@tuturuuu/utils 0.33.3 → 0.35.0

package/src/playground-schema.test.ts

@@ -0,0 +1,119 @@
+import { expect, it } from 'vitest';
+import {
+  PlaygroundDelta,
+  PlaygroundFiles,
+  PlaygroundJob,
+  PlaygroundRunnerExport,
+} from './playground-schema';
+
+it.each([
+  '../secret',
+  'a/../../secret',
+  '/absolute',
+  'node_modules/pkg.js',
+  'a/.git/config',
+  'a//b',
+  'a\\b',
+])('rejects unsafe path %s', (path) =>
+  expect(PlaygroundFiles.safeParse([{ path, content: 'x' }]).success).toBe(
+    false
+  )
+);
+it('enforces UTF-8 byte limits rather than only character counts', () =>
+  expect(
+    PlaygroundFiles.safeParse([{ path: 'a', content: 'ấ'.repeat(100000) }])
+      .success
+  ).toBe(false));
+it('rejects inconsistent delta inventories', () => {
+  expect(
+    PlaygroundDelta.safeParse({
+      revision: 1,
+      command: 'run',
+      paths: ['a', 'a/b'],
+      files: [],
+    }).success
+  ).toBe(false);
+  expect(
+    PlaygroundDelta.safeParse({
+      revision: 1,
+      command: 'run',
+      paths: ['a'],
+      files: [{ path: 'b', content: 'x' }],
+    }).success
+  ).toBe(false);
+});
+it('bounds preview requests to approved ports and paths', () => {
+  const job = {
+    projectId: '00000000-0000-4000-8000-000000000001',
+    revision: 0,
+    language: 'python',
+    operation: 'preview',
+    port: 22,
+    path: '/',
+  };
+  expect(PlaygroundJob.safeParse(job).success).toBe(false);
+  expect(
+    PlaygroundJob.safeParse({ ...job, port: 3000, path: '/\r\nHost:metadata' })
+      .success
+  ).toBe(false);
+});
+
+it('rejects file/directory collisions with intervening sorted siblings', () => {
+  const paths = ['a', 'a-b', 'a/b'];
+  expect(
+    PlaygroundFiles.safeParse(paths.map((path) => ({ path, content: 'x' })))
+      .success
+  ).toBe(false);
+  expect(
+    PlaygroundDelta.safeParse({ revision: 1, command: 'run', paths, files: [] })
+      .success
+  ).toBe(false);
+});
+
+it('rejects conflicting runner inventory ancestors', () => {
+  expect(
+    PlaygroundRunnerExport.safeParse({
+      revision: 1,
+      paths: ['a', 'a-b', 'a/b'],
+      files: [],
+      baseline: {},
+    }).success
+  ).toBe(false);
+});
+
+it.each([
+  '/../secret',
+  '/a/./b',
+  '/a//b',
+  '//other-host',
+  '/%2e%2e/secret',
+  '/a%2f../secret',
+  '/a\\b',
+  '/%',
+])('rejects unsafe preview path %s', (path) => {
+  expect(
+    PlaygroundJob.safeParse({
+      projectId: '00000000-0000-4000-8000-000000000001',
+      revision: 0,
+      language: 'python',
+      operation: 'preview',
+      port: 3000,
+      path,
+    }).success
+  ).toBe(false);
+});
+it.each(['/', '/index.html', '/assets/app.js?version=1'])(
+  'accepts ordinary preview path %s',
+  (path) => {
+    expect(
+      PlaygroundJob.safeParse({
+        projectId: '00000000-0000-4000-8000-000000000001',
+        revision: 0,
+        language: 'python',
+        operation: 'preview',
+        port: 3000,
+        path,
+      }).success
+    ).toBe(true);
+  }
+);

package/src/playground-schema.ts

@@ -0,0 +1,173 @@
+import { PLAYGROUND_LANGUAGES } from '@tuturuuu/types/primitives/playgrounds';
+import { z } from 'zod';
+
+function hasDirectoryConflict(paths: string[]) {
+  const inventory = new Set(paths);
+  return paths.some((path) => {
+    const pieces = path.split('/');
+    return pieces
+      .slice(0, -1)
+      .some((_, index) => inventory.has(pieces.slice(0, index + 1).join('/')));
+  });
+}
+
+function validPreviewPath(path: string) {
+  if (!path.startsWith('/') || /[\r\n\0\\]/.test(path)) return false;
+  try {
+    const pathname = decodeURIComponent(path.split(/[?#]/, 1)[0]!);
+    return (
+      pathname === '/' ||
+      (!/[\r\n\0\\]/.test(pathname) &&
+        pathname
+          .slice(1)
+          .split('/')
+          .every((part) => part !== '' && part !== '.' && part !== '..'))
+    );
+  } catch {
+    return false;
+  }
+}
+
+export const PLAYGROUND_BYTES = 2 * 1024 * 1024;
+export const PlaygroundPath = z
+  .string()
+  .min(1)
+  .max(240)
+  .refine(
+    (path) =>
+      path
+        .split('/')
+        .every(
+          (part) =>
+            /^[a-zA-Z0-9_.@+-]+$/.test(part) && part !== '.' && part !== '..'
+        ) &&
+      !path
+        .split('/')
+        .some((part) =>
+          ['node_modules', '.git', '__pycache__', 'target', '.venv'].includes(
+            part
+          )
+        )
+  );
+export const PlaygroundFiles = z
+  .array(
+    z
+      .object({
+        path: PlaygroundPath,
+        content: z
+          .string()
+          .max(256 * 1024)
+          .refine(
+            (value) =>
+              !value.includes('\0') &&
+              new TextEncoder().encode(value).byteLength <= 256 * 1024
+          ),
+      })
+      .strict()
+  )
+  .max(128)
+  .superRefine((files, ctx) => {
+    if (new Set(files.map((file) => file.path)).size !== files.length)
+      ctx.addIssue({ code: 'custom', message: 'Duplicate file paths' });
+    if (
+      files.reduce(
+        (size, file) => size + new TextEncoder().encode(file.content).length,
+        0
+      ) > PLAYGROUND_BYTES
+    )
+      ctx.addIssue({
+        code: 'custom',
+        message: 'Project exceeds storage limit',
+      });
+    const paths = files.map((file) => file.path).sort();
+    if (hasDirectoryConflict(paths))
+      ctx.addIssue({
+        code: 'custom',
+        message: 'File conflicts with directory',
+      });
+  });
+export const PlaygroundCreate = z
+  .object({
+    name: z.string().trim().min(1).max(80),
+    language: z.enum(PLAYGROUND_LANGUAGES),
+  })
+  .strict();
+export const PlaygroundSave = z
+  .object({
+    revision: z.number().int().nonnegative(),
+    files: PlaygroundFiles,
+    command: z
+      .string()
+      .min(1)
+      .max(4096)
+      .refine((value) => !value.includes('\0')),
+  })
+  .strict();
+export const PlaygroundJob = z
+  .object({
+    projectId: z.guid(),
+    revision: z.number().int().nonnegative(),
+    language: z.enum(PLAYGROUND_LANGUAGES),
+    operation: z.enum(['run', 'stop', 'preview']),
+    files: PlaygroundFiles.optional(),
+    command: z.string().max(4096).optional(),
+    stdin: z.string().max(65536).optional(),
+    port: z.number().int().min(1024).max(65535).optional(),
+    path: z.string().max(2048).optional(),
+  })
+  .strict()
+  .superRefine((job, ctx) => {
+    if (
+      job.operation === 'run' &&
+      (!job.files || !job.command || job.command.includes('\0'))
+    )
+      ctx.addIssue({ code: 'custom', message: 'Missing run payload' });
+    if (
+      job.operation === 'preview' &&
+      (!job.port || !job.path || !validPreviewPath(job.path))
+    )
+      ctx.addIssue({ code: 'custom', message: 'Invalid preview request' });
+  });
+export type PlaygroundJobPayload = z.infer<typeof PlaygroundJob>;
+
+/** Full path inventory plus changed text; unchanged file bytes never cross the callback. */
+export const PlaygroundDelta = PlaygroundSave.extend({
+  paths: z.array(PlaygroundPath).max(128),
+}).superRefine((value, ctx) => {
+  const paths = [...value.paths].sort();
+  if (
+    new Set(paths).size !== paths.length ||
+    hasDirectoryConflict(paths) ||
+    value.files.some((file) => !paths.includes(file.path))
+  )
+    ctx.addIssue({ code: 'custom', message: 'Invalid delta inventory' });
+});
+
+/** Authenticated runner export merged into the room before Drive persistence. */
+export const PlaygroundRunnerExport = z
+  .object({
+    revision: z.number().int().nonnegative(),
+    files: PlaygroundFiles,
+    paths: z.array(PlaygroundPath).max(128),
+    baseline: z.record(PlaygroundPath, z.string().regex(/^[a-f0-9]{64}$/)),
+  })
+  .strict()
+  .refine(
+    (value) =>
+      new Set(value.paths).size === value.paths.length &&
+      !hasDirectoryConflict(value.paths) &&
+      value.files.every((file) => value.paths.includes(file.path)),
+    'Invalid runner inventory'
+  );
+
+export const PlaygroundPreviewCapability = z
+  .object({
+    aud: z.literal('tuturuuu.playground-preview'),
+    ownerId: z.guid(),
+    projectId: z.guid(),
+    port: z.number().int().min(1024).max(65535),
+    meetingId: z.guid().optional(),
+    roomId: z.guid().optional(),
+    exp: z.number().int().positive(),
+  })
+  .strict();

package/src/playground-templates.ts

@@ -0,0 +1,65 @@
+import type { PlaygroundLanguage } from '@tuturuuu/types/primitives/playgrounds';
+export const playgroundTemplates: Record<
+  PlaygroundLanguage,
+  { path: string; content: string; command: string }
+> = {
+  python: {
+    path: 'main.py',
+    content: 'print("Hello, playground!")\n',
+    command: 'python3 main.py',
+  },
+  javascript: {
+    path: 'main.js',
+    content: 'console.log("Hello, playground!");\n',
+    command: 'node main.js',
+  },
+  typescript: {
+    path: 'main.ts',
+    content: 'console.log("Hello, playground!");\n',
+    command: 'bun main.ts',
+  },
+  c: {
+    path: 'main.c',
+    content:
+      '#include <stdio.h>\nint main(void) { puts("Hello, playground!"); }\n',
+    command: 'gcc main.c -o /tmp/main && /tmp/main',
+  },
+  cpp: {
+    path: 'main.cpp',
+    content:
+      '#include <iostream>\nint main() { std::cout << "Hello, playground!\\n"; }\n',
+    command: 'g++ main.cpp -o /tmp/main && /tmp/main',
+  },
+  java: {
+    path: 'Main.java',
+    content:
+      'class Main { public static void main(String[] args) { System.out.println("Hello, playground!"); } }\n',
+    command: 'javac Main.java && java Main',
+  },
+  rust: {
+    path: 'main.rs',
+    content: 'fn main() { println!("Hello, playground!"); }\n',
+    command: 'rustc main.rs -o /tmp/main && /tmp/main',
+  },
+  go: {
+    path: 'main.go',
+    content:
+      'package main\nimport "fmt"\nfunc main() { fmt.Println("Hello, playground!") }\n',
+    command: 'go run main.go',
+  },
+  ruby: {
+    path: 'main.rb',
+    content: 'puts "Hello, playground!"\n',
+    command: 'ruby main.rb',
+  },
+  php: {
+    path: 'main.php',
+    content: '<?php echo "Hello, playground!\\n";\n',
+    command: 'php main.php',
+  },
+  shell: {
+    path: 'main.sh',
+    content: 'printf "Hello, playground!\\n"\n',
+    command: 'sh main.sh',
+  },
+};

package/src/release-note-policy-core.cjs

@@ -0,0 +1,28 @@
+const { patterns } = require('./release-note-policy.json');
+const matchers = patterns.map((pattern) => new RegExp(pattern, 'iu'));
+
+/** Omit known Git bookkeeping, never arbitrary product text containing merge. */
+function isReleaseBookkeeping(subject) {
+  const description = subject
+    .replace(/^\w+(?:\([^)]*\))?!?:\s*/u, '')
+    .replace(/^\*\*[^*]+:\*\*\s*/u, '')
+    .replace(/\s*\(#\d+\)$/u, '')
+    .replace(
+      /\s*\(\[[^\]]+\]\(https:\/\/github\.com\/tutur3u\/platform\/(?:commit|issues|pull)\/[^)]+\)\)/gu,
+      ''
+    )
+    .trim();
+  return matchers.some((pattern) => pattern.test(description));
+}
+
+function filterReleaseBookkeeping(markdown) {
+  return markdown
+    .split('\n')
+    .filter((line) => {
+      const bullet = /^\s*[-*]\s+(.+)$/u.exec(line);
+      return !bullet || !isReleaseBookkeeping(bullet[1]);
+    })
+    .join('\n');
+}
+
+module.exports = { isReleaseBookkeeping, filterReleaseBookkeeping };

package/src/release-note-policy-core.d.cts

@@ -0,0 +1,5 @@
+declare const policy: {
+  isReleaseBookkeeping(subject: string): boolean;
+  filterReleaseBookkeeping(markdown: string): string;
+};
+export = policy;

package/src/release-note-policy.json

@@ -0,0 +1,9 @@
+{
+  "patterns": [
+    "^merge (?:remote-tracking )?(?:branch(?:es)?|tag|commit) ['\"][^'\"\\n]+['\"](?: (?:and ['\"][^'\"\\n]+['\"]|of \\S+|into (?:['\"][^'\"\\n]+['\"]|\\S+)))*$",
+    "^merge pull request #\\d+ from \\S+$",
+    "^merge (?:current |latest )?(?:main|production|origin/(?:main|production|release-please--branches--\\S+))(?: (?:into|to) (?:main|production))?$",
+    "^(?:sync|synchronize) (?:current |latest )?(?:main|production)(?: (?:to|into|with|from) (?:main|production))$",
+    "^address review and integrate current main$"
+  ]
+}

package/src/release-note-policy.ts

@@ -0,0 +1,4 @@
+import policy from './release-note-policy-core.cjs';
+
+/** Filter known Git merge/sync metadata while retaining product merge features. */
+export const isReleaseBookkeeping = policy.isReleaseBookkeeping;

package/src/request-workspace.ts

@@ -0,0 +1,29 @@
+import { cache } from 'react';
+import { getWorkspace } from './workspace-helper';
+
+// React cache is scoped to a server render/request, never a shared authorization
+// cache. Primitive actor keys let sibling layouts/pages reuse the same read.
+const readWorkspace = cache(
+  (
+    id: string,
+    useAdmin: boolean,
+    actorId: string | null,
+    email: string | null
+  ) =>
+    getWorkspace(id, {
+      useAdmin,
+      ...(actorId ? { user: { id: actorId, email } } : {}),
+    })
+);
+
+export function getRequestWorkspace(
+  id: string,
+  options: Parameters<typeof getWorkspace>[1] = {}
+) {
+  return readWorkspace(
+    id,
+    options.useAdmin ?? false,
+    options.user?.id ?? null,
+    options.user?.email ?? null
+  );
+}

package/src/seo-policy.json

@@ -0,0 +1,196 @@
+{
+  "ai": {
+    "origin": "https://ai.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "apps": {
+    "origin": "https://apps.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [""],
+    "publicPatterns": []
+  },
+  "calendar": {
+    "origin": "https://calendar.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "chat": {
+    "origin": "https://chat.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "cms": {
+    "origin": "https://cms.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "contacts": {
+    "origin": "https://contacts.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "drive": {
+    "origin": "https://drive.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "external": {
+    "origin": "https://external.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "finance": {
+    "origin": "https://finance.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "forms": {
+    "origin": "https://forms.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [""],
+    "publicPatterns": ["f/[^/]+"]
+  },
+  "git": {
+    "origin": "https://git.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": ["tutur3u/platform"],
+    "publicPatterns": ["", "[^/]+/[^/]+(?:/.*)?"]
+  },
+  "hive": {
+    "origin": "https://hive.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "infrastructure": {
+    "origin": "https://infrastructure.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "inventory": {
+    "origin": "https://inventory.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "learn": {
+    "origin": "https://learn.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [""],
+    "publicPatterns": []
+  },
+  "lettin": {
+    "origin": "https://lettin.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": ["", "worlds", "spaces"],
+    "publicPatterns": ["worlds/[^/]+", "creators/[^/]+"]
+  },
+  "mail": {
+    "origin": "https://mail.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "meet": {
+    "origin": "https://meet.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "mind": {
+    "origin": "https://mind.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "nova": {
+    "origin": "https://nova.tuturuuu.com",
+    "localePrefix": "as-needed",
+    "publicPaths": [
+      "",
+      "learn",
+      "learn/introduction",
+      "learn/basic-techniques",
+      "learn/advanced-strategies",
+      "learn/best-practices",
+      "competitions/neo-league/prompt-the-future/about"
+    ],
+    "publicPatterns": []
+  },
+  "parley": {
+    "origin": "https://parley.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "pay": {
+    "origin": "https://pay.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "playground": {
+    "origin": "https://playground.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "rewise": {
+    "origin": "https://rewise.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "shortener": {
+    "origin": "https://shortener.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "storefront": {
+    "origin": "https://storefront.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": ["[^/]+", "[^/]+/products/[^/]+"]
+  },
+  "tasks": {
+    "origin": "https://tasks.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "teach": {
+    "origin": "https://teach.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [""],
+    "publicPatterns": []
+  },
+  "tools": {
+    "origin": "https://tools.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": ["", "qr", "random"],
+    "publicPatterns": []
+  },
+  "track": {
+    "origin": "https://track.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "web": {
+    "origin": "https://tuturuuu.com",
+    "localePrefix": "as-needed",
+    "publicPaths": [],
+    "publicPatterns": []
+  }
+}