@tokenoftrust/cli 1.4.0-rc.20 → 1.4.0-rc.22

package/src/validate.mjs

@@ -27,6 +27,38 @@ function mk(level, rule, file, message, fix) {
   return { level, rule, file, message, fix };
 }
 
+// --- git conflict markers ----------------------------------------------------
+// A half-resolved merge/rebase can commit literal conflict markers into content
+// (the incident: `<<<<<<<`/`=======`/`>>>>>>>` in content/home.html slipped past
+// preview as "validated"). These are the default and diff3 marker lines, anchored
+// at line start and exactly 7 chars with a trailing boundary — precise enough that
+// real content never matches. `=======` / `|||||||` ALONE are NOT flagged (a lone
+// `=======` is a common markdown/prose horizontal rule); only the START (`<<<<<<<`)
+// and END (`>>>>>>>`) markers trigger — either one is a near-certain conflict, so
+// we err false-negative-averse and flag on either.
+const CONFLICT_START = /^<{7}(?=[ \t]|$)/;
+const CONFLICT_END = /^>{7}(?=[ \t]|$)/;
+
+/**
+ * Line numbers (1-based) of git conflict markers in `content`. Empty ⇒ none.
+ * Pure — exported for focused testing.
+ * @param {string} content
+ * @returns {number[]}
+ */
+export function detectConflictMarkers(content) {
+  if (typeof content !== "string" || (!content.includes("<<<<<<<") && !content.includes(">>>>>>>"))) return [];
+  const lines = content.split(/\r?\n/);
+  const hits = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (CONFLICT_START.test(lines[i]) || CONFLICT_END.test(lines[i])) hits.push(i + 1);
+  }
+  return hits;
+}
+
+// Text artifacts a conflict marker can hide in (images/fonts live in public/, not scanned).
+const CONFLICT_SCAN_EXT = new Set([".html", ".htm", ".json", ".md", ".txt", ".css", ".js", ".mjs", ".svg", ".xml"]);
+const hasScanExt = (p) => CONFLICT_SCAN_EXT.has((p.match(/\.[^./\\]+$/) || [""])[0].toLowerCase());
+
 // --- canonical `.tot/config.json` shape (the #24/#25 regression guard) --------
 const KNOWN_KINDS = new Set(["file", "tree"]);
 const REQUIRED_WORKSPACES = ["content/", "public/", "theme.json"];
@@ -539,6 +571,26 @@ export function validateTenant(tenantDir, opts = {}) {
     }
   }
 
+  // 5. git conflict markers — advisory (never blocks), but LOUD: a half-resolved
+  // merge/rebase must not slip past as "validated". Scans text artifacts under
+  // content/ plus the root config files.
+  const conflictScanFiles = [
+    ...walk(contentDir, hasScanExt),
+    ...["theme.json", "capabilities.json", "scripts.json", join(".tot", "config.json")]
+      .map((f) => join(tenantDir, f))
+      .filter((p) => existsSync(p)),
+  ];
+  for (const p of conflictScanFiles) {
+    const lines = detectConflictMarkers(readFileSync(p, "utf8"));
+    if (lines.length) {
+      findings.push(
+        mk(WARN, "git-conflict-markers", rel(p),
+          `git conflict markers at line(s) ${lines.join(", ")} — looks like an unfinished merge/rebase (the page would still build/serve broken)`,
+          "resolve the conflict and remove the <<<<<<< / ======= / >>>>>>> lines before submitting"),
+      );
+    }
+  }
+
   const ok = !findings.some((f) => f.level === ERROR);
   return { ok, findings };
 }
@@ -555,6 +607,10 @@ function buildPageTargetSet(contentDir, pagesDir) {
   return set;
 }
 
+/**
+ * @param {any} href @param {any} file @param {any} scope @param {any} pageTargets
+ * @param {(path: string) => boolean} [ownsPlatformRoute]
+ */
 function checkLink(href, file, scope, pageTargets, ownsPlatformRoute = () => false) {
   const out = [];
   if (!href || href.startsWith("#") || href.startsWith("mailto:") || href.startsWith("tel:")) return out;

package/src/viewer-session.mjs

@@ -0,0 +1,118 @@
+/**
+ * Viewer-session transport for the ship surface — the NO-operator-secret path.
+ *
+ * An invited developer holds a `tot login` MCP session but no operator secret and no
+ * storefront cookie, so the old ship-surface transport dead-ended on them. This mints
+ * a storefront VIEWER session from the developer's OWN MCP token (POST
+ * /api/dev/cli-session on the tenant's own host, which resolves WHO the opaque token
+ * is via the MCP and hands back a `tot_session` cookie), then hands the caller a
+ * cookie-based transport pointed at the tenant host. Authorization is still the
+ * developer's live `ship-on-behalf` grant, enforced server-side at the ship route —
+ * this only carries their identity, it grants nothing.
+ *
+ * Minted FRESH per call (no disk cache): a `tot accept` is interactive + infrequent,
+ * and minting-per-call means a revoked session/grant is never honored past its life.
+ */
+import { resolveDeveloperSession, AuthUnavailableError } from "./auth.mjs";
+
+const SESSION_COOKIE = "tot_session";
+
+/** The tenant's own storefront host — the dev-viewer admission derives the tenant
+ *  from the request host, so the session + integrate MUST target it (not the generic
+ *  storefront origin + X-Tot-Owner, which only steers the operator-secret path). */
+function tenantBase(tenant) {
+  return `https://${String(tenant || "").trim().toLowerCase()}`;
+}
+
+/** Pull `tot_session=<id>` out of a (possibly comma-folded) Set-Cookie header. The
+ *  id is base64url — no comma/semicolon — so a non-greedy stop-set is unambiguous. */
+export function parseSessionCookie(setCookie) {
+  if (!setCookie) return null;
+  const m = new RegExp(`${SESSION_COOKIE}=([^;,\\s]+)`).exec(setCookie);
+  return m ? m[1] : null;
+}
+
+/**
+ * Resolve a viewer-session transport for `tenant`. Returns
+ *   { ok:true, base, authHeaders }               — base = tenant host; cookie transport
+ *   { ok:false, message, hint }                  — a clean, actionable refusal
+ * Never throws.
+ *
+ * @param {{ tenant:string, env?:NodeJS.ProcessEnv, fetchImpl?:typeof fetch,
+ *   resolveDev?:typeof resolveDeveloperSession }} params
+ * @returns {Promise<
+ *   { ok:true, base:string, authHeaders:Record<string,string> } |
+ *   { ok:false, message:string, hint:string }
+ * >}
+ */
+export async function resolveViewerTransport({
+  tenant,
+  env = process.env,
+  fetchImpl = fetch,
+  resolveDev = resolveDeveloperSession,
+}) {
+  // The developer's OWN MCP token (read + silently refreshed by the resolver). No
+  // client needed — resolveDeveloperSession tolerates a null client.
+  let dev;
+  try {
+    dev = await resolveDev(null, env, { fetchImpl });
+  } catch (e) {
+    if (e instanceof AuthUnavailableError) {
+      return { ok: false, message: e.message, hint: e.hint || "run `tot login`, then re-run." };
+    }
+    return {
+      ok: false,
+      message: `couldn't read your Token of Trust session: ${e?.message || e}`,
+      hint: "run `tot login`, then re-run.",
+    };
+  }
+
+  const base = tenantBase(tenant);
+  let res;
+  try {
+    res = await fetchImpl(`${base}/api/dev/cli-session`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${dev.token}` },
+    });
+  } catch (e) {
+    return {
+      ok: false,
+      message: `couldn't reach ${base} to start a session: ${e?.message || e}`,
+      hint: "check the --tenant domain / your network, then re-run.",
+    };
+  }
+  if (res.status === 401) {
+    return {
+      ok: false,
+      message: "your `tot` session wasn't recognized for this store.",
+      hint: "run `tot login`, then re-run.",
+    };
+  }
+  if (!res.ok) {
+    return {
+      ok: false,
+      message: `couldn't start a session at ${base} (HTTP ${res.status}).`,
+      hint: "retry shortly; if it persists, this store may not be set up for CLI publishing yet.",
+    };
+  }
+
+  const cookie = parseSessionCookie(res.headers.get("set-cookie"));
+  if (!cookie) {
+    return {
+      ok: false,
+      message: "the store started a session but returned no session cookie.",
+      hint: "re-run; if it persists, report it via `tot` feedback.",
+    };
+  }
+
+  return {
+    ok: true,
+    base,
+    authHeaders: {
+      cookie: `${SESSION_COOKIE}=${cookie}`,
+      // Matches the admin browser client; the server IGNORES this hint and re-reads
+      // the live ship-on-behalf grant, so it authorizes nothing on its own.
+      "x-tot-capability": "ship-on-behalf",
+    },
+  };
+}