@tuturuuu/utils 0.13.0 → 0.15.1

package/src/next-config.test.ts

@@ -1,3 +1,4 @@
+import { tryToParsePath } from 'next/dist/lib/try-to-parse-path';
 import { describe, expect, it } from 'vitest';
 import {
   createTuturuuuNextConfig,
@@ -40,6 +41,97 @@ describe('createTuturuuuNextConfig', () => {
     });
   });
 
+  it('protects responses from framing by default', async () => {
+    const config = createTuturuuuNextConfig();
+
+    await expect(config.headers?.()).resolves.toEqual([
+      {
+        source:
+          '/:path((?!api/v1/workspaces/[^/]+/external-projects/assets/[^/]+/webgl(?:/|$)).*)',
+        headers: [
+          {
+            key: 'Content-Security-Policy',
+            value: "frame-ancestors 'none'",
+          },
+          {
+            key: 'X-Frame-Options',
+            value: 'DENY',
+          },
+        ],
+      },
+    ]);
+  });
+
+  it('preserves app-specific response headers after shared security headers', async () => {
+    const config = createTuturuuuNextConfig({
+      async headers() {
+        return [
+          {
+            source: '/login',
+            headers: [
+              {
+                key: 'Cache-Control',
+                value: 'public, max-age=0, must-revalidate',
+              },
+              {
+                key: 'X-Robots-Tag',
+                value: 'noindex, nofollow',
+              },
+            ],
+          },
+        ];
+      },
+    });
+
+    const headers = await config.headers?.();
+
+    expect(headers).toHaveLength(2);
+    expect(headers?.[1]).toEqual({
+      source: '/login',
+      headers: [
+        {
+          key: 'Cache-Control',
+          value: 'public, max-age=0, must-revalidate',
+        },
+        {
+          key: 'X-Robots-Tag',
+          value: 'noindex, nofollow',
+        },
+      ],
+    });
+  });
+
+  it('exempts only the sandboxed CMS WebGL asset route from anti-framing headers', async () => {
+    const config = createTuturuuuNextConfig();
+    const [antiFramingRule] = (await config.headers?.()) ?? [];
+    const parsedPath = tryToParsePath(antiFramingRule?.source ?? '');
+
+    expect(parsedPath.error).toBeUndefined();
+    expect(parsedPath.regexStr).toBeDefined();
+
+    const routePattern = new RegExp(parsedPath.regexStr ?? '');
+
+    expect(routePattern.test('/')).toBe(true);
+    expect(routePattern.test('/login')).toBe(true);
+    expect(routePattern.test('/en/workspace')).toBe(true);
+    expect(routePattern.test('/api/billing/workspace/invoice')).toBe(true);
+    expect(
+      routePattern.test(
+        '/api/v1/workspaces/workspace-id/external-projects/assets/asset-id/webgl/index.html'
+      )
+    ).toBe(false);
+    expect(
+      routePattern.test(
+        '/api/v1/workspaces/workspace-id/external-projects/assets/asset-id/webgl'
+      )
+    ).toBe(false);
+    expect(
+      routePattern.test(
+        '/api/v1/workspaces/workspace-id/external-projects/assets/asset-id/webgl-preview'
+      )
+    ).toBe(true);
+  });
+
   it('allows the exact worktree-prefixed Portless host for Next dev assets', () => {
     const originalPortlessUrl = process.env.PORTLESS_URL;
 

package/src/next-config.ts

@@ -33,6 +33,20 @@ export const TUTURUUU_NEXT_IMAGE_REMOTE_PATTERNS = [
   },
 ] satisfies NextImageRemotePattern[];
 
+const TUTURUUU_ANTI_FRAMING_SOURCE =
+  '/:path((?!api/v1/workspaces/[^/]+/external-projects/assets/[^/]+/webgl(?:/|$)).*)';
+
+const TUTURUUU_ANTI_FRAMING_HEADERS = [
+  {
+    key: 'Content-Security-Policy',
+    value: "frame-ancestors 'none'",
+  },
+  {
+    key: 'X-Frame-Options',
+    value: 'DENY',
+  },
+];
+
 function mergeStringArrays(
   first: readonly string[] | undefined,
   second: readonly string[] | undefined
@@ -107,6 +121,15 @@ export function createTuturuuuNextConfig(config: NextConfig = {}): NextConfig {
         experimentalConfig.optimizePackageImports
       ),
     },
+    async headers() {
+      return [
+        {
+          source: TUTURUUU_ANTI_FRAMING_SOURCE,
+          headers: TUTURUUU_ANTI_FRAMING_HEADERS,
+        },
+        ...((await config.headers?.()) ?? []),
+      ];
+    },
   };
 }
 

package/src/platform-release.test.ts

@@ -7,10 +7,10 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.18.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.22.0'); // x-release-please-version
   });
 
-  it('normalizes generated metadata and derives a short hash', () => {
+  it('preserves the source timestamp in builtAt and derives a short hash', () => {
     expect(
       normalizePlatformBuildMetadata({
         builtAt: '2026-05-27T10:00:00.000Z',

package/src/platform-release.ts

@@ -1,8 +1,9 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.18.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.22.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
+  /** ISO timestamp of the source commit used for the build, not deployment time. */
   builtAt?: string | null;
   commitHash?: string | null;
   commitMessage?: string | null;
@@ -14,6 +15,7 @@ export type PlatformBuildMetadataInput = {
 };
 
 export type PlatformBuildMetadata = {
+  /** ISO timestamp of the source commit used for the build, not deployment time. */
   builtAt: string;
   commitHash: string;
   commitMessage: string;

package/src/portless.ts

@@ -10,6 +10,8 @@ export const TUTURUUU_PORTLESS_APP_ORIGINS = {
   calendar: `https://calendar.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   chat: `https://chat.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   cms: `https://cms.${TUTURUUU_PORTLESS_ROOT_HOST}`,
+  contacts: `https://contacts.${TUTURUUU_PORTLESS_ROOT_HOST}`,
+  docs: `https://docs.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   drive: `https://drive.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   external: `https://external.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   finance: `https://finance.${TUTURUUU_PORTLESS_ROOT_HOST}`,
@@ -22,6 +24,7 @@ export const TUTURUUU_PORTLESS_APP_ORIGINS = {
   meet: `https://meet.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   mind: `https://mind.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   nova: `https://nova.${TUTURUUU_PORTLESS_ROOT_HOST}`,
+  pay: `https://pay.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   platform: TUTURUUU_PORTLESS_ROOT_ORIGIN,
   playground: `https://playground.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   qr: `https://qr.${TUTURUUU_PORTLESS_ROOT_HOST}`,

package/src/shared-cookie.test.ts

@@ -0,0 +1,114 @@
+import { describe, expect, it } from 'vitest';
+import {
+  getHostOnlyCookieOptions,
+  getSharedAndHostOnlyCookieDeleteOptions,
+  getTuturuuuSharedCookieOptions,
+  resolveTuturuuuSharedCookieDomain,
+} from './shared-cookie';
+
+describe('shared Tuturuuu cookie helpers', () => {
+  it('resolves production root and subdomains to the parent domain', () => {
+    expect(
+      resolveTuturuuuSharedCookieDomain('https://tuturuuu.com')?.cookieDomain
+    ).toBe('.tuturuuu.com');
+    expect(
+      resolveTuturuuuSharedCookieDomain('https://tasks.tuturuuu.com')
+    ).toMatchObject({
+      cookieDomain: '.tuturuuu.com',
+      secure: true,
+    });
+  });
+
+  it('resolves local first-party subdomains without Secure cookies', () => {
+    expect(
+      resolveTuturuuuSharedCookieDomain('https://tasks.tuturuuu.localhost')
+    ).toMatchObject({
+      cookieDomain: '.tuturuuu.localhost',
+      secure: false,
+    });
+  });
+
+  it('uses forwarded host headers for server requests', () => {
+    const request = new Request('http://internal.localhost/api', {
+      headers: {
+        'x-forwarded-host': 'calendar.tuturuuu.com',
+        'x-forwarded-proto': 'https',
+      },
+    });
+
+    expect(resolveTuturuuuSharedCookieDomain(request)).toMatchObject({
+      cookieDomain: '.tuturuuu.com',
+      secure: true,
+    });
+  });
+
+  it('does not share cookies on preview, localhost, or custom domains', () => {
+    expect(
+      resolveTuturuuuSharedCookieDomain('https://tuturuuu-git-main.vercel.app')
+    ).toBe(null);
+    expect(resolveTuturuuuSharedCookieDomain('http://localhost:7803')).toBe(
+      null
+    );
+    expect(resolveTuturuuuSharedCookieDomain('https://nova.ai.vn')).toBe(null);
+  });
+
+  it('applies shared options only when the current host is first-party', () => {
+    expect(
+      getTuturuuuSharedCookieOptions(
+        { maxAge: 60, path: '/', sameSite: 'lax' as const },
+        'https://finance.tuturuuu.com'
+      )
+    ).toEqual({
+      domain: '.tuturuuu.com',
+      maxAge: 60,
+      path: '/',
+      sameSite: 'lax',
+      secure: true,
+    });
+    expect(
+      getTuturuuuSharedCookieOptions(
+        { maxAge: 60, path: '/', sameSite: 'lax' as const },
+        'https://rewise.me'
+      )
+    ).toEqual({
+      maxAge: 60,
+      path: '/',
+      sameSite: 'lax',
+    });
+  });
+
+  it('returns host-only and shared delete options when a shared domain exists', () => {
+    expect(
+      getSharedAndHostOnlyCookieDeleteOptions(
+        { path: '/', sameSite: 'lax' as const },
+        'https://drive.tuturuuu.com'
+      )
+    ).toEqual([
+      {
+        maxAge: 0,
+        path: '/',
+        sameSite: 'lax',
+      },
+      {
+        domain: '.tuturuuu.com',
+        maxAge: 0,
+        path: '/',
+        sameSite: 'lax',
+        secure: true,
+      },
+    ]);
+  });
+
+  it('strips domains from host-only options', () => {
+    expect(
+      getHostOnlyCookieOptions({
+        domain: '.tuturuuu.com',
+        maxAge: 0,
+        path: '/',
+      })
+    ).toEqual({
+      maxAge: 0,
+      path: '/',
+    });
+  });
+});

package/src/shared-cookie.ts

@@ -0,0 +1,235 @@
+export interface TuturuuuSharedCookieDomain {
+  cookieDomain: '.tuturuuu.com' | '.tuturuuu.localhost';
+  hostname: 'tuturuuu.com' | 'tuturuuu.localhost';
+  secure: boolean;
+}
+
+export type CookieOptionsLike = {
+  domain?: string;
+  expires?: Date;
+  maxAge?: number;
+  path?: string;
+  sameSite?: boolean | 'lax' | 'none' | 'strict';
+  secure?: boolean;
+};
+
+type HeaderReader =
+  | Headers
+  | Pick<Headers, 'get'>
+  | Record<string, string | null | undefined>;
+
+type CookieSource =
+  | URL
+  | string
+  | {
+      headers?: HeaderReader;
+      url?: string;
+    }
+  | null
+  | undefined;
+
+export const TUTURUUU_SHARED_COOKIE_DOMAINS = [
+  {
+    cookieDomain: '.tuturuuu.com',
+    hostname: 'tuturuuu.com',
+    secure: true,
+  },
+  {
+    cookieDomain: '.tuturuuu.localhost',
+    hostname: 'tuturuuu.localhost',
+    secure: false,
+  },
+] as const satisfies readonly TuturuuuSharedCookieDomain[];
+
+const ENV_APP_URL_KEYS = [
+  'PORTLESS_URL',
+  'NEXT_PUBLIC_APP_URL',
+  'NEXT_PUBLIC_WEB_APP_URL',
+  'WEB_APP_URL',
+  'VERCEL_URL',
+] as const;
+
+function normalizeUrlLike(value: string | URL | null | undefined) {
+  if (!value) return null;
+
+  if (value instanceof URL) return value;
+
+  try {
+    return new URL(value);
+  } catch {
+    try {
+      return new URL(`https://${value}`);
+    } catch {
+      return null;
+    }
+  }
+}
+
+function readHeader(headers: HeaderReader | undefined, name: string) {
+  if (!headers) return null;
+
+  if ('get' in headers && typeof headers.get === 'function') {
+    return headers.get(name);
+  }
+
+  const lowerName = name.toLowerCase();
+  const record = headers as Record<string, string | null | undefined>;
+
+  return record[name] ?? record[lowerName] ?? null;
+}
+
+function extractForwardedValue(value: string | null | undefined) {
+  return value
+    ?.split(',')
+    .map((entry) => entry.trim())
+    .find(Boolean);
+}
+
+function configuredAppUrl() {
+  if (typeof window !== 'undefined' && window.location?.href) {
+    return window.location.href;
+  }
+
+  for (const key of ENV_APP_URL_KEYS) {
+    const value = process.env[key];
+    if (value) return value;
+  }
+
+  return null;
+}
+
+function resolveUrlFromRequestLike(
+  source: Extract<CookieSource, { headers?: HeaderReader; url?: string }>
+) {
+  const forwardedHost =
+    extractForwardedValue(readHeader(source.headers, 'x-forwarded-host')) ??
+    extractForwardedValue(readHeader(source.headers, 'host'));
+
+  if (forwardedHost && !/[\r\n]/u.test(forwardedHost)) {
+    const forwardedProto = extractForwardedValue(
+      readHeader(source.headers, 'x-forwarded-proto')
+    );
+    const fallbackProtocol = normalizeUrlLike(source.url)?.protocol ?? 'https:';
+    const protocol =
+      forwardedProto?.replace(/:$/u, '') === 'http'
+        ? 'http:'
+        : fallbackProtocol === 'http:'
+          ? 'http:'
+          : 'https:';
+
+    return normalizeUrlLike(`${protocol}//${forwardedHost}`);
+  }
+
+  return normalizeUrlLike(source.url);
+}
+
+function resolveCookieUrl(source: CookieSource) {
+  if (!source) {
+    return normalizeUrlLike(configuredAppUrl());
+  }
+
+  if (typeof source === 'string' || source instanceof URL) {
+    return normalizeUrlLike(source);
+  }
+
+  return resolveUrlFromRequestLike(source);
+}
+
+function domainForUrl(url: string | URL | null | undefined) {
+  const parsedUrl = normalizeUrlLike(url);
+  const hostname = parsedUrl?.hostname.toLowerCase();
+
+  if (!hostname) return null;
+
+  return (
+    TUTURUUU_SHARED_COOKIE_DOMAINS.find(
+      (entry) =>
+        hostname === entry.hostname || hostname.endsWith(`.${entry.hostname}`)
+    ) ?? null
+  );
+}
+
+function isPortlessBackendUrl(sourceUrl: URL | null) {
+  const portlessUrl = normalizeUrlLike(process.env.PORTLESS_URL);
+  const expectedPort = process.env.PORT;
+
+  if (!sourceUrl || !portlessUrl || !expectedPort) return false;
+  if (!domainForUrl(portlessUrl)) return false;
+
+  return (
+    (sourceUrl.protocol === 'http:' || sourceUrl.protocol === 'https:') &&
+    (sourceUrl.hostname === '127.0.0.1' ||
+      sourceUrl.hostname === 'localhost') &&
+    sourceUrl.port === expectedPort
+  );
+}
+
+export function resolveTuturuuuSharedCookieDomain(source?: CookieSource) {
+  const sourceUrl = resolveCookieUrl(source);
+  const sourceDomain = domainForUrl(sourceUrl);
+
+  if (sourceDomain) return sourceDomain;
+
+  if (isPortlessBackendUrl(sourceUrl)) {
+    return domainForUrl(process.env.PORTLESS_URL);
+  }
+
+  return null;
+}
+
+export function getTuturuuuSharedCookieOptions<
+  TOptions extends CookieOptionsLike,
+>(options: TOptions, source?: CookieSource): TOptions {
+  const sharedDomain = resolveTuturuuuSharedCookieDomain(source);
+  const nextOptions = {
+    ...options,
+    path: options.path ?? '/',
+  };
+
+  if (!sharedDomain) return nextOptions;
+
+  return {
+    ...nextOptions,
+    domain: sharedDomain.cookieDomain,
+    secure: sharedDomain.secure,
+  };
+}
+
+export function getTuturuuuBrowserSharedCookieOptions<
+  TOptions extends CookieOptionsLike,
+>(options: TOptions): TOptions {
+  return getTuturuuuSharedCookieOptions(options);
+}
+
+export function getHostOnlyCookieOptions<TOptions extends CookieOptionsLike>(
+  options: TOptions
+): TOptions {
+  const { domain: _domain, ...hostOnlyOptions } = options;
+
+  return {
+    ...hostOnlyOptions,
+    path: options.path ?? '/',
+  } as TOptions;
+}
+
+export function getSharedAndHostOnlyCookieDeleteOptions<
+  TOptions extends CookieOptionsLike,
+>(options: TOptions, source?: CookieSource): TOptions[] {
+  const hostOnlyOptions = getHostOnlyCookieOptions({
+    ...options,
+    maxAge: 0,
+    path: options.path ?? '/',
+  });
+  const sharedOptions = getTuturuuuSharedCookieOptions(
+    {
+      ...options,
+      maxAge: 0,
+      path: options.path ?? '/',
+    },
+    source
+  );
+
+  if (!sharedOptions.domain) return [hostOnlyOptions];
+
+  return [hostOnlyOptions, sharedOptions];
+}

package/src/topic-announcements.ts

@@ -0,0 +1 @@
+export const TOPIC_ANNOUNCEMENTS_SECRET = 'ENABLE_TOPIC_ANNOUNCEMENTS';

package/src/user-helper.ts

@@ -1,13 +1,8 @@
 import type { TypedSupabaseClient } from '@tuturuuu/supabase/next/client';
-import {
-  createAdminClient,
-  createClient,
-} from '@tuturuuu/supabase/next/server';
+import { createClient } from '@tuturuuu/supabase/next/server';
 import type { User, UserPrivateDetails } from '@tuturuuu/types';
 import type { WorkspaceUser } from '@tuturuuu/types/primitives/WorkspaceUser';
-
-import { resolveWorkspaceId } from './constants';
-import { verifyWorkspaceMembershipType } from './workspace-helper';
+import { getWorkspaceUserLinkForUser } from './workspace-user-link';
 
 async function resolveCurrentUserId(
   supabase: TypedSupabaseClient
@@ -71,98 +66,14 @@ export async function getCurrentWorkspaceUser(
   wsId: string,
   options: GetCurrentWorkspaceUserOptions = {}
 ): Promise<WorkspaceUserLink | null> {
-  const { autoRepair = true } = options;
-
   const supabase = await createClient();
   const userId = await resolveCurrentUserId(supabase as TypedSupabaseClient);
   if (!userId) return null;
 
-  const resolvedWsId = resolveWorkspaceId(wsId);
-
-  // First attempt to get the workspace user link
-  const { data: workspaceUser } = await supabase
-    .from('workspace_user_linked_users')
-    .select(
-      'platform_user_id, virtual_user_id, ws_id, created_at, workspace_users!virtual_user_id(*)'
-    )
-    .eq('platform_user_id', userId)
-    .eq('ws_id', resolvedWsId)
-    .limit(1)
-    .maybeSingle();
-
-  // If found, return it
-  if (workspaceUser) {
-    const linkedData = workspaceUser.workspace_users;
-    return {
-      platform_user_id: workspaceUser.platform_user_id,
-      virtual_user_id: workspaceUser.virtual_user_id,
-      ws_id: workspaceUser.ws_id,
-      created_at: workspaceUser.created_at,
-      ...(linkedData ? { workspace_users: linkedData as WorkspaceUser } : {}),
-    };
-  }
-
-  // If not found and auto-repair is disabled, return null
-  if (!autoRepair) return null;
-
-  const membership = await verifyWorkspaceMembershipType({
-    wsId: resolvedWsId,
-    userId,
-    supabase,
-    requiredType: 'MEMBER',
-  });
-
-  if (!membership.ok) return null;
-
-  // Try to repair the missing link using the RPC function
-  try {
-    const sbAdmin = await createAdminClient();
-    // Note: ensure_workspace_user_link is defined in migration 20260112060000
-    // Using type assertion since RPC types are generated after migration is applied
-    // IMPORTANT: Must use .bind() to preserve the Supabase client's `this` context
-    const rpc = sbAdmin.rpc.bind(sbAdmin) as unknown as (
-      fn: string,
-      args: Record<string, unknown>
-    ) => Promise<{ error: Error | null }>;
-    const { error: repairError } = await rpc('ensure_workspace_user_link', {
-      target_user_id: userId,
-      target_ws_id: resolvedWsId,
-    });
-
-    if (repairError) {
-      console.error(
-        '[getCurrentWorkspaceUser] Failed to auto-repair workspace user link:',
-        repairError
-      );
-      return null;
-    }
-
-    // Fetch the newly created link
-    const { data: repairedUser } = await supabase
-      .from('workspace_user_linked_users')
-      .select(
-        'platform_user_id, virtual_user_id, ws_id, created_at, workspace_users!virtual_user_id(*)'
-      )
-      .eq('platform_user_id', userId)
-      .eq('ws_id', resolvedWsId)
-      .limit(1)
-      .maybeSingle();
-
-    if (repairedUser) {
-      const linkedData = repairedUser.workspace_users;
-      return {
-        platform_user_id: repairedUser.platform_user_id,
-        virtual_user_id: repairedUser.virtual_user_id,
-        ws_id: repairedUser.ws_id,
-        created_at: repairedUser.created_at,
-        ...(linkedData ? { workspace_users: linkedData as WorkspaceUser } : {}),
-      };
-    }
-  } catch (err) {
-    console.error('[getCurrentWorkspaceUser] Error during auto-repair:', err);
-  }
-
-  return null;
+  // The link lookup + auto-repair lives in workspace-user-link so satellite apps
+  // can reuse it with an app-session actor: the internal-app-auth guard forbids
+  // registered apps from importing this module (it resolves actors via Supabase).
+  return getWorkspaceUserLinkForUser(wsId, userId, options);
 }
 
 export async function getCurrentUser() {