@tuturuuu/utils 0.34.0 → 0.35.0

package/src/deployment-vault-permissions.tsx

@@ -0,0 +1,26 @@
+import { FileKey2 } from '@tuturuuu/icons';
+import type { RolePermission } from './permissions';
+
+/** Called only inside the existing root/full infrastructure catalog branch. */
+export function deploymentVaultPermissions(
+  t: (key: string) => string
+): RolePermission[] {
+  return [
+    {
+      id: 'manage_mobile_deployment_vault',
+      icon: <FileKey2 />,
+      title: t('ws-roles.manage_mobile_deployment_vault'),
+      description: t('ws-roles.manage_mobile_deployment_vault_description'),
+      disableOnProduction: false,
+      disabled: false,
+    },
+    {
+      id: 'manage_desktop_deployment_vault',
+      icon: <FileKey2 />,
+      title: t('ws-roles.manage_desktop_deployment_vault'),
+      description: t('ws-roles.manage_desktop_deployment_vault_description'),
+      disableOnProduction: false,
+      disabled: false,
+    },
+  ];
+}

package/src/desktop-signing-profiles.ts

@@ -0,0 +1,20 @@
+/** Shared pure signing allowlist; native CI imports this checkout file directly. */
+export const DESKTOP_SIGNING_PROFILES = {
+  windows: {
+    files: ['windows_authenticode_certificate_pfx'],
+    scalars: ['WINDOWS_SIGNING_CERTIFICATE_PASSWORD'],
+  },
+  macos: {
+    files: [
+      'macos_developer_id_certificate_p12',
+      'macos_notarization_private_key_p8',
+    ],
+    scalars: [
+      'MACOS_CERTIFICATE_PASSWORD',
+      'MACOS_SIGNING_IDENTITY',
+      'APPLE_TEAM_ID',
+      'APP_STORE_CONNECT_API_KEY_ID',
+      'APP_STORE_CONNECT_ISSUER_ID',
+    ],
+  },
+} as const;

package/src/next-config.ts

@@ -2,6 +2,7 @@ import type { NextConfig } from 'next';
 import { resolveInternalAppUrl } from './app-url';
 import { getLocalInternalAppUrl } from './internal-domains';
 import { getTuturuuuPortlessAllowedDevOrigins } from './portless';
+import { createSeoHeaders, type SeoApp } from './seo';
 
 type Environment = Record<string, string | undefined>;
 
@@ -135,6 +136,10 @@ export function getTuturuuuNextOptimizePackageImports(
 }
 
 export interface TuturuuuNextConfigOptions extends NextConfig {
+  /** Explicit app policy; private routes receive an HTTP noindex directive. */
+  seoApp?: SeoApp;
+  /** Literal path regexes without a leading slash, for generated public pages. */
+  seoPublicPathPatterns?: readonly string[];
   /**
    * Path patterns (no leading slash, regex fragments) that this app allows to
    * be framed by third-party sites. Excluded from the platform-wide
@@ -150,7 +155,8 @@ export function createTuturuuuNextConfig(
 ): NextConfig {
   const experimentalConfig = config.experimental ?? {};
   const imageConfig = config.images ?? {};
-  const { framablePathPatterns, ...nextConfig } = config;
+  const { framablePathPatterns, seoApp, seoPublicPathPatterns, ...nextConfig } =
+    config;
   const antiFramingSource = buildAntiFramingSource([
     ...TUTURUUU_DEFAULT_FRAMABLE_PATTERNS,
     ...(framablePathPatterns ?? []),
@@ -204,6 +210,7 @@ export function createTuturuuuNextConfig(
           headers: TUTURUUU_ANTI_FRAMING_HEADERS,
         },
         ...((await nextConfig.headers?.()) ?? []),
+        ...(seoApp ? createSeoHeaders(seoApp, seoPublicPathPatterns) : []),
       ];
     },
   };

package/src/permissions.tsx

@@ -53,6 +53,7 @@ import type { SupabaseUser } from '@tuturuuu/supabase/next/user';
 import type { PermissionId } from '@tuturuuu/types';
 import { ROOT_WORKSPACE_ID } from '@tuturuuu/utils/constants';
 import type { ReactNode } from 'react';
+import { deploymentVaultPermissions } from './deployment-vault-permissions';
 
 export type RolePermission = {
   id: PermissionId;
@@ -142,16 +143,7 @@ export const permissionGroups = ({
                   disableOnProduction: false,
                   disabled: false,
                 },
-                {
-                  id: 'manage_mobile_deployment_vault' as PermissionId,
-                  icon: <FileKey2 />,
-                  title: t('ws-roles.manage_mobile_deployment_vault'),
-                  description: t(
-                    'ws-roles.manage_mobile_deployment_vault_description'
-                  ),
-                  disableOnProduction: false,
-                  disabled: false,
-                },
+                ...deploymentVaultPermissions(t),
                 {
                   id: 'manage_external_migrations',
                   icon: <DatabaseZap />,

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.66.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.67.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.66.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.67.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */

package/src/request-workspace.ts

@@ -0,0 +1,29 @@
+import { cache } from 'react';
+import { getWorkspace } from './workspace-helper';
+
+// React cache is scoped to a server render/request, never a shared authorization
+// cache. Primitive actor keys let sibling layouts/pages reuse the same read.
+const readWorkspace = cache(
+  (
+    id: string,
+    useAdmin: boolean,
+    actorId: string | null,
+    email: string | null
+  ) =>
+    getWorkspace(id, {
+      useAdmin,
+      ...(actorId ? { user: { id: actorId, email } } : {}),
+    })
+);
+
+export function getRequestWorkspace(
+  id: string,
+  options: Parameters<typeof getWorkspace>[1] = {}
+) {
+  return readWorkspace(
+    id,
+    options.useAdmin ?? false,
+    options.user?.id ?? null,
+    options.user?.email ?? null
+  );
+}

package/src/seo-policy.json

@@ -0,0 +1,196 @@
+{
+  "ai": {
+    "origin": "https://ai.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "apps": {
+    "origin": "https://apps.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [""],
+    "publicPatterns": []
+  },
+  "calendar": {
+    "origin": "https://calendar.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "chat": {
+    "origin": "https://chat.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "cms": {
+    "origin": "https://cms.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "contacts": {
+    "origin": "https://contacts.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "drive": {
+    "origin": "https://drive.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "external": {
+    "origin": "https://external.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "finance": {
+    "origin": "https://finance.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "forms": {
+    "origin": "https://forms.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [""],
+    "publicPatterns": ["f/[^/]+"]
+  },
+  "git": {
+    "origin": "https://git.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": ["tutur3u/platform"],
+    "publicPatterns": ["", "[^/]+/[^/]+(?:/.*)?"]
+  },
+  "hive": {
+    "origin": "https://hive.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "infrastructure": {
+    "origin": "https://infrastructure.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "inventory": {
+    "origin": "https://inventory.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "learn": {
+    "origin": "https://learn.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [""],
+    "publicPatterns": []
+  },
+  "lettin": {
+    "origin": "https://lettin.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": ["", "worlds", "spaces"],
+    "publicPatterns": ["worlds/[^/]+", "creators/[^/]+"]
+  },
+  "mail": {
+    "origin": "https://mail.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "meet": {
+    "origin": "https://meet.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "mind": {
+    "origin": "https://mind.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "nova": {
+    "origin": "https://nova.tuturuuu.com",
+    "localePrefix": "as-needed",
+    "publicPaths": [
+      "",
+      "learn",
+      "learn/introduction",
+      "learn/basic-techniques",
+      "learn/advanced-strategies",
+      "learn/best-practices",
+      "competitions/neo-league/prompt-the-future/about"
+    ],
+    "publicPatterns": []
+  },
+  "parley": {
+    "origin": "https://parley.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "pay": {
+    "origin": "https://pay.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "playground": {
+    "origin": "https://playground.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "rewise": {
+    "origin": "https://rewise.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "shortener": {
+    "origin": "https://shortener.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "storefront": {
+    "origin": "https://storefront.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": ["[^/]+", "[^/]+/products/[^/]+"]
+  },
+  "tasks": {
+    "origin": "https://tasks.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "teach": {
+    "origin": "https://teach.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [""],
+    "publicPatterns": []
+  },
+  "tools": {
+    "origin": "https://tools.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": ["", "qr", "random"],
+    "publicPatterns": []
+  },
+  "track": {
+    "origin": "https://track.tuturuuu.com",
+    "localePrefix": "never",
+    "publicPaths": [],
+    "publicPatterns": []
+  },
+  "web": {
+    "origin": "https://tuturuuu.com",
+    "localePrefix": "as-needed",
+    "publicPaths": [],
+    "publicPatterns": []
+  }
+}

package/src/seo.test.ts

@@ -0,0 +1,168 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { tryToParsePath } from 'next/dist/lib/try-to-parse-path';
+import { describe, expect, it } from 'vitest';
+import { createTuturuuuNextConfig } from './next-config';
+import { APP_SEO_POLICY, createSeoHeaders, type SeoApp } from './seo';
+
+function blocked(
+  app: SeoApp,
+  pathname: string,
+  patterns?: string[],
+  preview = false
+) {
+  return createSeoHeaders(app, patterns, {
+    VERCEL_ENV: preview ? 'preview' : 'production',
+  }).some((rule) => {
+    const parsed = tryToParsePath(rule.source);
+    expect(parsed.error, rule.source).toBeUndefined();
+    return new RegExp(parsed.regexStr ?? '').test(pathname);
+  });
+}
+
+describe('app indexing boundaries', () => {
+  it.each(Object.keys(APP_SEO_POLICY) as SeoApp[])(
+    'protects auth and API paths in %s',
+    (app) => {
+      for (const path of [
+        '/login',
+        '/vi/login',
+        '/en/verify-token',
+        '/api/v1/users',
+        '/dashboard',
+        '/invite/token',
+      ]) {
+        expect(blocked(app, path), `${app}: ${path}`).toBe(true);
+      }
+    }
+  );
+
+  it('keeps private apps, shared task links, meeting codes and embeds unindexed', () => {
+    for (const app of [
+      'tasks',
+      'meet',
+      'parley',
+      'chat',
+      'ai',
+      'infrastructure',
+    ] as const) {
+      for (const path of [
+        '/',
+        '/personal',
+        '/vi/workspace-id',
+        '/shared/task/secret',
+        '/r/secret',
+      ]) {
+        expect(blocked(app, path), `${app}: ${path}`).toBe(true);
+      }
+    }
+    expect(blocked('forms', '/embed/share-code')).toBe(true);
+    expect(blocked('forms', '/')).toBe(false);
+    expect(blocked('forms', '/f/share-code')).toBe(false);
+    expect(blocked('forms', '/f/share-code/responses')).toBe(true);
+  });
+
+  it('allows public shops and products but protects buyer transactions', () => {
+    for (const prefix of ['', '/vi', '/en']) {
+      expect(blocked('storefront', `${prefix}/my-store`)).toBe(false);
+      expect(blocked('storefront', `${prefix}/my-store/products/item`)).toBe(
+        false
+      );
+      for (const suffix of [
+        'cart',
+        'checkout',
+        'checkout/success',
+        'orders',
+        'orders/bearer-token',
+      ]) {
+        expect(blocked('storefront', `${prefix}/my-store/${suffix}`)).toBe(
+          true
+        );
+      }
+    }
+  });
+
+  it('limits public education and tool surfaces to their declared pages', () => {
+    expect(blocked('learn', '/')).toBe(false);
+    expect(blocked('learn', '/personal/reports')).toBe(true);
+    expect(blocked('teach', '/personal/attendance')).toBe(true);
+    expect(blocked('tools', '/qr')).toBe(false);
+    expect(blocked('tools', '/qr/unknown')).toBe(true);
+    expect(blocked('nova', '/vi/learn/basic-techniques')).toBe(false);
+    expect(blocked('nova', '/vi/challenges')).toBe(true);
+    expect(blocked('git', '/-/personal/repositories')).toBe(true);
+    expect(blocked('git', '/tutur3u/platform/issues')).toBe(false);
+    expect(blocked('lettin', '/worlds/published-world')).toBe(false);
+    expect(blocked('lettin', '/personal/wiki/world')).toBe(true);
+  });
+
+  it('uses the generated platform allowlist and matches exact route boundaries', () => {
+    const paths: string[] = JSON.parse(
+      readFileSync(
+        resolve(
+          __dirname,
+          '../../../apps/web/src/lib/seo/public-routes.generated.json'
+        ),
+        'utf8'
+      )
+    );
+    const patterns = [...paths.map((path) => path.slice(1)), 'changelog/[^/]+'];
+    for (const path of paths) {
+      expect(blocked('web', path, patterns), path).toBe(false);
+      expect(blocked('web', `/vi${path === '/' ? '' : path}`, patterns)).toBe(
+        false
+      );
+    }
+    for (const path of [
+      '/personal/tasks',
+      '/workspace-id',
+      '/documents/private-id',
+      '/share/document/secret',
+      '/ai/chats/private',
+      '/pricing/unknown',
+    ]) {
+      expect(blocked('web', path, patterns), path).toBe(true);
+    }
+    expect(blocked('web', '/changelog/released', patterns)).toBe(false);
+  });
+
+  it('noindexes all preview URLs and preserves the policy after app headers', async () => {
+    expect(blocked('tools', '/qr', undefined, true)).toBe(true);
+    const config = createTuturuuuNextConfig({
+      seoApp: 'learn',
+      headers: async () => [
+        {
+          source: '/login',
+          headers: [{ key: 'X-Robots-Tag', value: 'index' }],
+        },
+      ],
+    });
+    const rules = await config.headers?.();
+    expect(rules?.at(-1)?.headers[0]?.value).toBe(
+      'noindex, nofollow, nosnippet'
+    );
+    expect(config).not.toHaveProperty('seoApp');
+  });
+
+  it('registers every Next app and prevents static/metadata route conflicts', () => {
+    const root = resolve(__dirname, '../../..');
+    for (const app of Object.keys(APP_SEO_POLICY)) {
+      const config = readFileSync(
+        resolve(root, `apps/${app}/next.config.ts`),
+        'utf8'
+      );
+      expect(config).toContain(`seoApp: '${app}'`);
+      for (const file of ['robots', 'sitemap']) {
+        expect(
+          existsSync(resolve(root, `apps/${app}/src/app/${file}.ts`)) &&
+            existsSync(
+              resolve(
+                root,
+                `apps/${app}/public/${file === 'robots' ? 'robots.txt' : 'sitemap.xml'}`
+              )
+            )
+        ).toBe(false);
+      }
+    }
+  });
+});

package/src/seo.ts

@@ -0,0 +1,49 @@
+import policy from './seo-policy.json';
+
+export type SeoApp = keyof typeof policy;
+export const APP_SEO_POLICY = policy;
+export const PRIVATE_ROBOTS_HEADER = 'noindex, nofollow, nosnippet';
+
+// These remain private even where a public dynamic slug pattern could match.
+const PRIVATE_PATH_PATTERN =
+  '(?:api|auth|login|logout|signup|verify-token|auth-error|add-account|dashboard|onboarding|invite|shared|share|embed|orders|cart|checkout|account|no-access|access-denied|not-whitelisted|not-available|-)(?:/|$)';
+
+function escapeRegex(value: string) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/** Next path-to-regexp fragments; every public pattern must match a whole URL. */
+export function createSeoHeaders(
+  app: SeoApp,
+  publicPathPatterns?: readonly string[],
+  env: Record<string, string | undefined> = process.env
+) {
+  const appPolicy = policy[app];
+  const publicPatterns = publicPathPatterns ?? [
+    ...appPolicy.publicPaths.map(escapeRegex),
+    ...appPolicy.publicPatterns,
+  ];
+  const isPreview =
+    env.VERCEL_ENV === 'preview' ||
+    env.VERCEL_ENV === 'development' ||
+    env.NODE_ENV === 'development' ||
+    env.TUTURUUU_NOINDEX === '1';
+  const publicPattern = `(?:${publicPatterns.join('|')})/?$`;
+  const localePrefix = '(?:(?:en|vi)/)?';
+
+  return [
+    {
+      // A header reaches redirects, errors, API responses and non-HTML files.
+      // Preview builds and apps with no explicit public content fail closed.
+      source:
+        isPreview || publicPatterns.length === 0
+          ? '/:path*'
+          : `/:path((?!(?:(?:en|vi)(?:/|$))?${publicPattern}).*)`,
+      headers: [{ key: 'X-Robots-Tag', value: PRIVATE_ROBOTS_HEADER }],
+    },
+    {
+      source: `/:path(${localePrefix}${PRIVATE_PATH_PATTERN}.*)`,
+      headers: [{ key: 'X-Robots-Tag', value: PRIVATE_ROBOTS_HEADER }],
+    },
+  ];
+}