@wervt/nuxt 0.3.0 → 0.3.2

package/README.md

@@ -18,6 +18,8 @@ export default defineNuxtConfig({
 - `useDb()` (server): Drizzle on the app's own schema, with migrations from `drizzle/`.
 - `proxyShape()` (server) and `useShape()` (app): live rows from Postgres via Electric.
 - `useWervtUser()`: the signed-in wervt user, on the server and in the app.
+- `useWervtAccess(event)`: invites on invite-only apps (`wervt access <app> --invite`), as the
+  signed-in user.
 - `useValidatedBody()` / `useValidatedQuery()` / `useValidatedParams()`: valibot validation.
 - `useWervtTrack()`: custom events for wervt's cookieless analytics (page views are counted automatically).
 - `wervt: { feedback: { key } }` and `useWervtFeedback()`: the kontor feedback widget, reports go into a kontor project's triage.

package/dist/module.d.ts

@@ -1,4 +1,5 @@
 import { DevOptions } from "./dev.js";
+import { PreviewOptions } from "./preview.js";
 //#region src/module.d.ts
 export interface ModuleOptions {
   /** App name on wervt. Defaults to the package.json name. */
@@ -37,6 +38,13 @@ export interface ModuleOptions {
    * (it can override a configured key the same way).
    */
   feedback?: FeedbackOptions | boolean;
+  /**
+   * The link preview of a private app, shown without a login when its link is shared in chats.
+   * Defaults to the app's name and icon only; `true` takes title, description, `og:image` and
+   * theme color from `app.head`, an object sets them (falling back to `app.head`). `false`
+   * sends visitors without a login straight to the login, with no preview of the app.
+   */
+  preview?: PreviewOptions | boolean;
 }
 export interface FeedbackOptions {
   /** Public intake key of the kontor project (Project settings → Intake keys). */

package/dist/module.js

@@ -1,6 +1,7 @@
 import { SEED_TASK, unscheduleSeed } from "./seed.js";
 import { resolveAppName, setupDev } from "./dev.js";
 import { findRouteTools } from "./route-tools.js";
+import { localFiles, previewManifest } from "./preview.js";
 import { findShapeRoutes, shapeRoutesTypes, shapesManifest } from "./shapes.js";
 import { addImports, addPlugin, addServerHandler, addServerPlugin, addServerTemplate, addTypeTemplate, createResolver, defineNuxtModule, getNuxtVersion, hasNuxtModule, installModule, updateTemplates, useLogger } from "nuxt/kit";
 import { existsSync } from "node:fs";
@@ -275,6 +276,10 @@ var module_default = defineNuxtModule({
 			method: "get",
 			handler: resolver.resolve("./runtime/server/user-route")
 		});
+		if (nitroMajor >= 3) addServerHandler({
+			route: "/.well-known/oauth-protected-resource",
+			handler: resolver.resolve("./runtime/server/mcp-metadata")
+		});
 		addPlugin({
 			src: resolver.resolve("./runtime/app/plugins/user.client"),
 			mode: "client"
@@ -337,6 +342,20 @@ var module_default = defineNuxtModule({
 				await writeFile(join(serverDir, "wervt-shapes.json"), `${JSON.stringify(shapesManifest(await findShapeRoutes(shapesDir)), null, 2)}\n`);
 			});
 		});
+		if (!nuxt.options.dev) {
+			const app = await resolveAppName(nuxt.options.rootDir, options.app);
+			const publicDir = resolve(nuxt.options.rootDir, nuxt.options.dir.public);
+			const favicon = FAVICONS.find((file) => existsSync(join(publicDir, file)));
+			const manifest = previewManifest(options.preview, nuxt.options.app.head, app, favicon && `/${favicon}`);
+			for (const file of localFiles(manifest)) if (!existsSync(join(publicDir, file))) logger.warn(`The link preview names \`${file}\`, which isn't in public/.`);
+			nuxt.hook("nitro:init", (instance) => {
+				const { serverDir } = instance.options.output;
+				instance.hooks.hook("compiled", async () => {
+					await mkdir(serverDir, { recursive: true });
+					await writeFile(join(serverDir, "wervt-preview.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+				});
+			});
+		}
 		nuxt.options.build.transpile.push(resolver.resolve("./runtime"));
 		addImports([
 			{
@@ -374,6 +393,11 @@ var module_default = defineNuxtModule({
 		]);
 	}
 });
+const FAVICONS = [
+	"favicon.png",
+	"favicon.svg",
+	"favicon.ico"
+];
 const TOOL_EXTENSIONS = /* @__PURE__ */ new Set([
 	".ts",
 	".js",

package/dist/preview.d.ts

@@ -0,0 +1,14 @@
+//#region src/preview.d.ts
+export interface PreviewOptions {
+  /** Defaults to the app's `app.head.title`. */
+  title?: string;
+  /** Defaults to the app's `description` or `og:description` meta tag. */
+  description?: string;
+  /** A file in `public/` (`/og.png`, ideally 1200×630) or an https URL. Defaults to `og:image`. */
+  image?: string;
+  /** A file in `public/` or an https URL. Defaults to the app's `<link rel="icon">` or favicon. */
+  icon?: string;
+  /** Defaults to the app's `theme-color` meta tag. */
+  themeColor?: string;
+}
+//#endregion

package/dist/preview.js

@@ -0,0 +1,39 @@
+//#region src/preview.ts
+/**
+* What the runtime shows. Without `preview`, only the app's name and icon: for some private apps
+* the title alone says too much, so the rest of the head is only used once the app opts in.
+*/
+function previewManifest(option, head, app, favicon) {
+	if (option === false) return false;
+	const icon = headIcon(head) ?? favicon;
+	if (option === void 0) return {
+		title: app,
+		icon
+	};
+	const fromHead = {
+		title: typeof head.title === "string" && head.title ? head.title : app,
+		description: headMeta(head, "description") ?? headMeta(head, "og:description"),
+		image: headMeta(head, "og:image"),
+		icon,
+		themeColor: headMeta(head, "theme-color")
+	};
+	if (option === true) return fromHead;
+	const manifest = { ...fromHead };
+	for (const [key, value] of Object.entries(option)) if (typeof value === "string" && value) manifest[key] = value;
+	return manifest;
+}
+function headMeta(head, key) {
+	const tag = head.meta?.find((meta) => meta.name === key || meta.property === key);
+	return typeof tag?.content === "string" && tag.content ? tag.content : void 0;
+}
+function headIcon(head) {
+	const link = head.link?.find((link) => link.rel === "icon" || link.rel === "shortcut icon");
+	return typeof link?.href === "string" && link.href ? link.href : void 0;
+}
+/** Local files the manifest names (not URLs), to check they're in `public/`. */
+function localFiles(manifest) {
+	if (!manifest) return [];
+	return [manifest.image, manifest.icon].filter((path) => !!path && path.startsWith("/") && !path.startsWith("//"));
+}
+//#endregion
+export { localFiles, previewManifest };

package/dist/runtime/server/access.d.ts

@@ -0,0 +1,34 @@
+import { RequestEvent } from "nuxt/server";
+//#region src/runtime/server/access.d.ts
+export interface WervtInvite {
+  email: string;
+  /** Who invited them. */
+  by: string;
+  /** ISO time. */
+  at: string;
+}
+export interface WervtAccess {
+  /** Lets `email` into the app. `invited` is false when they could already get in. */
+  invite(email: string): Promise<{
+    email: string;
+    invited: boolean;
+  }>;
+  /** Takes back an invite (not the owner's allow list). */
+  revoke(email: string): Promise<{
+    email: string;
+    revoked: boolean;
+  }>;
+  /** Everyone the app invited, with who invited them and when. */
+  list(): Promise<WervtInvite[]>;
+}
+/**
+ * Invites on an invite-only app (`wervt access <app> --invite`), as the user of this request: the
+ * runtime vouches for them, and only someone with access can invite. Everyone with access may
+ * invite; restrict it in the route if the app has its own roles.
+ *
+ * Throws with the platform's status: 401 without a signed-in user, 403 when they have no access,
+ * 409 when the app isn't invite-only, 429 past the limits (25 invites per person and day, 500 per
+ * app).
+ */
+export declare function useWervtAccess(event: RequestEvent): WervtAccess;
+//#endregion

package/dist/runtime/server/access.js

@@ -0,0 +1,87 @@
+import { DEV_LOGIN_COOKIE, devUser } from "../shared/user.js";
+import { createError, getCookie } from "nuxt/server";
+//#region src/runtime/server/access.ts
+const devInvites = [];
+/**
+* Invites on an invite-only app (`wervt access <app> --invite`), as the user of this request: the
+* runtime vouches for them, and only someone with access can invite. Everyone with access may
+* invite; restrict it in the route if the app has its own roles.
+*
+* Throws with the platform's status: 401 without a signed-in user, 403 when they have no access,
+* 409 when the app isn't invite-only, 429 past the limits (25 invites per person and day, 500 per
+* app).
+*/
+function useWervtAccess(event) {
+	const runtime = process.env.WERVT_RUNTIME_URL;
+	if (!runtime) return devAccess(event);
+	async function call(method, body) {
+		const res = await fetch(new URL("/_wervt/access", runtime), {
+			method,
+			headers: {
+				"content-type": "application/json",
+				"x-wervt-app": process.env.WERVT_APP ?? "",
+				"x-wervt-token": process.env.WERVT_TOKEN ?? "",
+				"x-wervt-user": event.req.headers.get("x-wervt-user") ?? "",
+				"x-wervt-user-proof": event.req.headers.get("x-wervt-user-proof") ?? ""
+			},
+			body: body && JSON.stringify(body)
+		});
+		const data = await res.json().catch(() => ({}));
+		if (!res.ok) throw createError({
+			status: res.status,
+			message: data.error ?? `access ${res.status}`
+		});
+		return data;
+	}
+	return {
+		invite: (email) => call("POST", { email }),
+		revoke: (email) => call("DELETE", { email }),
+		list: async () => (await call("GET")).invited
+	};
+}
+function devAccess(event) {
+	const user = devUser(getCookie(event, DEV_LOGIN_COOKIE) === "1");
+	const by = () => {
+		if (!user) throw createError({
+			status: 401,
+			message: "sign in at /_wervt/login first"
+		});
+		return user.email;
+	};
+	return {
+		async invite(email) {
+			const inviter = by();
+			email = email.trim().toLowerCase();
+			if (devInvites.some((invite) => invite.email === email)) return {
+				email,
+				invited: false
+			};
+			devInvites.push({
+				email,
+				by: inviter,
+				at: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			console.info(`[access] ${inviter} invited ${email} (dev: not stored)`);
+			return {
+				email,
+				invited: true
+			};
+		},
+		async revoke(email) {
+			by();
+			email = email.trim().toLowerCase();
+			const index = devInvites.findIndex((invite) => invite.email === email);
+			if (index >= 0) devInvites.splice(index, 1);
+			return {
+				email,
+				revoked: index >= 0
+			};
+		},
+		async list() {
+			by();
+			return [...devInvites];
+		}
+	};
+}
+//#endregion
+export { useWervtAccess };

package/dist/runtime/server/index.d.ts

@@ -1,5 +1,6 @@
 import { WervtUser } from "../shared/user.js";
 import { EmailProps, RenderedEmail, renderEmail } from "../email/render.js";
+import { WervtAccess, WervtInvite, useWervtAccess } from "./access.js";
 import { useDb } from "./db.js";
 import { createEvlogError, log, useLogger } from "./logger.js";
 import { SendMailOptions, sendMail } from "./mail.js";
@@ -11,4 +12,4 @@ import { Task, TaskEvent, TaskResult, defineTask } from "./tasks.js";
 import { SafeResult, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, vh } from "./validate.js";
 import { Tool, ToolRoute, defineTool, defineToolRoute } from "./tools.js";
 import { useWervtUser } from "./user.js";
-export { type EmailProps, type McpTokenContext, type RenderedEmail, type SafeResult, type SendMailOptions, type ShapeOptions, type ShapeResponse, type ShapeRow, type Task, type TaskEvent, type TaskResult, type Tool, type ToolRoute, type WervtUser, createEvlogError, defineTask, defineTool, defineToolRoute, log, proxyShape, renderEmail, seedTable, sendMail, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtUser, vh };
+export { type EmailProps, type McpTokenContext, type RenderedEmail, type SafeResult, type SendMailOptions, type ShapeOptions, type ShapeResponse, type ShapeRow, type Task, type TaskEvent, type TaskResult, type Tool, type ToolRoute, type WervtAccess, type WervtInvite, type WervtUser, createEvlogError, defineTask, defineTool, defineToolRoute, log, proxyShape, renderEmail, seedTable, sendMail, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtAccess, useWervtUser, vh };

package/dist/runtime/server/index.js

@@ -1,5 +1,6 @@
-import { renderEmail } from "../email/render.js";
+import { useWervtAccess } from "./access.js";
 import { useDb } from "./db.js";
+import { renderEmail } from "../email/render.js";
 import { createEvlogError, log, useLogger } from "./logger.js";
 import { sendMail } from "./mail.js";
 import { seedTable } from "./seed.js";
@@ -8,4 +9,4 @@ import { defineTask } from "./tasks.js";
 import { useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, vh } from "./validate.js";
 import { defineTool, defineToolRoute } from "./tools.js";
 import { useWervtUser } from "./user.js";
-export { createEvlogError, defineTask, defineTool, defineToolRoute, log, proxyShape, renderEmail, seedTable, sendMail, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtUser, vh };
+export { createEvlogError, defineTask, defineTool, defineToolRoute, log, proxyShape, renderEmail, seedTable, sendMail, useDb, useLogger, useSafeValidatedBody, useSafeValidatedParams, useSafeValidatedQuery, useValidatedBody, useValidatedParams, useValidatedQuery, useWervtAccess, useWervtUser, vh };

package/dist/runtime/server/mcp-auth.d.ts

@@ -17,7 +17,9 @@ declare module 'nuxt/schema' {
   }
 }
 export interface McpEndpoint {
-  /** This app's `/mcp`, the audience its access tokens must carry. */
+  /** This app's origin, a resource too: tokens for the whole app (native apps) work on `/mcp`. */
+  app: string;
+  /** This app's `/mcp`, the audience MCP clients' access tokens carry. */
   resource: string;
   /** wervt's login as OAuth issuer, e.g. `https://auth.wervt.app/api/auth`. */
   issuer: string;
@@ -36,8 +38,8 @@ export declare const CORS: {
   'access-control-allow-headers': string;
   'access-control-max-age': string;
 };
-/** RFC 9728: tells MCP clients which login issues tokens for `/mcp`. */
-export declare function protectedResourceMetadata(endpoint: McpEndpoint): {
+/** RFC 9728: tells clients which login issues tokens for `resource` (`/mcp` or the app). */
+export declare function protectedResourceMetadata(endpoint: McpEndpoint, resource?: string): {
   resource: string;
   authorization_servers: string[];
   bearer_methods_supported: string[];

package/dist/runtime/server/mcp-auth.js

@@ -12,6 +12,7 @@ function mcpEndpoint(event) {
 	if (!authUrl) return void 0;
 	const appUrl = trimSlash(process.env.WERVT_APP_URL ?? getRequestURL(event).origin);
 	return {
+		app: appUrl,
 		resource: `${appUrl}/mcp`,
 		issuer: `${trimSlash(authUrl)}/api/auth`,
 		metadataUrl: `${appUrl}/.well-known/oauth-protected-resource/mcp`
@@ -24,10 +25,10 @@ const CORS = {
 	"access-control-allow-headers": "*",
 	"access-control-max-age": "86400"
 };
-/** RFC 9728: tells MCP clients which login issues tokens for `/mcp`. */
-function protectedResourceMetadata(endpoint) {
+/** RFC 9728: tells clients which login issues tokens for `resource` (`/mcp` or the app). */
+function protectedResourceMetadata(endpoint, resource = endpoint.resource) {
 	return {
-		resource: endpoint.resource,
+		resource,
 		authorization_servers: [endpoint.issuer],
 		bearer_methods_supported: ["header"],
 		scopes_supported: [
@@ -36,7 +37,7 @@ function protectedResourceMetadata(endpoint) {
 			"email",
 			"offline_access"
 		],
-		resource_name: new URL(endpoint.resource).hostname.split(".")[0]
+		resource_name: new URL(resource).hostname.split(".")[0]
 	};
 }
 /**
@@ -69,7 +70,7 @@ async function verifyAccessToken(token, endpoint) {
 	try {
 		const { payload } = await jwtVerify(token, keySet(endpoint.issuer), {
 			issuer: endpoint.issuer,
-			audience: endpoint.resource,
+			audience: [endpoint.resource, endpoint.app],
 			requiredClaims: ["exp", "sub"],
 			clockTolerance: 5
 		});

package/dist/runtime/server/mcp-metadata.js

@@ -1,5 +1,5 @@
 import { CORS, mcpEndpoint, protectedResourceMetadata } from "./mcp-auth.js";
-import { defineEventHandler } from "nuxt/server";
+import { defineEventHandler, getRequestURL } from "nuxt/server";
 //#region src/runtime/server/mcp-metadata.ts
 var mcp_metadata_default = defineEventHandler((event) => {
 	const endpoint = mcpEndpoint(event);
@@ -8,7 +8,8 @@ var mcp_metadata_default = defineEventHandler((event) => {
 		headers: CORS
 	});
 	if (!endpoint) return Response.json({ error: "No login configured." }, { status: 404 });
-	return Response.json(protectedResourceMetadata(endpoint), { headers: CORS });
+	const mcp = getRequestURL(event).pathname.endsWith("/mcp");
+	return Response.json(protectedResourceMetadata(endpoint, mcp ? endpoint.resource : endpoint.app), { headers: CORS });
 });
 //#endregion
 export { mcp_metadata_default as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wervt/nuxt",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Nuxt module for apps hosted on wervt: database, live data, MCP and runtime setup.",
   "keywords": [
     "drizzle",