@tuturuuu/utils 0.12.1 → 0.15.0

package/src/shared-cookie.test.ts

@@ -0,0 +1,114 @@
+import { describe, expect, it } from 'vitest';
+import {
+  getHostOnlyCookieOptions,
+  getSharedAndHostOnlyCookieDeleteOptions,
+  getTuturuuuSharedCookieOptions,
+  resolveTuturuuuSharedCookieDomain,
+} from './shared-cookie';
+
+describe('shared Tuturuuu cookie helpers', () => {
+  it('resolves production root and subdomains to the parent domain', () => {
+    expect(
+      resolveTuturuuuSharedCookieDomain('https://tuturuuu.com')?.cookieDomain
+    ).toBe('.tuturuuu.com');
+    expect(
+      resolveTuturuuuSharedCookieDomain('https://tasks.tuturuuu.com')
+    ).toMatchObject({
+      cookieDomain: '.tuturuuu.com',
+      secure: true,
+    });
+  });
+
+  it('resolves local first-party subdomains without Secure cookies', () => {
+    expect(
+      resolveTuturuuuSharedCookieDomain('https://tasks.tuturuuu.localhost')
+    ).toMatchObject({
+      cookieDomain: '.tuturuuu.localhost',
+      secure: false,
+    });
+  });
+
+  it('uses forwarded host headers for server requests', () => {
+    const request = new Request('http://internal.localhost/api', {
+      headers: {
+        'x-forwarded-host': 'calendar.tuturuuu.com',
+        'x-forwarded-proto': 'https',
+      },
+    });
+
+    expect(resolveTuturuuuSharedCookieDomain(request)).toMatchObject({
+      cookieDomain: '.tuturuuu.com',
+      secure: true,
+    });
+  });
+
+  it('does not share cookies on preview, localhost, or custom domains', () => {
+    expect(
+      resolveTuturuuuSharedCookieDomain('https://tuturuuu-git-main.vercel.app')
+    ).toBe(null);
+    expect(resolveTuturuuuSharedCookieDomain('http://localhost:7803')).toBe(
+      null
+    );
+    expect(resolveTuturuuuSharedCookieDomain('https://nova.ai.vn')).toBe(null);
+  });
+
+  it('applies shared options only when the current host is first-party', () => {
+    expect(
+      getTuturuuuSharedCookieOptions(
+        { maxAge: 60, path: '/', sameSite: 'lax' as const },
+        'https://finance.tuturuuu.com'
+      )
+    ).toEqual({
+      domain: '.tuturuuu.com',
+      maxAge: 60,
+      path: '/',
+      sameSite: 'lax',
+      secure: true,
+    });
+    expect(
+      getTuturuuuSharedCookieOptions(
+        { maxAge: 60, path: '/', sameSite: 'lax' as const },
+        'https://rewise.me'
+      )
+    ).toEqual({
+      maxAge: 60,
+      path: '/',
+      sameSite: 'lax',
+    });
+  });
+
+  it('returns host-only and shared delete options when a shared domain exists', () => {
+    expect(
+      getSharedAndHostOnlyCookieDeleteOptions(
+        { path: '/', sameSite: 'lax' as const },
+        'https://drive.tuturuuu.com'
+      )
+    ).toEqual([
+      {
+        maxAge: 0,
+        path: '/',
+        sameSite: 'lax',
+      },
+      {
+        domain: '.tuturuuu.com',
+        maxAge: 0,
+        path: '/',
+        sameSite: 'lax',
+        secure: true,
+      },
+    ]);
+  });
+
+  it('strips domains from host-only options', () => {
+    expect(
+      getHostOnlyCookieOptions({
+        domain: '.tuturuuu.com',
+        maxAge: 0,
+        path: '/',
+      })
+    ).toEqual({
+      maxAge: 0,
+      path: '/',
+    });
+  });
+});

package/src/shared-cookie.ts

@@ -0,0 +1,235 @@
+export interface TuturuuuSharedCookieDomain {
+  cookieDomain: '.tuturuuu.com' | '.tuturuuu.localhost';
+  hostname: 'tuturuuu.com' | 'tuturuuu.localhost';
+  secure: boolean;
+}
+
+export type CookieOptionsLike = {
+  domain?: string;
+  expires?: Date;
+  maxAge?: number;
+  path?: string;
+  sameSite?: boolean | 'lax' | 'none' | 'strict';
+  secure?: boolean;
+};
+
+type HeaderReader =
+  | Headers
+  | Pick<Headers, 'get'>
+  | Record<string, string | null | undefined>;
+
+type CookieSource =
+  | URL
+  | string
+  | {
+      headers?: HeaderReader;
+      url?: string;
+    }
+  | null
+  | undefined;
+
+export const TUTURUUU_SHARED_COOKIE_DOMAINS = [
+  {
+    cookieDomain: '.tuturuuu.com',
+    hostname: 'tuturuuu.com',
+    secure: true,
+  },
+  {
+    cookieDomain: '.tuturuuu.localhost',
+    hostname: 'tuturuuu.localhost',
+    secure: false,
+  },
+] as const satisfies readonly TuturuuuSharedCookieDomain[];
+
+const ENV_APP_URL_KEYS = [
+  'PORTLESS_URL',
+  'NEXT_PUBLIC_APP_URL',
+  'NEXT_PUBLIC_WEB_APP_URL',
+  'WEB_APP_URL',
+  'VERCEL_URL',
+] as const;
+
+function normalizeUrlLike(value: string | URL | null | undefined) {
+  if (!value) return null;
+
+  if (value instanceof URL) return value;
+
+  try {
+    return new URL(value);
+  } catch {
+    try {
+      return new URL(`https://${value}`);
+    } catch {
+      return null;
+    }
+  }
+}
+
+function readHeader(headers: HeaderReader | undefined, name: string) {
+  if (!headers) return null;
+
+  if ('get' in headers && typeof headers.get === 'function') {
+    return headers.get(name);
+  }
+
+  const lowerName = name.toLowerCase();
+  const record = headers as Record<string, string | null | undefined>;
+
+  return record[name] ?? record[lowerName] ?? null;
+}
+
+function extractForwardedValue(value: string | null | undefined) {
+  return value
+    ?.split(',')
+    .map((entry) => entry.trim())
+    .find(Boolean);
+}
+
+function configuredAppUrl() {
+  if (typeof window !== 'undefined' && window.location?.href) {
+    return window.location.href;
+  }
+
+  for (const key of ENV_APP_URL_KEYS) {
+    const value = process.env[key];
+    if (value) return value;
+  }
+
+  return null;
+}
+
+function resolveUrlFromRequestLike(
+  source: Extract<CookieSource, { headers?: HeaderReader; url?: string }>
+) {
+  const forwardedHost =
+    extractForwardedValue(readHeader(source.headers, 'x-forwarded-host')) ??
+    extractForwardedValue(readHeader(source.headers, 'host'));
+
+  if (forwardedHost && !/[\r\n]/u.test(forwardedHost)) {
+    const forwardedProto = extractForwardedValue(
+      readHeader(source.headers, 'x-forwarded-proto')
+    );
+    const fallbackProtocol = normalizeUrlLike(source.url)?.protocol ?? 'https:';
+    const protocol =
+      forwardedProto?.replace(/:$/u, '') === 'http'
+        ? 'http:'
+        : fallbackProtocol === 'http:'
+          ? 'http:'
+          : 'https:';
+
+    return normalizeUrlLike(`${protocol}//${forwardedHost}`);
+  }
+
+  return normalizeUrlLike(source.url);
+}
+
+function resolveCookieUrl(source: CookieSource) {
+  if (!source) {
+    return normalizeUrlLike(configuredAppUrl());
+  }
+
+  if (typeof source === 'string' || source instanceof URL) {
+    return normalizeUrlLike(source);
+  }
+
+  return resolveUrlFromRequestLike(source);
+}
+
+function domainForUrl(url: string | URL | null | undefined) {
+  const parsedUrl = normalizeUrlLike(url);
+  const hostname = parsedUrl?.hostname.toLowerCase();
+
+  if (!hostname) return null;
+
+  return (
+    TUTURUUU_SHARED_COOKIE_DOMAINS.find(
+      (entry) =>
+        hostname === entry.hostname || hostname.endsWith(`.${entry.hostname}`)
+    ) ?? null
+  );
+}
+
+function isPortlessBackendUrl(sourceUrl: URL | null) {
+  const portlessUrl = normalizeUrlLike(process.env.PORTLESS_URL);
+  const expectedPort = process.env.PORT;
+
+  if (!sourceUrl || !portlessUrl || !expectedPort) return false;
+  if (!domainForUrl(portlessUrl)) return false;
+
+  return (
+    (sourceUrl.protocol === 'http:' || sourceUrl.protocol === 'https:') &&
+    (sourceUrl.hostname === '127.0.0.1' ||
+      sourceUrl.hostname === 'localhost') &&
+    sourceUrl.port === expectedPort
+  );
+}
+
+export function resolveTuturuuuSharedCookieDomain(source?: CookieSource) {
+  const sourceUrl = resolveCookieUrl(source);
+  const sourceDomain = domainForUrl(sourceUrl);
+
+  if (sourceDomain) return sourceDomain;
+
+  if (isPortlessBackendUrl(sourceUrl)) {
+    return domainForUrl(process.env.PORTLESS_URL);
+  }
+
+  return null;
+}
+
+export function getTuturuuuSharedCookieOptions<
+  TOptions extends CookieOptionsLike,
+>(options: TOptions, source?: CookieSource): TOptions {
+  const sharedDomain = resolveTuturuuuSharedCookieDomain(source);
+  const nextOptions = {
+    ...options,
+    path: options.path ?? '/',
+  };
+
+  if (!sharedDomain) return nextOptions;
+
+  return {
+    ...nextOptions,
+    domain: sharedDomain.cookieDomain,
+    secure: sharedDomain.secure,
+  };
+}
+
+export function getTuturuuuBrowserSharedCookieOptions<
+  TOptions extends CookieOptionsLike,
+>(options: TOptions): TOptions {
+  return getTuturuuuSharedCookieOptions(options);
+}
+
+export function getHostOnlyCookieOptions<TOptions extends CookieOptionsLike>(
+  options: TOptions
+): TOptions {
+  const { domain: _domain, ...hostOnlyOptions } = options;
+
+  return {
+    ...hostOnlyOptions,
+    path: options.path ?? '/',
+  } as TOptions;
+}
+
+export function getSharedAndHostOnlyCookieDeleteOptions<
+  TOptions extends CookieOptionsLike,
+>(options: TOptions, source?: CookieSource): TOptions[] {
+  const hostOnlyOptions = getHostOnlyCookieOptions({
+    ...options,
+    maxAge: 0,
+    path: options.path ?? '/',
+  });
+  const sharedOptions = getTuturuuuSharedCookieOptions(
+    {
+      ...options,
+      maxAge: 0,
+      path: options.path ?? '/',
+    },
+    source
+  );
+
+  if (!sharedOptions.domain) return [hostOnlyOptions];
+
+  return [hostOnlyOptions, sharedOptions];
+}

package/src/task/transformers.ts

@@ -142,6 +142,8 @@ export function transformTaskRecord(task: any): Task {
 
   return {
     ...task,
+    is_personal_external: task.is_personal_external ?? false,
+    is_personal_external_default: task.is_personal_external_default ?? false,
     assignees: transformAssignees(task.assignees),
     labels: normalizedLabels,
     projects: normalizedProjects,

package/src/topic-announcements.ts

@@ -0,0 +1 @@
+export const TOPIC_ANNOUNCEMENTS_SECRET = 'ENABLE_TOPIC_ANNOUNCEMENTS';

package/src/user-helper.ts

@@ -1,13 +1,8 @@
 import type { TypedSupabaseClient } from '@tuturuuu/supabase/next/client';
-import {
-  createAdminClient,
-  createClient,
-} from '@tuturuuu/supabase/next/server';
+import { createClient } from '@tuturuuu/supabase/next/server';
 import type { User, UserPrivateDetails } from '@tuturuuu/types';
 import type { WorkspaceUser } from '@tuturuuu/types/primitives/WorkspaceUser';
-
-import { resolveWorkspaceId } from './constants';
-import { verifyWorkspaceMembershipType } from './workspace-helper';
+import { getWorkspaceUserLinkForUser } from './workspace-user-link';
 
 async function resolveCurrentUserId(
   supabase: TypedSupabaseClient
@@ -71,98 +66,14 @@ export async function getCurrentWorkspaceUser(
   wsId: string,
   options: GetCurrentWorkspaceUserOptions = {}
 ): Promise<WorkspaceUserLink | null> {
-  const { autoRepair = true } = options;
-
   const supabase = await createClient();
   const userId = await resolveCurrentUserId(supabase as TypedSupabaseClient);
   if (!userId) return null;
 
-  const resolvedWsId = resolveWorkspaceId(wsId);
-
-  // First attempt to get the workspace user link
-  const { data: workspaceUser } = await supabase
-    .from('workspace_user_linked_users')
-    .select(
-      'platform_user_id, virtual_user_id, ws_id, created_at, workspace_users!virtual_user_id(*)'
-    )
-    .eq('platform_user_id', userId)
-    .eq('ws_id', resolvedWsId)
-    .limit(1)
-    .maybeSingle();
-
-  // If found, return it
-  if (workspaceUser) {
-    const linkedData = workspaceUser.workspace_users;
-    return {
-      platform_user_id: workspaceUser.platform_user_id,
-      virtual_user_id: workspaceUser.virtual_user_id,
-      ws_id: workspaceUser.ws_id,
-      created_at: workspaceUser.created_at,
-      ...(linkedData ? { workspace_users: linkedData as WorkspaceUser } : {}),
-    };
-  }
-
-  // If not found and auto-repair is disabled, return null
-  if (!autoRepair) return null;
-
-  const membership = await verifyWorkspaceMembershipType({
-    wsId: resolvedWsId,
-    userId,
-    supabase,
-    requiredType: 'MEMBER',
-  });
-
-  if (!membership.ok) return null;
-
-  // Try to repair the missing link using the RPC function
-  try {
-    const sbAdmin = await createAdminClient();
-    // Note: ensure_workspace_user_link is defined in migration 20260112060000
-    // Using type assertion since RPC types are generated after migration is applied
-    // IMPORTANT: Must use .bind() to preserve the Supabase client's `this` context
-    const rpc = sbAdmin.rpc.bind(sbAdmin) as unknown as (
-      fn: string,
-      args: Record<string, unknown>
-    ) => Promise<{ error: Error | null }>;
-    const { error: repairError } = await rpc('ensure_workspace_user_link', {
-      target_user_id: userId,
-      target_ws_id: resolvedWsId,
-    });
-
-    if (repairError) {
-      console.error(
-        '[getCurrentWorkspaceUser] Failed to auto-repair workspace user link:',
-        repairError
-      );
-      return null;
-    }
-
-    // Fetch the newly created link
-    const { data: repairedUser } = await supabase
-      .from('workspace_user_linked_users')
-      .select(
-        'platform_user_id, virtual_user_id, ws_id, created_at, workspace_users!virtual_user_id(*)'
-      )
-      .eq('platform_user_id', userId)
-      .eq('ws_id', resolvedWsId)
-      .limit(1)
-      .maybeSingle();
-
-    if (repairedUser) {
-      const linkedData = repairedUser.workspace_users;
-      return {
-        platform_user_id: repairedUser.platform_user_id,
-        virtual_user_id: repairedUser.virtual_user_id,
-        ws_id: repairedUser.ws_id,
-        created_at: repairedUser.created_at,
-        ...(linkedData ? { workspace_users: linkedData as WorkspaceUser } : {}),
-      };
-    }
-  } catch (err) {
-    console.error('[getCurrentWorkspaceUser] Error during auto-repair:', err);
-  }
-
-  return null;
+  // The link lookup + auto-repair lives in workspace-user-link so satellite apps
+  // can reuse it with an app-session actor: the internal-app-auth guard forbids
+  // registered apps from importing this module (it resolves actors via Supabase).
+  return getWorkspaceUserLinkForUser(wsId, userId, options);
 }
 
 export async function getCurrentUser() {

package/src/workspace-user-link.test.ts

@@ -0,0 +1,53 @@
+import type { TypedSupabaseClient } from '@tuturuuu/supabase/types';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  createAdminClient: vi.fn(),
+  createClient: vi.fn(),
+  verifyWorkspaceMembershipType: vi.fn(),
+}));
+
+vi.mock('@tuturuuu/supabase/next/server', () => ({
+  createAdminClient: mocks.createAdminClient,
+  createClient: mocks.createClient,
+}));
+vi.mock('./workspace-helper', () => ({
+  verifyWorkspaceMembershipType: mocks.verifyWorkspaceMembershipType,
+}));
+
+import { getWorkspaceUserLinkForUser } from './workspace-user-link';
+
+describe('getWorkspaceUserLinkForUser', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('uses an injected authorization client for satellite actors', async () => {
+    const link = {
+      created_at: '2026-07-13T00:00:00.000Z',
+      platform_user_id: 'platform-user-1',
+      virtual_user_id: 'virtual-user-1',
+      ws_id: 'workspace-1',
+    };
+    const maybeSingle = vi.fn().mockResolvedValue({ data: link, error: null });
+    const limit = vi.fn(() => ({ maybeSingle }));
+    const secondEq = vi.fn(() => ({ limit }));
+    const firstEq = vi.fn(() => ({ eq: secondEq }));
+    const select = vi.fn(() => ({ eq: firstEq }));
+    const authorizationClient = {
+      from: vi.fn(() => ({ select })),
+    } as unknown as TypedSupabaseClient;
+
+    await expect(
+      getWorkspaceUserLinkForUser('workspace-1', 'platform-user-1', {
+        authorizationClient,
+      })
+    ).resolves.toEqual(link);
+
+    expect(authorizationClient.from).toHaveBeenCalledWith(
+      'workspace_user_linked_users'
+    );
+    expect(mocks.createClient).not.toHaveBeenCalled();
+    expect(mocks.createAdminClient).not.toHaveBeenCalled();
+  });
+});

package/src/workspace-user-link.ts

@@ -0,0 +1,122 @@
+import {
+  createAdminClient,
+  createClient,
+} from '@tuturuuu/supabase/next/server';
+import type { TypedSupabaseClient } from '@tuturuuu/supabase/types';
+import type { WorkspaceUser } from '@tuturuuu/types/primitives/WorkspaceUser';
+import { resolveWorkspaceId } from './constants';
+import { verifyWorkspaceMembershipType } from './workspace-helper';
+
+export interface WorkspaceUserLink {
+  platform_user_id: string;
+  virtual_user_id: string;
+  ws_id: string;
+  created_at: string;
+  workspace_users?: WorkspaceUser;
+}
+
+const LINK_SELECT =
+  'platform_user_id, virtual_user_id, ws_id, created_at, workspace_users!virtual_user_id(*)';
+
+type LinkRow = {
+  platform_user_id: string;
+  virtual_user_id: string;
+  ws_id: string;
+  created_at: string;
+  workspace_users?: unknown;
+};
+
+function toLink(row: LinkRow): WorkspaceUserLink {
+  const linkedData = row.workspace_users;
+  return {
+    platform_user_id: row.platform_user_id,
+    virtual_user_id: row.virtual_user_id,
+    ws_id: row.ws_id,
+    created_at: row.created_at,
+    ...(linkedData ? { workspace_users: linkedData as WorkspaceUser } : {}),
+  };
+}
+
+/**
+ * Resolves the workspace-user link for an EXPLICIT platform user id.
+ *
+ * `getCurrentWorkspaceUser` (user-helper) resolves the actor from Supabase auth
+ * and then delegates here. Satellite apps must not do that: they resolve the
+ * actor from Tuturuuu app-session auth (`getSatelliteAppSessionUser`) and pass
+ * the id in, which is why this lives outside `user-helper` — the internal-app-auth
+ * guard forbids registered apps from importing that module.
+ */
+export async function getWorkspaceUserLinkForUser(
+  wsId: string,
+  userId: string,
+  options: {
+    authorizationClient?: TypedSupabaseClient;
+    autoRepair?: boolean;
+  } = {}
+): Promise<WorkspaceUserLink | null> {
+  const { authorizationClient, autoRepair = true } = options;
+  if (!userId) return null;
+
+  const supabase = authorizationClient ?? (await createClient());
+  const resolvedWsId = resolveWorkspaceId(wsId);
+
+  const { data: workspaceUser } = await supabase
+    .from('workspace_user_linked_users')
+    .select(LINK_SELECT)
+    .eq('platform_user_id', userId)
+    .eq('ws_id', resolvedWsId)
+    .limit(1)
+    .maybeSingle();
+
+  if (workspaceUser) return toLink(workspaceUser as LinkRow);
+
+  if (!autoRepair) return null;
+
+  const membership = await verifyWorkspaceMembershipType({
+    wsId: resolvedWsId,
+    userId,
+    supabase,
+    requiredType: 'MEMBER',
+  });
+
+  if (!membership.ok) return null;
+
+  try {
+    const sbAdmin = await createAdminClient();
+    // Note: ensure_workspace_user_link is defined in migration 20260112060000.
+    // IMPORTANT: must use .bind() to preserve the Supabase client's `this` context.
+    const rpc = sbAdmin.rpc.bind(sbAdmin) as unknown as (
+      fn: string,
+      args: Record<string, unknown>
+    ) => Promise<{ error: Error | null }>;
+    const { error: repairError } = await rpc('ensure_workspace_user_link', {
+      target_user_id: userId,
+      target_ws_id: resolvedWsId,
+    });
+
+    if (repairError) {
+      console.error(
+        '[getWorkspaceUserLinkForUser] Failed to auto-repair workspace user link:',
+        repairError
+      );
+      return null;
+    }
+
+    const { data: repairedUser } = await supabase
+      .from('workspace_user_linked_users')
+      .select(LINK_SELECT)
+      .eq('platform_user_id', userId)
+      .eq('ws_id', resolvedWsId)
+      .limit(1)
+      .maybeSingle();
+
+    if (repairedUser) return toLink(repairedUser as LinkRow);
+  } catch (err) {
+    console.error(
+      '[getWorkspaceUserLinkForUser] Error during auto-repair:',
+      err
+    );
+  }
+
+  return null;
+}

package/src/yjs-helper.ts

@@ -1,5 +1,5 @@
 import type { JSONContent } from '@tiptap/react';
-import { Node as ProseMirrorNode, type Schema } from 'prosemirror-model';
+import type { Schema } from 'prosemirror-model';
 import * as Y from 'yjs';
 
 const PROSEMIRROR_FRAGMENT_NAME = 'prosemirror';
@@ -179,7 +179,7 @@ function validateJsonContent(
     return jsonContent;
   }
 
-  return ProseMirrorNode.fromJSON(schema, jsonContent).toJSON() as JSONContent;
+  return schema.nodeFromJSON(jsonContent).toJSON() as JSONContent;
 }
 
 export function convertJsonContentToYjsState(