@tuturuuu/utils 0.33.3 → 0.35.0

package/src/google-calendar-import-fence.test.ts

@@ -0,0 +1,182 @@
+import type { calendar_v3 } from '@tuturuuu/google';
+import type { SupabaseClient } from '@tuturuuu/supabase';
+import { describe, expect, it, vi } from 'vitest';
+import {
+  applyGoogleImport,
+  captureGoogleImport,
+  GoogleImportFenceError,
+  replayDeferredGoogleImports,
+} from './google-calendar-import-fence';
+
+const scope = {
+  wsId: 'aaaaaaaa-aaaa-4aaa-aaaa-aaaaaaaaaaaa',
+  calendarId: 'calendar',
+  authTokenId: 'bbbbbbbb-bbbb-4bbb-bbbb-bbbbbbbbbbbb',
+};
+const capture = { ...scope, id: 'cccccccc-cccc-4ccc-cccc-cccccccccccc' };
+const result = { inserted: 0, updated: 1, deleted: 0, deferred: 0 };
+
+function fixture(providerEvent: unknown = { id: 'event', summary: 'fresh' }) {
+  const order: string[] = [];
+  const rpc = vi.fn(
+    async (
+      name: string,
+      _args: Record<string, unknown>
+    ): Promise<{ data: unknown; error: null }> => {
+      order.push(name);
+      return {
+        data:
+          name === 'list_deferred_calendar_google_imports'
+            ? ['event']
+            : name === 'capture_calendar_google_import'
+              ? capture
+              : result,
+        error: null,
+      };
+    }
+  );
+  const get = vi.fn(async () => {
+    order.push('get');
+    return { data: providerEvent };
+  });
+  const format = vi.fn(async (events: unknown[]) => events as object[]);
+  const client = { rpc } as unknown as SupabaseClient;
+  const calendarGet = vi.fn(async () => {
+    order.push('calendar-get');
+    return { data: { id: scope.calendarId, accessRole: 'reader' } };
+  });
+  const calendar = {
+    events: { get },
+    calendarList: { get: calendarGet },
+  } as unknown as calendar_v3.Calendar;
+  return { client, calendar, scope, format, order, rpc, get, calendarGet };
+}
+
+describe('guarded Google import boundaries', () => {
+  it('captures before the fresh provider read and persists before returning', async () => {
+    const f = fixture();
+    await replayDeferredGoogleImports(f);
+    expect(f.order).toEqual([
+      'list_deferred_calendar_google_imports',
+      'capture_calendar_google_import',
+      'get',
+      'apply_calendar_google_import',
+    ]);
+    expect(f.rpc.mock.calls[2]?.[1]).toEqual({
+      p_capture_id: capture.id,
+      p_events: [{ id: 'event', summary: 'fresh' }],
+      p_tombstones: [],
+    });
+  });
+  it('rejects a capture scoped to another account before any provider read', async () => {
+    const f = fixture();
+    f.rpc.mockImplementation(async (name) => ({
+      data:
+        name === 'list_deferred_calendar_google_imports'
+          ? ['event']
+          : { ...capture, authTokenId: null },
+      error: null,
+    }));
+    await expect(replayDeferredGoogleImports(f)).rejects.toBeInstanceOf(
+      GoogleImportFenceError
+    );
+    expect(f.get).not.toHaveBeenCalled();
+  });
+  it('does not apply an unexpected provider event identity', async () => {
+    const f = fixture({ id: 'another-event' });
+    await expect(replayDeferredGoogleImports(f)).rejects.toBeInstanceOf(
+      GoogleImportFenceError
+    );
+    expect(f.format).not.toHaveBeenCalled();
+    expect(f.rpc).toHaveBeenCalledTimes(2);
+  });
+  it.each([404, 410])(
+    'confirms calendar access before treating %s as a tombstone',
+    async (status) => {
+      const f = fixture();
+      f.get.mockRejectedValue({ response: { status } });
+      await replayDeferredGoogleImports(f);
+      expect(f.rpc.mock.calls[2]?.[1]).toEqual({
+        p_capture_id: capture.id,
+        p_events: [],
+        p_tombstones: ['event'],
+      });
+      expect(f.format).not.toHaveBeenCalled();
+      expect(f.calendarGet).toHaveBeenCalledWith({
+        calendarId: scope.calendarId,
+      });
+      expect(f.order).toEqual([
+        'list_deferred_calendar_google_imports',
+        'capture_calendar_google_import',
+        'calendar-get',
+        'apply_calendar_google_import',
+      ]);
+    }
+  );
+  it.each([403, 404, 410, 503])(
+    'keeps a missing event deferred when calendar access fails with %s',
+    async (status) => {
+      const f = fixture();
+      f.get.mockRejectedValue({ response: { status: 404 } });
+      f.calendarGet.mockRejectedValue({ response: { status } });
+      await expect(replayDeferredGoogleImports(f)).resolves.toEqual({
+        deferred: 1,
+      });
+      expect(f.rpc).toHaveBeenCalledTimes(2);
+      expect(f.format).not.toHaveBeenCalled();
+    }
+  );
+  it.each(['freeBusyReader', 'none', ''])(
+    'does not mistake %s metadata access for event access',
+    async (accessRole) => {
+      const f = fixture();
+      f.get.mockRejectedValue({ response: { status: 404 } });
+      f.calendarGet.mockResolvedValue({
+        data: { id: scope.calendarId, accessRole },
+      });
+      await expect(replayDeferredGoogleImports(f)).resolves.toEqual({
+        deferred: 1,
+      });
+      expect(f.rpc).toHaveBeenCalledTimes(2);
+    }
+  );
+  it('keeps deferred entries when calendar metadata has a different identity', async () => {
+    const f = fixture();
+    f.get.mockRejectedValue({ response: { status: 404 } });
+    f.calendarGet.mockResolvedValue({
+      data: { id: 'another-calendar', accessRole: 'reader' },
+    });
+    await expect(replayDeferredGoogleImports(f)).resolves.toEqual({
+      deferred: 1,
+    });
+    expect(f.rpc).toHaveBeenCalledTimes(2);
+  });
+  it('leaves deletion-disabled entries queued without an apply', async () => {
+    const f = fixture({ id: 'event', status: 'cancelled' });
+    expect(
+      await replayDeferredGoogleImports({ ...f, syncDeletes: false })
+    ).toEqual({ deferred: 1 });
+    expect(f.rpc).toHaveBeenCalledTimes(2);
+  });
+  it('propagates provider failure without tombstones or persistence', async () => {
+    const f = fixture();
+    const failure = new Error('provider unavailable');
+    f.get.mockRejectedValue(failure);
+    await expect(replayDeferredGoogleImports(f)).rejects.toBe(failure);
+    expect(f.rpc).toHaveBeenCalledTimes(2);
+  });
+  it('fails on optional-looking malformed persistence rather than advancing sync', async () => {
+    const f = fixture();
+    f.rpc.mockResolvedValue({ data: { ...result, deferred: -1 }, error: null });
+    await expect(
+      applyGoogleImport(f.client, capture, [])
+    ).rejects.toBeInstanceOf(GoogleImportFenceError);
+  });
+  it('rejects malformed capture state', async () => {
+    const f = fixture();
+    f.rpc.mockResolvedValue({ data: {}, error: null });
+    await expect(captureGoogleImport(f.client, scope)).rejects.toBeInstanceOf(
+      GoogleImportFenceError
+    );
+  });
+});

package/src/google-calendar-import-fence.ts

@@ -0,0 +1,166 @@
+import type { calendar_v3 } from '@tuturuuu/google';
+import type { SupabaseClient } from '@tuturuuu/supabase';
+import type { Json } from '@tuturuuu/types/db';
+import { z } from 'zod';
+
+const CaptureSchema = z
+  .object({
+    id: z.guid(),
+    wsId: z.guid(),
+    calendarId: z.string().min(1),
+    authTokenId: z.guid().nullable(),
+  })
+  .strict();
+const ResultSchema = z
+  .object({
+    inserted: z.number().int().nonnegative(),
+    updated: z.number().int().nonnegative(),
+    deleted: z.number().int().nonnegative(),
+    deferred: z.number().int().nonnegative(),
+  })
+  .strict();
+export type GoogleImportCapture = z.infer<typeof CaptureSchema>;
+export type GoogleImportResult = z.infer<typeof ResultSchema>;
+export type GoogleImportScope = Omit<GoogleImportCapture, 'id'>;
+
+export class GoogleImportFenceError extends Error {
+  constructor() {
+    super('Google import guard is unavailable; retry sync');
+  }
+}
+
+/** Must run before any provider GET/list, including deferred replay reads. */
+export async function captureGoogleImport(
+  client: SupabaseClient,
+  scope: GoogleImportScope
+) {
+  const { data, error } = await client.rpc('capture_calendar_google_import', {
+    p_ws_id: scope.wsId,
+    p_calendar_id: scope.calendarId,
+    p_auth_token_id: scope.authTokenId,
+  });
+  const parsed = CaptureSchema.safeParse(data);
+  if (
+    error ||
+    !parsed.success ||
+    parsed.data.wsId !== scope.wsId ||
+    parsed.data.calendarId !== scope.calendarId ||
+    parsed.data.authTokenId !== scope.authTokenId
+  )
+    throw new GoogleImportFenceError();
+  return parsed.data;
+}
+
+/** RPC commits applied rows and deferred identities together before token advance. */
+export async function applyGoogleImport(
+  client: SupabaseClient,
+  capture: GoogleImportCapture,
+  events: object[],
+  tombstones: string[] = []
+) {
+  const { data, error } = await client.rpc('apply_calendar_google_import', {
+    p_capture_id: capture.id,
+    p_events: events as Json[],
+    p_tombstones: tombstones,
+  });
+  const parsed = ResultSchema.safeParse(data);
+  if (error || !parsed.success) throw new GoogleImportFenceError();
+  return parsed.data;
+}
+
+function missingProviderEvent(error: unknown) {
+  if (!error || typeof error !== 'object') return false;
+  const value = error as { code?: unknown; response?: { status?: unknown } };
+  return [404, 410].includes(Number(value.response?.status ?? value.code));
+}
+
+/** Only exact verified token-row scope may replay protected entries. Unknown
+ * legacy account scope remains deferred; it never borrows a guessed account. */
+export async function replayDeferredGoogleImports(args: {
+  client: SupabaseClient;
+  calendar: calendar_v3.Calendar;
+  scope: GoogleImportScope;
+  format: (events: calendar_v3.Schema$Event[]) => Promise<object[]>;
+  syncDeletes?: boolean;
+}) {
+  const { data, error } = await args.client.rpc(
+    'list_deferred_calendar_google_imports',
+    {
+      p_ws_id: args.scope.wsId,
+      p_calendar_id: args.scope.calendarId,
+      p_auth_token_id: args.scope.authTokenId,
+    }
+  );
+  const parsed = z.array(z.string().min(1)).max(100).safeParse(data);
+  if (error || !parsed.success) throw new GoogleImportFenceError();
+  let deferred = 0;
+  for (const id of parsed.data) {
+    // Never apply the stored old snapshot. The queue stores identity only.
+    const capture = await captureGoogleImport(args.client, args.scope);
+    let providerEvent: calendar_v3.Schema$Event | null;
+    try {
+      const result = await args.calendar.events.get({
+        calendarId: args.scope.calendarId,
+        eventId: id,
+      });
+      if (result.data.id !== id) throw new GoogleImportFenceError();
+      providerEvent = result.data.status === 'cancelled' ? null : result.data;
+    } catch (failure) {
+      if (!missingProviderEvent(failure)) throw failure;
+      // Missing events and inaccessible/deleted calendars share 404/410. Only
+      // confirmed access to this exact calendar can justify a local tombstone.
+      try {
+        const access = await args.calendar.calendarList.get({
+          calendarId: args.scope.calendarId,
+        });
+        if (
+          !['reader', 'writer', 'owner'].includes(
+            access.data.accessRole ?? ''
+          ) ||
+          !access.data.id ||
+          (args.scope.calendarId !== 'primary' &&
+            access.data.id !== args.scope.calendarId)
+        ) {
+          deferred++;
+          continue;
+        }
+      } catch {
+        deferred++;
+        continue;
+      }
+      providerEvent = null;
+    }
+    if (!providerEvent && args.syncDeletes === false) {
+      deferred++;
+      continue;
+    }
+    const result = await applyGoogleImport(
+      args.client,
+      capture,
+      providerEvent ? await args.format([providerEvent]) : [],
+      providerEvent ? [] : [id]
+    );
+    deferred += result.deferred;
+  }
+  return { deferred };
+}
+
+/** Resolve a background caller's exact stored token row from its supplied
+ * credential, without persisting or logging that credential. Ambiguity is null. */
+export async function verifiedGoogleImportToken(
+  client: SupabaseClient,
+  wsId: string,
+  accessToken: string
+) {
+  const { data, error } = await client
+    .from('calendar_auth_tokens')
+    .select('id')
+    .eq('ws_id', wsId)
+    .eq('provider', 'google')
+    .eq('is_active', true)
+    .eq('access_token', accessToken)
+    .limit(2);
+  if (error) throw new GoogleImportFenceError();
+  const token = data?.length === 1 ? data[0] : undefined;
+  return token ? z.guid().parse(token.id) : null;
+}

package/src/next-config.ts

@@ -2,6 +2,7 @@ import type { NextConfig } from 'next';
 import { resolveInternalAppUrl } from './app-url';
 import { getLocalInternalAppUrl } from './internal-domains';
 import { getTuturuuuPortlessAllowedDevOrigins } from './portless';
+import { createSeoHeaders, type SeoApp } from './seo';
 
 type Environment = Record<string, string | undefined>;
 
@@ -135,6 +136,10 @@ export function getTuturuuuNextOptimizePackageImports(
 }
 
 export interface TuturuuuNextConfigOptions extends NextConfig {
+  /** Explicit app policy; private routes receive an HTTP noindex directive. */
+  seoApp?: SeoApp;
+  /** Literal path regexes without a leading slash, for generated public pages. */
+  seoPublicPathPatterns?: readonly string[];
   /**
    * Path patterns (no leading slash, regex fragments) that this app allows to
    * be framed by third-party sites. Excluded from the platform-wide
@@ -150,7 +155,8 @@ export function createTuturuuuNextConfig(
 ): NextConfig {
   const experimentalConfig = config.experimental ?? {};
   const imageConfig = config.images ?? {};
-  const { framablePathPatterns, ...nextConfig } = config;
+  const { framablePathPatterns, seoApp, seoPublicPathPatterns, ...nextConfig } =
+    config;
   const antiFramingSource = buildAntiFramingSource([
     ...TUTURUUU_DEFAULT_FRAMABLE_PATTERNS,
     ...(framablePathPatterns ?? []),
@@ -204,6 +210,7 @@ export function createTuturuuuNextConfig(
           headers: TUTURUUU_ANTI_FRAMING_HEADERS,
         },
         ...((await nextConfig.headers?.()) ?? []),
+        ...(seoApp ? createSeoHeaders(seoApp, seoPublicPathPatterns) : []),
       ];
     },
   };

package/src/offline-download-guard.ts

@@ -0,0 +1,160 @@
+import { verifyTurnstileToken } from '@tuturuuu/turnstile/server';
+import { Ratelimit } from '@upstash/ratelimit';
+import type { NextRequest } from 'next/server';
+import { NextResponse } from 'next/server';
+import { extractIPFromRequest } from './abuse-protection/edge';
+import { getCachedTrustEntries } from './abuse-protection/edge-trust';
+import {
+  buildProxySessionSubjectKey,
+  getProxySessionSubjectKeyFromCookieHeader,
+} from './api-proxy-guard';
+import {
+  getUpstashRatelimitRedisClient,
+  getUpstashRestRedisClient,
+} from './upstash-rest';
+
+export const OFFLINE_DOWNLOAD_HEADER = 'x-tuturuuu-offline-download';
+const CLEARANCE_SECONDS = 15 * 60;
+const READ_PATH =
+  /^\/api\/(?:v1\/)?workspaces\/[^/]+\/(?:finance|inventory|transactions|wallets|tags|members|products|product-categories|product-units|product-warehouses|tasks|task-boards|boards|labels|task-projects|task-initiatives|habit-trackers|habits|calendar)(?:[-/]|$)/u;
+const USER_READ_PATH =
+  /^\/api\/v1\/(?:users\/me\/tasks|calendar|users\/calendar-settings)(?:\/|$)/u;
+
+export function isOfflineCapableRead(
+  request: Pick<NextRequest, 'method' | 'url'>
+) {
+  if (request.method !== 'GET' && request.method !== 'HEAD') return false;
+  const pathname = new URL(request.url).pathname.replace(
+    /^\/api\/v1\/mobile-calendar(?=\/api\/)/u,
+    ''
+  );
+  return (
+    READ_PATH.test(pathname) ||
+    USER_READ_PATH.test(pathname) ||
+    /^\/api\/v1\/exchange-rates\/?$/u.test(pathname)
+  );
+}
+
+function unavailable() {
+  return NextResponse.json(
+    {
+      message:
+        'Download protection is temporarily unavailable. Try again later.',
+    },
+    {
+      status: 503,
+      headers: { 'Cache-Control': 'no-store', 'Retry-After': '30' },
+    }
+  );
+}
+
+function challenge() {
+  return NextResponse.json(
+    {
+      code: 'ABUSE_CHALLENGE_REQUIRED',
+      message: 'Additional verification is required before retrying.',
+    },
+    {
+      status: 403,
+      headers: {
+        'Cache-Control': 'no-store',
+        'X-Abuse-Challenge': 'turnstile',
+      },
+    }
+  );
+}
+
+/** Additional protection is scoped to explicitly marked offline bulk downloads.
+ * Ordinary enterprise reads retain their existing API/auth protections.
+ * Clearance never satisfies authentication, authorization, IP blocks, required
+ * MFA, or either rate-limit budget. Runtime failures remain fail-closed. */
+export async function guardOfflineDownloadRequest(request: NextRequest) {
+  if (!isOfflineCapableRead(request) || process.env.NODE_ENV !== 'production')
+    return null;
+  const bulk = request.headers.get(OFFLINE_DOWNLOAD_HEADER) === '1';
+  if (!bulk) return null;
+  if (process.env.OFFLINE_DOWNLOAD_PROTECTION_ENABLED !== 'true') {
+    // Keep baseline API/auth protections while this additional protection is
+    // unprovisioned. Offline prefetch is unavailable until explicitly enabled.
+    return unavailable();
+  }
+  try {
+    const redis = await getUpstashRestRedisClient();
+    const limiterRedis = await getUpstashRatelimitRedisClient();
+    if (!redis || !limiterRedis) return unavailable();
+    const bearer = request.headers
+      .get('authorization')
+      ?.match(/^Bearer\s+([^\s]+)$/i)?.[1];
+    const sessionKey = bearer
+      ? await buildProxySessionSubjectKey('bearer', bearer)
+      : await getProxySessionSubjectKeyFromCookieHeader(
+          request.headers.get('cookie')
+        );
+    const ip = extractIPFromRequest(request.headers);
+    // IP remains bounded even when a caller rotates unverified bearer values.
+    // Internal authenticated gateways may lack a client IP. Never combine
+    // their unrelated sessions into a shared unknown-IP bucket. Public ingress
+    // still supplies a real IP, retaining the rotating-token budget.
+    if (ip === 'unknown' && !sessionKey) return unavailable();
+    const subjects = [
+      ...(ip !== 'unknown'
+        ? [{ key: `ip:${ip}`, minute: 1200, hour: 30000 }]
+        : []),
+      ...(sessionKey ? [{ key: sessionKey, minute: 600, hour: 12000 }] : []),
+    ];
+    for (const subject of subjects) {
+      for (const [window, limit] of [
+        ['1 m', subject.minute],
+        ['1 h', subject.hour],
+      ] as const) {
+        const limiter = new Ratelimit({
+          redis: limiterRedis,
+          limiter: Ratelimit.slidingWindow(limit, window),
+          prefix: `offline:read:${window}`,
+        });
+        const result = await limiter.limit(subject.key);
+        if (!result.success) {
+          return NextResponse.json(
+            {
+              message:
+                'Read limit reached. Try again after the indicated delay.',
+            },
+            {
+              status: 429,
+              headers: {
+                'Cache-Control': 'no-store',
+                'Retry-After': `${Math.max(1, Math.ceil((result.reset - Date.now()) / 1000))}`,
+                'X-RateLimit-Policy': 'offline-capable-read',
+              },
+            }
+          );
+        }
+      }
+    }
+    if (!sessionKey)
+      return NextResponse.json(
+        { message: 'Authentication required' },
+        { status: 401 }
+      );
+    const trust = (await getCachedTrustEntries([sessionKey])).get(sessionKey);
+    // Reuse established account trust. This check does not write trust markers.
+    if (trust?.verified && (trust.m > 1 || trust.mode === 'unlimited'))
+      return null;
+    const clearanceKey = `offline:clearance:${sessionKey}`;
+    if (await redis.get(clearanceKey)) return null;
+    const token = request.headers.get('x-tuturuuu-turnstile-token');
+    if (!token) return challenge();
+    try {
+      await verifyTurnstileToken(request, token, {
+        remoteIp: ip === 'unknown' ? undefined : ip,
+      });
+    } catch {
+      return challenge();
+    }
+    await redis.set(clearanceKey, 'passed', { ex: CLEARANCE_SECONDS });
+    return null;
+  } catch {
+    // A distributed guard must not silently fall back to per-process limits.
+    return unavailable();
+  }
+}

package/src/permissions.tsx

@@ -53,6 +53,7 @@ import type { SupabaseUser } from '@tuturuuu/supabase/next/user';
 import type { PermissionId } from '@tuturuuu/types';
 import { ROOT_WORKSPACE_ID } from '@tuturuuu/utils/constants';
 import type { ReactNode } from 'react';
+import { deploymentVaultPermissions } from './deployment-vault-permissions';
 
 export type RolePermission = {
   id: PermissionId;
@@ -142,16 +143,7 @@ export const permissionGroups = ({
                   disableOnProduction: false,
                   disabled: false,
                 },
-                {
-                  id: 'manage_mobile_deployment_vault' as PermissionId,
-                  icon: <FileKey2 />,
-                  title: t('ws-roles.manage_mobile_deployment_vault'),
-                  description: t(
-                    'ws-roles.manage_mobile_deployment_vault_description'
-                  ),
-                  disableOnProduction: false,
-                  disabled: false,
-                },
+                ...deploymentVaultPermissions(t),
                 {
                   id: 'manage_external_migrations',
                   icon: <DatabaseZap />,

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.65.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.67.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.65.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.67.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */