for all the stuff we have planned.*
+
 Multiple users, multiple wikis for TiddlyWiki.
 
 - Bag & Recipe system for storing tiddlers.

package/dist/server.d.ts

@@ -228,6 +228,10 @@ declare class StartupCommander {
     $tw: TW;
     PasswordService: PasswordService;
     fieldModules: Record<string, TiddlerFieldModule>;
+    versions: {
+        tiddlywiki: any;
+        mws: string;
+    };
     constructor(config: MWSConfig, $tw: TW, PasswordService: PasswordService);
     init(): Promise<void>;
     wikiPath: string;
@@ -333,6 +337,7 @@ declare class StateObject<B extends BodyFormat = BodyFormat, M extends AllowedMe
     private engine;
     config: SiteConfig;
     PasswordService: PasswordService;
+    get pathPrefix(): string;
     constructor(streamer: Streamer, 
     /** The array of Route tree nodes the request matched. */
     routePath: RouteMatch[], 
@@ -798,6 +803,10 @@ declare class Router {
     engine: Commander["engine"];
     private SessionManager;
     PasswordService: Commander["PasswordService"];
+    versions: {
+        tiddlywiki: any;
+        mws: string;
+    };
     fieldModules: Commander["$tw"]["Tiddler"]["fieldModules"];
     AttachmentService: Commander["AttachmentService"];
     constructor(rootRoute: rootRoute$1, commander: Commander, tiddlerCache: CacheState);

package/dist/server.js

@@ -1621,7 +1621,7 @@ var require_destroy = __commonJS({
   "node_modules/destroy/index.js"(exports, module2) {
     "use strict";
     init_esm_shims();
-    var EventEmitter = __require("events").EventEmitter;
+    var EventEmitter2 = __require("events").EventEmitter;
     var ReadStream = __require("fs").ReadStream;
     var Stream = __require("stream");
     var Zlib = __require("zlib");
@@ -1688,7 +1688,7 @@ var require_destroy = __commonJS({
     }
     __name(hasDestroy, "hasDestroy");
     function isEventEmitter(val) {
-      return val instanceof EventEmitter;
+      return val instanceof EventEmitter2;
     }
     __name(isEventEmitter, "isEventEmitter");
     function isFsReadStream(stream) {
@@ -11569,7 +11569,8 @@ var init_data_checks = __esm({
     init_esm_shims();
     init_utils();
     _DataChecks = class _DataChecks {
-      constructor(options) {
+      constructor(config) {
+        this.config = config;
         this.isPermissionName = /* @__PURE__ */ __name((e) => {
           const test2 = e;
           switch (test2) {
@@ -11586,8 +11587,6 @@ var init_data_checks = __esm({
         this.permissions = { READ: "READ", WRITE: "WRITE", ADMIN: "ADMIN" };
         this.isEntityType = /* @__PURE__ */ __name((x) => ["recipe", "bag"].includes(x), "isEntityType");
         this.entityTypes = { recipe: "recipe", bag: "bag" };
-        this.allowAnonReads = options.allowAnonReads;
-        this.allowAnonWrites = options.allowAnonWrites;
       }
       okTiddlerFields(tiddlerFields) {
         ok2(tiddlerFields.title, "title must not be empty");
@@ -11648,17 +11647,11 @@ var init_data_checks = __esm({
         ].filter(truthy);
       }
       getWhereACL({ permission, user_id, role_ids }) {
-        const { allowAnonReads, allowAnonWrites } = this;
-        const anonRead = allowAnonReads && permission === "READ";
-        const anonWrite = allowAnonWrites && permission === "WRITE";
-        const allowAnon = anonRead || anonWrite;
         const allperms = ["READ", "WRITE", "ADMIN"];
         const index = allperms.indexOf(permission);
         if (index === -1) throw new Error("Invalid permission");
         const checkPerms = allperms.slice(index);
         return [
-          // allow unowned for any user (conditional for anon reads)
-          (user_id || allowAnon) && { acl: { none: {} }, owner_id: null },
           // allow owner for user 
           user_id && { owner_id: { equals: user_id, not: null } },
           // allow acl for user 
@@ -11669,7 +11662,9 @@ var init_data_checks = __esm({
                 role_id: { in: role_ids }
               }
             }
-          }
+          },
+          { owner_id: { equals: null, not: null } }
+          // dud to make sure that at least one condition exists
         ].filter(truthy);
       }
     };
@@ -11814,8 +11809,9 @@ var init_streamer = __esm({
           if (error === STREAM_ENDED) return;
           const tag = this.urlInfo.href;
           console.error(tag, error);
-          if (!this.headersSent)
+          if (!this.headersSent) {
             this.sendEmpty(500, { "x-reason": "Internal Server Error (catcher)" });
+          }
         }, "catcher");
         this.readBody = /* @__PURE__ */ __name(() => new Promise((resolve13) => {
           const chunks = [];
@@ -12178,6 +12174,9 @@ var init_StateObject = __esm({
       get method() {
         return super.method;
       }
+      get pathPrefix() {
+        return this.config.pathPrefix;
+      }
       okUser() {
         if (!this.user.isLoggedIn) throw "User not authenticated";
       }
@@ -12406,8 +12405,8 @@ var init_manager_recipes = __esm({
             where: isAdmin ? void 0 : {
               OR: [
                 { recipe_bags: { every: { bag: { OR } } } },
-                { owner_id: { equals: user_id, not: null } }
-              ]
+                user_id && { owner_id: { equals: user_id, not: null } }
+              ].filter((e) => e)
             }
           });
           const userListUser = !isAdmin && await prisma.users.findMany({
@@ -12428,7 +12427,8 @@ var init_manager_recipes = __esm({
             username,
             isLoggedIn: state.user.isLoggedIn,
             allowAnonReads: state.config.allowAnonReads,
-            allowAnonWrites: state.config.allowAnonWrites
+            allowAnonWrites: state.config.allowAnonWrites,
+            versions: state.router.versions
           };
         });
         this.recipe_create = zodManage((z5) => z5.object({
@@ -12585,8 +12585,7 @@ var init_manager_recipes = __esm({
           });
           return null;
         });
-        const { allowAnonReads, allowAnonWrites } = config;
-        this.checks = new DataChecks({ allowAnonReads, allowAnonWrites });
+        this.checks = new DataChecks(config);
       }
       static defineRoutes(root, config) {
         registerZodRoutes(root, new _RecipeManager(config), Object.keys(RecipeKeyMap));
@@ -13190,13 +13189,15 @@ var init_TiddlerStore = __esm({
             recipe_bags: {
               // we're saving to the top most bag
               where: { position: 0 },
-              select: { bag: { select: { bag_id: true, bag_name: true } } }
+              select: { bag: { select: { bag_id: true, bag_name: true, is_plugin: true } } }
             }
           }
         });
         if (!recipe) throw new UserError("Recipe not found");
         const bag_name = recipe.recipe_bags[0]?.bag.bag_name;
         if (!bag_name) throw new UserError("Recipe has no bag at position 0");
+        if (recipe.recipe_bags[0]?.bag.is_plugin)
+          throw new UserError("Saving to plugin bags is not currently supported. Please use a normal bag. This error occurs if a plugin bag is at the top of the recipe.\n");
         var { tiddler_id } = await this.saveBagTiddlerFields(tiddlerFields, bag_name, attachment_hash);
         return { tiddler_id, bag_name };
       }
@@ -14676,58 +14677,62 @@ var init_router_tiddlers = __esm({
 
 // src/routes/tw-routes.ts
 import { TiddlyWiki } from "tiddlywiki";
-function DocsRoute(parent, config) {
-  const wikiRouter = new TWRouter(config);
-  console.log("The mws-docs tiddlywiki is being served at " + config.pathPrefix + "/mws-docs");
-  parent.defineRoute({
+import { basename } from "path";
+import EventEmitter from "events";
+function DocsRoute(rootRoute2, mountPath, singleFile) {
+  const $tw2 = TiddlyWiki();
+  const last = basename(mountPath);
+  $tw2.preloadTiddler({
+    title: "$:/config/tiddlyweb/host",
+    // if the page url doesn't end with a slash, we have to include the basename here
+    text: singleFile ? last + "/" : ""
+  });
+  $tw2.boot.argv = [
+    "+plugins/tiddlywiki/tiddlyweb",
+    "+plugins/tiddlywiki/filesystem",
+    // relative to the cwd
+    "./editions/mws-docs"
+  ];
+  const hooks = new EventEmitter();
+  $tw2.boot.boot(() => {
+    const Server2 = $tw2.modules.execute("$:/core/modules/server/server.js", "tw-test.ts").Server;
+    const twserver = new Server2({
+      wiki: $tw2.wiki,
+      variables: {
+        // path prefix gets set per-request
+        "path-prefix": "",
+        "root-tiddler": "$:/core/save/all"
+      },
+      routes: []
+    });
+    $tw2.hooks.invokeHook("th-server-command-post-start", twserver, null, "mws");
+    hooks.on("req", (req, res, pathPrefix) => {
+      twserver.requestHandler(req, res, { pathPrefix });
+    });
+  });
+  rootRoute2.defineRoute({
     method: ["OPTIONS", "GET", "HEAD", "POST", "PUT", "DELETE"],
     bodyFormat: "stream",
-    path: /^\/mwsp-docs(\/|$)/,
+    path: new RegExp("^" + mountPath + "(/|$)"),
     pathParams: []
   }, async (state) => {
-    if (state.urlInfo.pathname === "/mws-docs") throw state.redirect("/mws-docs/");
+    if (singleFile && state.urlInfo.pathname === mountPath + "/")
+      throw state.redirect(mountPath);
+    if (!singleFile && state.urlInfo.pathname === mountPath)
+      throw state.redirect(mountPath + "/");
     const { req, res } = state.streamer;
-    if (req.url === "/mws-docs") req.url = "/mws-docs/";
-    wikiRouter.twserver.requestHandler(req, res, {});
-    return new Promise((r, c) => res.on("finish", r).on("error", c));
+    if (req.url === state.pathPrefix + mountPath)
+      req.url = state.pathPrefix + mountPath + "/";
+    const prom = new Promise((r, c) => res.on("finish", r).on("error", c));
+    hooks.emit("req", req, res, state.pathPrefix + mountPath);
+    return prom;
   });
 }
-var _TWRouter, TWRouter;
 var init_tw_routes = __esm({
   "src/routes/tw-routes.ts"() {
     "use strict";
     init_esm_shims();
     __name(DocsRoute, "DocsRoute");
-    _TWRouter = class _TWRouter {
-      constructor(config) {
-        this.config = config;
-        this.$tw = TiddlyWiki();
-        this.$tw.boot.argv = [
-          "+plugins/tiddlywiki/tiddlyweb",
-          "+plugins/tiddlywiki/filesystem",
-          "./editions/mws-docs"
-        ];
-        this.$tw.preloadTiddler({
-          text: "$protocol$//$host$" + this.config.pathPrefix + "/mws/",
-          title: "$:/config/tiddlyweb/host"
-        });
-        this.$tw.boot.boot(() => {
-          const Server2 = this.$tw.modules.execute("$:/core/modules/server/server.js", "tw-test.ts").Server;
-          this.twserver = new Server2({
-            wiki: this.$tw.wiki,
-            variables: {
-              // do not use a trailing slash
-              "path-prefix": this.config.pathPrefix + "/mws",
-              "root-tiddler": "$:/core/save/all"
-            },
-            routes: []
-          });
-          this.$tw.hooks.invokeHook("th-server-command-post-start", this.twserver, null, "mws");
-        });
-      }
-    };
-    __name(_TWRouter, "TWRouter");
-    TWRouter = _TWRouter;
   }
 });
 
@@ -14747,7 +14752,7 @@ var init_ = __esm({
 // src/routes/index.ts
 import { Prisma } from "@prisma/client";
 async function RootRoute(root, config) {
-  if (process.env.ENABLE_DOCS_ROUTE) DocsRoute(root, config);
+  if (process.env.ENABLE_DOCS_ROUTE) DocsRoute(root, "/mws-docs", false);
   TiddlerRouter.defineRoutes(root);
   ManagerRoutes(root, config);
   if (process.env.ENABLE_UNSAFE_PRISMA_ROUTE)
@@ -14995,7 +15000,6 @@ import * as path3 from "path";
 import * as crypto from "crypto";
 async function startupCache(rootRoute2, commander2) {
   const $tw2 = commander2.$tw;
-  console.log(commander2.siteConfig.enablePluginCache);
   const { tiddlerFiles, tiddlerHashes } = commander2.siteConfig.enablePluginCache ? await importTW5(path3.join($tw2.boot.corePath, ".."), commander2.cachePath, "client", $tw2) : { tiddlerFiles: /* @__PURE__ */ new Map(), tiddlerHashes: /* @__PURE__ */ new Map() };
   rootRoute2.defineRoute({
     method: ["GET", "HEAD"],
@@ -15151,6 +15155,7 @@ var init_router = __esm({
         this.PasswordService = commander2.PasswordService;
         this.fieldModules = commander2.$tw.Tiddler.fieldModules;
         this.AttachmentService = commander2.AttachmentService;
+        this.versions = commander2.versions;
       }
       static async makeRouter(commander2, enableDevServer) {
         const sendDevServer = await setupDevServer(enableDevServer, commander2.siteConfig.pathPrefix);
@@ -15332,8 +15337,10 @@ var init_router = __esm({
             if (error === STREAM_ENDED) {
               return error;
             } else if (typeof error === "string") {
+              console.log(error);
               return state.sendString(400, { "x-reason": "zod-handler" }, error, "utf8");
             } else if (error instanceof Error && error.name === "UserError") {
+              console.log(error.stack);
               return state.sendString(400, { "x-reason": "user-error" }, error.message, "utf8");
             } else {
               throw error;
@@ -16878,7 +16885,7 @@ var require_command = __commonJS({
   "node_modules/commander/lib/command.js"(exports) {
     "use strict";
     init_esm_shims();
-    var EventEmitter = __require("node:events").EventEmitter;
+    var EventEmitter2 = __require("node:events").EventEmitter;
     var childProcess = __require("node:child_process");
     var path6 = __require("node:path");
     var fs4 = __require("node:fs");
@@ -16888,7 +16895,7 @@ var require_command = __commonJS({
     var { Help: Help2, stripColor } = require_help();
     var { Option: Option2, DualOptions } = require_option();
     var { suggestSimilar } = require_suggestSimilar();
-    var _Command12 = class _Command12 extends EventEmitter {
+    var _Command12 = class _Command12 extends EventEmitter2 {
       /**
        * Initialize a new `Command`.
        *
@@ -20134,6 +20141,23 @@ var init_sqlite_adapter = __esm({
             argTypes: []
           }).then((e) => e.rows.map((e2) => e2[0]))
         );
+        if (applied_migrations.size && !applied_migrations.has("20250406213424_init")) {
+          console.log("Unknown migrations have been found in the database.");
+          console.log("There is no way to guarentee the integrity of the database under these conditions.");
+          console.log("The only way I know of that you could be seeing this message is if you installed this verion of MWS in a project either from the PR branch or from a newer version of MWS.");
+          console.log("Please revert back to the version you had installed before.");
+          console.log("The sqlite database can be opened manually with any third-party SQLite tool to retrieve your data. If you do this, make sure you keep all the files in the store folder together, as they are all an integral part of your sqlite database and deleting any of them manually is very likely to cause data loss.");
+          process.exit();
+        } else {
+          console.log([
+            "=======================================================================================",
+            "This version of MWS is no longer supported. It is an alpha version",
+            "and you shouldn't be using it in production anyway. Please export any",
+            "wikis you want to keep by opening them and downloading them as single-file",
+            "wikis by clicking on the cloud status icon and then 'save snapshot for offline use'.",
+            "======================================================================================="
+          ].join("\n"));
+        }
         const migrations = await readdir(dist_resolve("../prisma/migrations"));
         migrations.sort();
         const new_migrations = migrations.filter((m) => !applied_migrations.has(m) && m !== "migration_lock.toml");
@@ -20168,6 +20192,78 @@ var init_sqlite_adapter = __esm({
   }
 });
 
+// package.json
+var package_default;
+var init_package = __esm({
+  "package.json"() {
+    package_default = {
+      name: "@tiddlywiki/mws",
+      description: "TiddlyWiki Multiple Wiki Server",
+      private: false,
+      version: "0.0.21",
+      type: "module",
+      exports: {
+        types: "./src/server.ts",
+        require: "./dist/server.cjs",
+        import: "./dist/server.js"
+      },
+      files: [
+        "dist",
+        "prisma",
+        "react-user-mgmt",
+        "tiddlywiki-types",
+        "editions/mws-docs",
+        "plugins/client",
+        "scripts.mjs"
+      ],
+      engines: {
+        node: ">=18"
+      },
+      scripts: {
+        docs: "node scripts.mjs docs",
+        start: "node scripts.mjs start",
+        certs: "(cd runtime-config && bash localhost_certs.sh)",
+        tsc: "tsc -p tsconfig.json --skipLibCheck",
+        build: "npm run tsc && tsup && node mws.dev.mjs --client-build",
+        "install-android": `GYP_DEFINES="android_ndk_path=''" npm install`,
+        postinstall: "node scripts.mjs prisma:generate",
+        env: "env",
+        "test:pack": "(git clean -dfx tests && npm pack --pack-destination tests && cd tests && npm install && npm install ./tiddlywiki-mws-$npm_package_version.tgz --no-save && npm test)",
+        test: "(git clean -dfx tests && cd tests && npm install .. --no-save && npm test)",
+        fulltest: "mv node_modules node_modules_old; npm run test:pack; mv node_modules_old node_modules",
+        prepublishOnly: "npm run build"
+      },
+      dependencies: {
+        "@prisma/adapter-better-sqlite3": "6.7.0-dev.48",
+        "@prisma/client": "6.6.0",
+        "@serenity-kit/opaque": "^0.8.4",
+        "@types/mime-types": "^2.1.4",
+        "@types/node": "^22.13.1",
+        "@types/send": "^0.17.4",
+        "@types/sjcl": "^1.0.34",
+        "@types/tiddlywiki": "file:tiddlywiki-types",
+        prisma: "6.6.0",
+        "source-map-support": "^0.5.21",
+        zod: "^3.24.2"
+      },
+      devDependencies: {
+        commander: "^13.1.0",
+        esbuild: "0.25.2",
+        "mime-types": "^2.1.35",
+        send: "^1.1.0",
+        sjcl: "^1.0.8",
+        tiddlywiki: "^5.1.22",
+        tsup: "^8.4.0",
+        typescript: "^5.7.3",
+        uuid: "^11.1.0"
+      },
+      peerDependencies: {
+        tiddlywiki: "^5.1.22"
+      }
+    };
+  }
+});
+
 // src/commander.ts
 import * as path5 from "node:path";
 import { PrismaClient as PrismaClient2 } from "@prisma/client";
@@ -20184,6 +20280,7 @@ var init_commander = __esm({
     init_esm();
     init_commands();
     init_sqlite_adapter();
+    init_package();
     _StartupCommander = class _StartupCommander {
       constructor(config, $tw2, PasswordService) {
         this.config = config;
@@ -20224,6 +20321,10 @@ var init_commander = __esm({
         this.AttachmentService = config.AttachmentService || AttachmentService;
         this.adapter = new SqliteAdapter(this.databasePath);
         this.engine = new PrismaClient2({ log: ["info", "warn"], adapter: this.adapter.adapter });
+        this.versions = {
+          tiddlywiki: $tw2.packageInfo.version,
+          mws: package_default.version
+        };
       }
       async init() {
         await this.adapter.init();
@@ -20231,6 +20332,19 @@ var init_commander = __esm({
         const users = await this.engine.users.count();
         if (!users) {
           this.setupRequired = true;
+        } else {
+          const checkBags = await this.engine.bags.findMany({
+            where: { bag_name: { startsWith: "$:/" } },
+            select: { bag_name: true, tiddlers: { select: { title: true } } }
+          });
+          checkBags.forEach((e) => {
+            e.tiddlers.forEach((f) => {
+              if (f.title !== e.bag_name) {
+                if (e.bag_name === "$:/plugins/tiddlywiki/codemirror-fullscreen-editing" && f.title === "$:/plugins/tiddlywiki/codemirror-fullscreen") return;
+                console.log(`The bag ${e.bag_name} has a tiddler ${f.title}, in the future this will be unsupported. This can occur if the top bag in a recipe is one of the system bags (starting with $:/)`);
+              }
+            });
+          });
         }
       }
       $transaction(fn, options) {