@tuturuuu/utils 0.33.2 → 0.34.0

package/src/offline-download-guard.ts

@@ -0,0 +1,160 @@
+import { verifyTurnstileToken } from '@tuturuuu/turnstile/server';
+import { Ratelimit } from '@upstash/ratelimit';
+import type { NextRequest } from 'next/server';
+import { NextResponse } from 'next/server';
+import { extractIPFromRequest } from './abuse-protection/edge';
+import { getCachedTrustEntries } from './abuse-protection/edge-trust';
+import {
+  buildProxySessionSubjectKey,
+  getProxySessionSubjectKeyFromCookieHeader,
+} from './api-proxy-guard';
+import {
+  getUpstashRatelimitRedisClient,
+  getUpstashRestRedisClient,
+} from './upstash-rest';
+
+export const OFFLINE_DOWNLOAD_HEADER = 'x-tuturuuu-offline-download';
+const CLEARANCE_SECONDS = 15 * 60;
+const READ_PATH =
+  /^\/api\/(?:v1\/)?workspaces\/[^/]+\/(?:finance|inventory|transactions|wallets|tags|members|products|product-categories|product-units|product-warehouses|tasks|task-boards|boards|labels|task-projects|task-initiatives|habit-trackers|habits|calendar)(?:[-/]|$)/u;
+const USER_READ_PATH =
+  /^\/api\/v1\/(?:users\/me\/tasks|calendar|users\/calendar-settings)(?:\/|$)/u;
+
+export function isOfflineCapableRead(
+  request: Pick<NextRequest, 'method' | 'url'>
+) {
+  if (request.method !== 'GET' && request.method !== 'HEAD') return false;
+  const pathname = new URL(request.url).pathname.replace(
+    /^\/api\/v1\/mobile-calendar(?=\/api\/)/u,
+    ''
+  );
+  return (
+    READ_PATH.test(pathname) ||
+    USER_READ_PATH.test(pathname) ||
+    /^\/api\/v1\/exchange-rates\/?$/u.test(pathname)
+  );
+}
+
+function unavailable() {
+  return NextResponse.json(
+    {
+      message:
+        'Download protection is temporarily unavailable. Try again later.',
+    },
+    {
+      status: 503,
+      headers: { 'Cache-Control': 'no-store', 'Retry-After': '30' },
+    }
+  );
+}
+
+function challenge() {
+  return NextResponse.json(
+    {
+      code: 'ABUSE_CHALLENGE_REQUIRED',
+      message: 'Additional verification is required before retrying.',
+    },
+    {
+      status: 403,
+      headers: {
+        'Cache-Control': 'no-store',
+        'X-Abuse-Challenge': 'turnstile',
+      },
+    }
+  );
+}
+
+/** Additional protection is scoped to explicitly marked offline bulk downloads.
+ * Ordinary enterprise reads retain their existing API/auth protections.
+ * Clearance never satisfies authentication, authorization, IP blocks, required
+ * MFA, or either rate-limit budget. Runtime failures remain fail-closed. */
+export async function guardOfflineDownloadRequest(request: NextRequest) {
+  if (!isOfflineCapableRead(request) || process.env.NODE_ENV !== 'production')
+    return null;
+  const bulk = request.headers.get(OFFLINE_DOWNLOAD_HEADER) === '1';
+  if (!bulk) return null;
+  if (process.env.OFFLINE_DOWNLOAD_PROTECTION_ENABLED !== 'true') {
+    // Keep baseline API/auth protections while this additional protection is
+    // unprovisioned. Offline prefetch is unavailable until explicitly enabled.
+    return unavailable();
+  }
+  try {
+    const redis = await getUpstashRestRedisClient();
+    const limiterRedis = await getUpstashRatelimitRedisClient();
+    if (!redis || !limiterRedis) return unavailable();
+    const bearer = request.headers
+      .get('authorization')
+      ?.match(/^Bearer\s+([^\s]+)$/i)?.[1];
+    const sessionKey = bearer
+      ? await buildProxySessionSubjectKey('bearer', bearer)
+      : await getProxySessionSubjectKeyFromCookieHeader(
+          request.headers.get('cookie')
+        );
+    const ip = extractIPFromRequest(request.headers);
+    // IP remains bounded even when a caller rotates unverified bearer values.
+    // Internal authenticated gateways may lack a client IP. Never combine
+    // their unrelated sessions into a shared unknown-IP bucket. Public ingress
+    // still supplies a real IP, retaining the rotating-token budget.
+    if (ip === 'unknown' && !sessionKey) return unavailable();
+    const subjects = [
+      ...(ip !== 'unknown'
+        ? [{ key: `ip:${ip}`, minute: 1200, hour: 30000 }]
+        : []),
+      ...(sessionKey ? [{ key: sessionKey, minute: 600, hour: 12000 }] : []),
+    ];
+    for (const subject of subjects) {
+      for (const [window, limit] of [
+        ['1 m', subject.minute],
+        ['1 h', subject.hour],
+      ] as const) {
+        const limiter = new Ratelimit({
+          redis: limiterRedis,
+          limiter: Ratelimit.slidingWindow(limit, window),
+          prefix: `offline:read:${window}`,
+        });
+        const result = await limiter.limit(subject.key);
+        if (!result.success) {
+          return NextResponse.json(
+            {
+              message:
+                'Read limit reached. Try again after the indicated delay.',
+            },
+            {
+              status: 429,
+              headers: {
+                'Cache-Control': 'no-store',
+                'Retry-After': `${Math.max(1, Math.ceil((result.reset - Date.now()) / 1000))}`,
+                'X-RateLimit-Policy': 'offline-capable-read',
+              },
+            }
+          );
+        }
+      }
+    }
+    if (!sessionKey)
+      return NextResponse.json(
+        { message: 'Authentication required' },
+        { status: 401 }
+      );
+    const trust = (await getCachedTrustEntries([sessionKey])).get(sessionKey);
+    // Reuse established account trust. This check does not write trust markers.
+    if (trust?.verified && (trust.m > 1 || trust.mode === 'unlimited'))
+      return null;
+    const clearanceKey = `offline:clearance:${sessionKey}`;
+    if (await redis.get(clearanceKey)) return null;
+    const token = request.headers.get('x-tuturuuu-turnstile-token');
+    if (!token) return challenge();
+    try {
+      await verifyTurnstileToken(request, token, {
+        remoteIp: ip === 'unknown' ? undefined : ip,
+      });
+    } catch {
+      return challenge();
+    }
+    await redis.set(clearanceKey, 'passed', { ex: CLEARANCE_SECONDS });
+    return null;
+  } catch {
+    // A distributed guard must not silently fall back to per-process limits.
+    return unavailable();
+  }
+}

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.64.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.66.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.64.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.66.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */

package/src/playground-schema.test.ts

@@ -0,0 +1,119 @@
+import { expect, it } from 'vitest';
+import {
+  PlaygroundDelta,
+  PlaygroundFiles,
+  PlaygroundJob,
+  PlaygroundRunnerExport,
+} from './playground-schema';
+
+it.each([
+  '../secret',
+  'a/../../secret',
+  '/absolute',
+  'node_modules/pkg.js',
+  'a/.git/config',
+  'a//b',
+  'a\\b',
+])('rejects unsafe path %s', (path) =>
+  expect(PlaygroundFiles.safeParse([{ path, content: 'x' }]).success).toBe(
+    false
+  )
+);
+it('enforces UTF-8 byte limits rather than only character counts', () =>
+  expect(
+    PlaygroundFiles.safeParse([{ path: 'a', content: 'ấ'.repeat(100000) }])
+      .success
+  ).toBe(false));
+it('rejects inconsistent delta inventories', () => {
+  expect(
+    PlaygroundDelta.safeParse({
+      revision: 1,
+      command: 'run',
+      paths: ['a', 'a/b'],
+      files: [],
+    }).success
+  ).toBe(false);
+  expect(
+    PlaygroundDelta.safeParse({
+      revision: 1,
+      command: 'run',
+      paths: ['a'],
+      files: [{ path: 'b', content: 'x' }],
+    }).success
+  ).toBe(false);
+});
+it('bounds preview requests to approved ports and paths', () => {
+  const job = {
+    projectId: '00000000-0000-4000-8000-000000000001',
+    revision: 0,
+    language: 'python',
+    operation: 'preview',
+    port: 22,
+    path: '/',
+  };
+  expect(PlaygroundJob.safeParse(job).success).toBe(false);
+  expect(
+    PlaygroundJob.safeParse({ ...job, port: 3000, path: '/\r\nHost:metadata' })
+      .success
+  ).toBe(false);
+});
+
+it('rejects file/directory collisions with intervening sorted siblings', () => {
+  const paths = ['a', 'a-b', 'a/b'];
+  expect(
+    PlaygroundFiles.safeParse(paths.map((path) => ({ path, content: 'x' })))
+      .success
+  ).toBe(false);
+  expect(
+    PlaygroundDelta.safeParse({ revision: 1, command: 'run', paths, files: [] })
+      .success
+  ).toBe(false);
+});
+
+it('rejects conflicting runner inventory ancestors', () => {
+  expect(
+    PlaygroundRunnerExport.safeParse({
+      revision: 1,
+      paths: ['a', 'a-b', 'a/b'],
+      files: [],
+      baseline: {},
+    }).success
+  ).toBe(false);
+});
+
+it.each([
+  '/../secret',
+  '/a/./b',
+  '/a//b',
+  '//other-host',
+  '/%2e%2e/secret',
+  '/a%2f../secret',
+  '/a\\b',
+  '/%',
+])('rejects unsafe preview path %s', (path) => {
+  expect(
+    PlaygroundJob.safeParse({
+      projectId: '00000000-0000-4000-8000-000000000001',
+      revision: 0,
+      language: 'python',
+      operation: 'preview',
+      port: 3000,
+      path,
+    }).success
+  ).toBe(false);
+});
+it.each(['/', '/index.html', '/assets/app.js?version=1'])(
+  'accepts ordinary preview path %s',
+  (path) => {
+    expect(
+      PlaygroundJob.safeParse({
+        projectId: '00000000-0000-4000-8000-000000000001',
+        revision: 0,
+        language: 'python',
+        operation: 'preview',
+        port: 3000,
+        path,
+      }).success
+    ).toBe(true);
+  }
+);

package/src/playground-schema.ts

@@ -0,0 +1,173 @@
+import { PLAYGROUND_LANGUAGES } from '@tuturuuu/types/primitives/playgrounds';
+import { z } from 'zod';
+
+function hasDirectoryConflict(paths: string[]) {
+  const inventory = new Set(paths);
+  return paths.some((path) => {
+    const pieces = path.split('/');
+    return pieces
+      .slice(0, -1)
+      .some((_, index) => inventory.has(pieces.slice(0, index + 1).join('/')));
+  });
+}
+
+function validPreviewPath(path: string) {
+  if (!path.startsWith('/') || /[\r\n\0\\]/.test(path)) return false;
+  try {
+    const pathname = decodeURIComponent(path.split(/[?#]/, 1)[0]!);
+    return (
+      pathname === '/' ||
+      (!/[\r\n\0\\]/.test(pathname) &&
+        pathname
+          .slice(1)
+          .split('/')
+          .every((part) => part !== '' && part !== '.' && part !== '..'))
+    );
+  } catch {
+    return false;
+  }
+}
+
+export const PLAYGROUND_BYTES = 2 * 1024 * 1024;
+export const PlaygroundPath = z
+  .string()
+  .min(1)
+  .max(240)
+  .refine(
+    (path) =>
+      path
+        .split('/')
+        .every(
+          (part) =>
+            /^[a-zA-Z0-9_.@+-]+$/.test(part) && part !== '.' && part !== '..'
+        ) &&
+      !path
+        .split('/')
+        .some((part) =>
+          ['node_modules', '.git', '__pycache__', 'target', '.venv'].includes(
+            part
+          )
+        )
+  );
+export const PlaygroundFiles = z
+  .array(
+    z
+      .object({
+        path: PlaygroundPath,
+        content: z
+          .string()
+          .max(256 * 1024)
+          .refine(
+            (value) =>
+              !value.includes('\0') &&
+              new TextEncoder().encode(value).byteLength <= 256 * 1024
+          ),
+      })
+      .strict()
+  )
+  .max(128)
+  .superRefine((files, ctx) => {
+    if (new Set(files.map((file) => file.path)).size !== files.length)
+      ctx.addIssue({ code: 'custom', message: 'Duplicate file paths' });
+    if (
+      files.reduce(
+        (size, file) => size + new TextEncoder().encode(file.content).length,
+        0
+      ) > PLAYGROUND_BYTES
+    )
+      ctx.addIssue({
+        code: 'custom',
+        message: 'Project exceeds storage limit',
+      });
+    const paths = files.map((file) => file.path).sort();
+    if (hasDirectoryConflict(paths))
+      ctx.addIssue({
+        code: 'custom',
+        message: 'File conflicts with directory',
+      });
+  });
+export const PlaygroundCreate = z
+  .object({
+    name: z.string().trim().min(1).max(80),
+    language: z.enum(PLAYGROUND_LANGUAGES),
+  })
+  .strict();
+export const PlaygroundSave = z
+  .object({
+    revision: z.number().int().nonnegative(),
+    files: PlaygroundFiles,
+    command: z
+      .string()
+      .min(1)
+      .max(4096)
+      .refine((value) => !value.includes('\0')),
+  })
+  .strict();
+export const PlaygroundJob = z
+  .object({
+    projectId: z.guid(),
+    revision: z.number().int().nonnegative(),
+    language: z.enum(PLAYGROUND_LANGUAGES),
+    operation: z.enum(['run', 'stop', 'preview']),
+    files: PlaygroundFiles.optional(),
+    command: z.string().max(4096).optional(),
+    stdin: z.string().max(65536).optional(),
+    port: z.number().int().min(1024).max(65535).optional(),
+    path: z.string().max(2048).optional(),
+  })
+  .strict()
+  .superRefine((job, ctx) => {
+    if (
+      job.operation === 'run' &&
+      (!job.files || !job.command || job.command.includes('\0'))
+    )
+      ctx.addIssue({ code: 'custom', message: 'Missing run payload' });
+    if (
+      job.operation === 'preview' &&
+      (!job.port || !job.path || !validPreviewPath(job.path))
+    )
+      ctx.addIssue({ code: 'custom', message: 'Invalid preview request' });
+  });
+export type PlaygroundJobPayload = z.infer<typeof PlaygroundJob>;
+
+/** Full path inventory plus changed text; unchanged file bytes never cross the callback. */
+export const PlaygroundDelta = PlaygroundSave.extend({
+  paths: z.array(PlaygroundPath).max(128),
+}).superRefine((value, ctx) => {
+  const paths = [...value.paths].sort();
+  if (
+    new Set(paths).size !== paths.length ||
+    hasDirectoryConflict(paths) ||
+    value.files.some((file) => !paths.includes(file.path))
+  )
+    ctx.addIssue({ code: 'custom', message: 'Invalid delta inventory' });
+});
+
+/** Authenticated runner export merged into the room before Drive persistence. */
+export const PlaygroundRunnerExport = z
+  .object({
+    revision: z.number().int().nonnegative(),
+    files: PlaygroundFiles,
+    paths: z.array(PlaygroundPath).max(128),
+    baseline: z.record(PlaygroundPath, z.string().regex(/^[a-f0-9]{64}$/)),
+  })
+  .strict()
+  .refine(
+    (value) =>
+      new Set(value.paths).size === value.paths.length &&
+      !hasDirectoryConflict(value.paths) &&
+      value.files.every((file) => value.paths.includes(file.path)),
+    'Invalid runner inventory'
+  );
+
+export const PlaygroundPreviewCapability = z
+  .object({
+    aud: z.literal('tuturuuu.playground-preview'),
+    ownerId: z.guid(),
+    projectId: z.guid(),
+    port: z.number().int().min(1024).max(65535),
+    meetingId: z.guid().optional(),
+    roomId: z.guid().optional(),
+    exp: z.number().int().positive(),
+  })
+  .strict();

package/src/playground-templates.ts

@@ -0,0 +1,65 @@
+import type { PlaygroundLanguage } from '@tuturuuu/types/primitives/playgrounds';
+export const playgroundTemplates: Record<
+  PlaygroundLanguage,
+  { path: string; content: string; command: string }
+> = {
+  python: {
+    path: 'main.py',
+    content: 'print("Hello, playground!")\n',
+    command: 'python3 main.py',
+  },
+  javascript: {
+    path: 'main.js',
+    content: 'console.log("Hello, playground!");\n',
+    command: 'node main.js',
+  },
+  typescript: {
+    path: 'main.ts',
+    content: 'console.log("Hello, playground!");\n',
+    command: 'bun main.ts',
+  },
+  c: {
+    path: 'main.c',
+    content:
+      '#include <stdio.h>\nint main(void) { puts("Hello, playground!"); }\n',
+    command: 'gcc main.c -o /tmp/main && /tmp/main',
+  },
+  cpp: {
+    path: 'main.cpp',
+    content:
+      '#include <iostream>\nint main() { std::cout << "Hello, playground!\\n"; }\n',
+    command: 'g++ main.cpp -o /tmp/main && /tmp/main',
+  },
+  java: {
+    path: 'Main.java',
+    content:
+      'class Main { public static void main(String[] args) { System.out.println("Hello, playground!"); } }\n',
+    command: 'javac Main.java && java Main',
+  },
+  rust: {
+    path: 'main.rs',
+    content: 'fn main() { println!("Hello, playground!"); }\n',
+    command: 'rustc main.rs -o /tmp/main && /tmp/main',
+  },
+  go: {
+    path: 'main.go',
+    content:
+      'package main\nimport "fmt"\nfunc main() { fmt.Println("Hello, playground!") }\n',
+    command: 'go run main.go',
+  },
+  ruby: {
+    path: 'main.rb',
+    content: 'puts "Hello, playground!"\n',
+    command: 'ruby main.rb',
+  },
+  php: {
+    path: 'main.php',
+    content: '<?php echo "Hello, playground!\\n";\n',
+    command: 'php main.php',
+  },
+  shell: {
+    path: 'main.sh',
+    content: 'printf "Hello, playground!\\n"\n',
+    command: 'sh main.sh',
+  },
+};

package/src/release-note-policy-core.cjs

@@ -0,0 +1,28 @@
+const { patterns } = require('./release-note-policy.json');
+const matchers = patterns.map((pattern) => new RegExp(pattern, 'iu'));
+
+/** Omit known Git bookkeeping, never arbitrary product text containing merge. */
+function isReleaseBookkeeping(subject) {
+  const description = subject
+    .replace(/^\w+(?:\([^)]*\))?!?:\s*/u, '')
+    .replace(/^\*\*[^*]+:\*\*\s*/u, '')
+    .replace(/\s*\(#\d+\)$/u, '')
+    .replace(
+      /\s*\(\[[^\]]+\]\(https:\/\/github\.com\/tutur3u\/platform\/(?:commit|issues|pull)\/[^)]+\)\)/gu,
+      ''
+    )
+    .trim();
+  return matchers.some((pattern) => pattern.test(description));
+}
+
+function filterReleaseBookkeeping(markdown) {
+  return markdown
+    .split('\n')
+    .filter((line) => {
+      const bullet = /^\s*[-*]\s+(.+)$/u.exec(line);
+      return !bullet || !isReleaseBookkeeping(bullet[1]);
+    })
+    .join('\n');
+}
+
+module.exports = { isReleaseBookkeeping, filterReleaseBookkeeping };

package/src/release-note-policy-core.d.cts

@@ -0,0 +1,5 @@
+declare const policy: {
+  isReleaseBookkeeping(subject: string): boolean;
+  filterReleaseBookkeeping(markdown: string): string;
+};
+export = policy;

package/src/release-note-policy.json

@@ -0,0 +1,9 @@
+{
+  "patterns": [
+    "^merge (?:remote-tracking )?(?:branch(?:es)?|tag|commit) ['\"][^'\"\\n]+['\"](?: (?:and ['\"][^'\"\\n]+['\"]|of \\S+|into (?:['\"][^'\"\\n]+['\"]|\\S+)))*$",
+    "^merge pull request #\\d+ from \\S+$",
+    "^merge (?:current |latest )?(?:main|production|origin/(?:main|production|release-please--branches--\\S+))(?: (?:into|to) (?:main|production))?$",
+    "^(?:sync|synchronize) (?:current |latest )?(?:main|production)(?: (?:to|into|with|from) (?:main|production))$",
+    "^address review and integrate current main$"
+  ]
+}

package/src/release-note-policy.ts

@@ -0,0 +1,4 @@
+import policy from './release-note-policy-core.cjs';
+
+/** Filter known Git merge/sync metadata while retaining product merge features. */
+export const isReleaseBookkeeping = policy.isReleaseBookkeeping;

package/src/username-policy.json

@@ -0,0 +1,87 @@
+{
+  "common": [
+    "admin",
+    "administrator",
+    "anonymous",
+    "account",
+    "accounts",
+    "artist",
+    "artists",
+    "creator",
+    "creators",
+    "dashboard",
+    "default",
+    "everyone",
+    "example",
+    "guest",
+    "help",
+    "home",
+    "login",
+    "logout",
+    "moderator",
+    "moderation",
+    "official",
+    "owner",
+    "personal",
+    "privacy",
+    "profile",
+    "public",
+    "root",
+    "security",
+    "settings",
+    "staff",
+    "support",
+    "system",
+    "terms",
+    "test",
+    "testing",
+    "unknown",
+    "user",
+    "username",
+    "users",
+    "website",
+    "webmaster"
+  ],
+  "brands": [
+    "adobe",
+    "amazon",
+    "android",
+    "apple",
+    "chatgpt",
+    "claude",
+    "cloudflare",
+    "discord",
+    "exocorpse",
+    "facebook",
+    "github",
+    "gmail",
+    "google",
+    "instagram",
+    "linkedin",
+    "meta",
+    "microsoft",
+    "netflix",
+    "nintendo",
+    "nvidia",
+    "openai",
+    "paypal",
+    "samsung",
+    "slack",
+    "snapchat",
+    "sony",
+    "spotify",
+    "stripe",
+    "telegram",
+    "tesla",
+    "tiktok",
+    "tulletin",
+    "tulettin",
+    "tuturuuu",
+    "twitch",
+    "twitter",
+    "vercel",
+    "whatsapp",
+    "windows",
+    "youtube"
+  ]
+}

package/src/username-policy.ts

@@ -0,0 +1,18 @@
+import reserved from './username-policy.json';
+
+export const USERNAME_MIN_LENGTH = 5;
+export const USERNAME_MAX_LENGTH = 32;
+export const USERNAME_CHANGE_INTERVAL_DAYS = 14;
+export const DISPLAY_NAME_CHANGE_LIMIT = 2;
+export const DISPLAY_NAME_CHANGE_WINDOW_DAYS = 7;
+const reservedPatterns = [...reserved.common, ...reserved.brands].map(
+  (brand) =>
+    new RegExp(`^(official)?${brand}(official|support|admin|team|[0-9]+)?$`)
+);
+export function isReservedUsername(value: string) {
+  const normalized = value.toLowerCase().replaceAll('_', '');
+  return reservedPatterns.some((pattern) => pattern.test(normalized));
+}
+export function isValidNewUsername(value: string) {
+  return /^[a-z0-9][a-z0-9_]{4,31}$/.test(value) && !isReservedUsername(value);
+}