@xexr/blog-platform 1.0.7 → 1.0.8

package/dist/lib/article-ui.ts

@@ -0,0 +1,158 @@
+import { format, formatDistanceToNow } from "date-fns";
+import type { CSSProperties } from "react";
+
+export interface BlogTheme {
+  accentColor?: string;
+  accentHoverColor?: string;
+  textAccentColor?: string;
+  textAccentHoverColor?: string;
+  accentBackgroundColor?: string;
+  accentBorderColor?: string;
+}
+
+export interface TocItem {
+  id: string;
+  text: string;
+  level: 2 | 3;
+}
+
+export interface ArticleDateMeta {
+  publishedDateLabel: string;
+  publishedRelativeLabel: string;
+  updatedDateLabel: string;
+  isUpdated: boolean;
+}
+
+export interface TocItemState {
+  isActive: boolean;
+  ariaCurrent: "location" | undefined;
+}
+
+export type BlogThemeStyle = CSSProperties & {
+  "--blog-accent": string;
+  "--blog-accent-hover": string;
+  "--blog-text-accent": string;
+  "--blog-text-accent-hover": string;
+  "--blog-accent-bg": string;
+  "--blog-accent-border": string;
+};
+
+const DEFAULT_THEME: Required<BlogTheme> = {
+  accentColor: "hsl(var(--primary))",
+  accentHoverColor: "hsl(var(--primary))",
+  textAccentColor: "hsl(var(--primary))",
+  textAccentHoverColor: "hsl(var(--primary))",
+  accentBackgroundColor: "hsl(var(--primary) / 0.08)",
+  accentBorderColor: "hsl(var(--primary) / 0.25)",
+};
+
+export function getBlogThemeStyle(theme: BlogTheme = {}): BlogThemeStyle {
+  return {
+    "--blog-accent": theme.accentColor ?? DEFAULT_THEME.accentColor,
+    "--blog-accent-hover":
+      theme.accentHoverColor ?? DEFAULT_THEME.accentHoverColor,
+    "--blog-text-accent":
+      theme.textAccentColor ?? theme.accentColor ?? DEFAULT_THEME.textAccentColor,
+    "--blog-text-accent-hover":
+      theme.textAccentHoverColor ??
+      theme.accentHoverColor ??
+      DEFAULT_THEME.textAccentHoverColor,
+    "--blog-accent-bg":
+      theme.accentBackgroundColor ?? DEFAULT_THEME.accentBackgroundColor,
+    "--blog-accent-border":
+      theme.accentBorderColor ?? DEFAULT_THEME.accentBorderColor,
+  };
+}
+
+export function formatArticleDateMeta(
+  publishedAt: string,
+  updatedAt: string,
+): ArticleDateMeta {
+  const publishedDate = new Date(publishedAt);
+  const updatedDate = new Date(updatedAt);
+
+  return {
+    publishedDateLabel: format(publishedDate, "d MMMM yyyy"),
+    publishedRelativeLabel: formatDistanceToNow(publishedDate, {
+      addSuffix: true,
+    }),
+    updatedDateLabel: format(updatedDate, "d MMMM yyyy"),
+    isUpdated: updatedDate.getTime() !== publishedDate.getTime(),
+  };
+}
+
+export function extractTableOfContents(markdown: string): TocItem[] {
+  const items: TocItem[] = [];
+  let inFence = false;
+
+  for (const line of markdown.split("\n")) {
+    if (/^\s*```/.test(line)) {
+      inFence = !inFence;
+      continue;
+    }
+
+    if (inFence) {
+      continue;
+    }
+
+    const match = /^(#{2,3})\s+(.+?)\s*#*\s*$/.exec(line);
+    if (!match?.[1] || !match[2]) {
+      continue;
+    }
+
+    const text = stripMarkdownInline(match[2]);
+    if (!text) {
+      continue;
+    }
+
+    items.push({
+      id: slugifyHeading(text),
+      text,
+      level: match[1].length as 2 | 3,
+    });
+  }
+
+  return items;
+}
+
+export function formatTableOfContentsSummary(count: number): string {
+  return `${count} ${count === 1 ? "section" : "sections"}`;
+}
+
+export function normalizeReadingProgress(progress: number): number {
+  if (!Number.isFinite(progress)) {
+    return 0;
+  }
+
+  return Math.min(100, Math.max(0, progress));
+}
+
+export function getTocItemState(
+  itemId: string,
+  activeItemId: string | null,
+): TocItemState {
+  const isActive = itemId === activeItemId;
+
+  return {
+    isActive,
+    ariaCurrent: isActive ? "location" : undefined,
+  };
+}
+
+function stripMarkdownInline(value: string): string {
+  return value
+    .replace(/\[([^\]]+)\]\([^)]+\)/g, "$1")
+    .replace(/[*_`~]/g, "")
+    .replace(/<[^>]+>/g, "")
+    .replace(/\s+/g, " ")
+    .trim();
+}
+
+function slugifyHeading(value: string): string {
+  return value
+    .toLowerCase()
+    .replace(/[^a-z0-9\s-]/g, "")
+    .trim()
+    .replace(/\s+/g, "-")
+    .replace(/-+/g, "-");
+}

package/dist/lib/auth.ts

@@ -0,0 +1,354 @@
+import { type NextRequest } from "next/server";
+import type { PublishResult } from "@/types/contracts";
+
+/**
+ * Authentication configuration interface
+ * Customers can implement this to customize authentication behavior
+ */
+export interface AuthConfig {
+  /**
+   * Validate an authentication token
+   * @param token - The token to validate
+   * @returns Promise that resolves to validation result
+   */
+  validateToken(token: string): Promise<AuthResult>;
+  
+  /**
+   * Extract token from request
+   * @param request - The incoming request
+   * @returns The extracted token or null if not found
+   */
+  extractToken?(request: NextRequest): string | null;
+  
+  /**
+   * Custom error messages for authentication failures
+   */
+  errorMessages?: {
+    missing?: string;
+    invalid?: string;
+    expired?: string;
+  };
+}
+
+/**
+ * Authentication result from token validation
+ */
+export interface AuthResult {
+  /** Whether the token is valid */
+  valid: boolean;
+  
+  /** Error code if invalid */
+  errorCode?: "missing" | "invalid" | "expired";
+  
+  /** Additional user/context information */
+  context?: Record<string, unknown>;
+}
+
+/**
+ * Default token extraction from Authorization header
+ * Supports both "Bearer <token>" and "Token <token>" formats
+ */
+export function extractTokenFromHeader(request: NextRequest): string | null {
+  const authHeader = request.headers.get("Authorization");
+  if (!authHeader) {
+    return null;
+  }
+
+  // Support both "Bearer <token>" and "Token <token>" formats
+  const bearerRegex = /^Bearer\s+(.+)$/i;
+  const bearerMatch = bearerRegex.exec(authHeader);
+  if (bearerMatch?.[1]) {
+    return bearerMatch[1];
+  }
+
+  const tokenRegex = /^Token\s+(.+)$/i;
+  const tokenMatch = tokenRegex.exec(authHeader);
+  if (tokenMatch?.[1]) {
+    return tokenMatch[1];
+  }
+
+  return null;
+}
+
+/**
+ * Simple API key based authentication implementation
+ * Customers can extend this or provide their own AuthConfig
+ */
+export class ApiKeyAuth implements AuthConfig {
+  private validApiKeys: Set<string>;
+  
+  constructor(apiKeys: string[]) {
+    this.validApiKeys = new Set(apiKeys);
+  }
+
+  async validateToken(token: string): Promise<AuthResult> {
+    if (!token?.trim()) {
+      return {
+        valid: false,
+        errorCode: "missing",
+      };
+    }
+
+    if (this.validApiKeys.has(token)) {
+      return {
+        valid: true,
+        context: {
+          tokenHash: this.hashToken(token),
+        },
+      };
+    }
+
+    return {
+      valid: false,
+      errorCode: "invalid",
+    };
+  }
+
+  extractToken = (request: NextRequest): string | null => {
+    return extractTokenFromHeader(request);
+  };
+
+  private hashToken(token: string): string {
+    // Simple hash for logging/debugging (first 8 chars)
+    return token.substring(0, 8) + "...";
+  }
+}
+
+/**
+ * Environment variable based authentication
+ * Reads API keys from environment variables
+ */
+export class EnvAuth extends ApiKeyAuth {
+  constructor(envVarName = "BLOG_PLATFORM_API_KEYS") {
+    let apiKeysEnv = process.env[envVarName];
+
+    // Backwards compatibility: fall back to BLOG_AUTH_TOKEN when using default env var
+    if (!apiKeysEnv && envVarName === "BLOG_PLATFORM_API_KEYS") {
+      apiKeysEnv = process.env.BLOG_AUTH_TOKEN;
+    }
+
+    const apiKeys = apiKeysEnv ? apiKeysEnv.split(",").map((key) => key.trim()).filter(Boolean) : [];
+
+    if (apiKeys.length === 0) {
+      const hint = envVarName === "BLOG_PLATFORM_API_KEYS"
+        ? " (set BLOG_PLATFORM_API_KEYS or BLOG_AUTH_TOKEN)"
+        : "";
+      console.warn(
+        `⚠️  No API keys found in environment variable ${envVarName}${hint}. Authentication will fail for all requests.`,
+      );
+    }
+
+    super(apiKeys);
+  }
+}
+
+/**
+ * No-op authentication for development/testing
+ * WARNING: Never use this in production!
+ */
+export class NoAuth implements AuthConfig {
+  async validateToken(): Promise<AuthResult> {
+    return {
+      valid: true,
+      context: {
+        development: true,
+      },
+    };
+  }
+
+  extractToken(): string | null {
+    return "development-mode";
+  }
+}
+
+/**
+ * Uninitialized authentication - rejects all requests
+ * This is the secure default before initialization
+ */
+export class UninitializedAuth implements AuthConfig {
+  private hasWarned = false;
+
+  async validateToken(_token: string): Promise<AuthResult> {
+    if (!this.hasWarned) {
+      console.error(
+        "❌ SECURITY WARNING: Blog platform authentication not initialized! " +
+        "All requests will be rejected. Call initBlogPlatform() to configure authentication."
+      );
+      this.hasWarned = true;
+    }
+
+    return {
+      valid: false,
+      errorCode: "invalid",
+    };
+  }
+
+  // Don't override extractToken - use default header extraction
+  // Don't override error messages - use defaults so users see
+  // "Invalid authentication credentials" instead of confusing
+  // "platform not initialized" messages
+}
+
+declare global {
+  // Using `var` here intentionally to declare a global on Node's globalThis
+  // across module boundaries and hot reloads
+  var __BLOG_PLATFORM_AUTH_CONFIG__: AuthConfig | undefined;
+}
+
+/**
+ * Global authentication configuration
+ * Defaults to UninitializedAuth for security (fail closed)
+ * Stored in globalThis to persist across Next.js dev mode hot reloads
+ */
+function getDefaultAuthConfig(): AuthConfig {
+  globalThis.__BLOG_PLATFORM_AUTH_CONFIG__ ??= new UninitializedAuth();
+  return globalThis.__BLOG_PLATFORM_AUTH_CONFIG__;
+}
+
+/**
+ * Set the authentication configuration
+ * Customers should call this in their app initialization
+ */
+export function setAuthConfig(config: AuthConfig): void {
+  globalThis.__BLOG_PLATFORM_AUTH_CONFIG__ = config;
+}
+
+/**
+ * Get the current authentication configuration
+ */
+export function getAuthConfig(): AuthConfig {
+  return globalThis.__BLOG_PLATFORM_AUTH_CONFIG__ ?? getDefaultAuthConfig();
+}
+
+/**
+ * Initialize authentication with environment-based API keys
+ * This is a convenience function for common setups
+ */
+export function initEnvAuth(envVarName?: string): void {
+  setAuthConfig(new EnvAuth(envVarName));
+}
+
+/**
+ * Authenticate an incoming request
+ * @param request - The Next.js request object
+ * @returns Authentication result with token validation
+ */
+export async function authenticateRequest(request: NextRequest): Promise<{
+  authenticated: boolean;
+  result: AuthResult;
+  token: string | null;
+}> {
+  const config = getAuthConfig();
+
+  // Extract token using configured method or default
+  const token = config.extractToken ? config.extractToken(request) : extractTokenFromHeader(request);
+
+  if (!token) {
+    return {
+      authenticated: false,
+      result: {
+        valid: false,
+        errorCode: "missing",
+      },
+      token: null,
+    };
+  }
+
+  // Validate the token
+  const result = await config.validateToken(token);
+
+  return {
+    authenticated: result.valid,
+    result,
+    token,
+  };
+}
+
+/**
+ * Create an authentication error response
+ * @param authResult - The failed authentication result
+ * @param idempotencyKey - Optional idempotency key from request
+ * @returns NextResponse with appropriate error
+ */
+export function createAuthErrorResponse(
+  authResult: AuthResult,
+  idempotencyKey = ""
+): PublishResult {
+  const config = getAuthConfig();
+  const customMessages = config.errorMessages ?? {};
+  
+  let message: string;
+  let code: string;
+  
+  switch (authResult.errorCode) {
+    case "missing":
+      message = customMessages.missing ?? "Authentication token is required";
+      code = "PUB005";
+      break;
+    case "expired":
+      message = customMessages.expired ?? "Authentication token has expired";
+      code = "PUB005";
+      break;
+    case "invalid":
+    default:
+      message = customMessages.invalid ?? "Invalid authentication credentials";
+      code = "PUB005";
+      break;
+  }
+
+  return {
+    success: false,
+    error: {
+      code,
+      message,
+      details: {
+        authError: authResult.errorCode ?? "invalid",
+      },
+    },
+    idempotencyKey,
+  };
+}
+
+/**
+ * Middleware function to protect API endpoints
+ * Usage in route handlers:
+ * 
+ * ```typescript
+ * export async function POST(request: NextRequest) {
+ *   const authCheck = await requireAuth(request);
+ *   if (!authCheck.authenticated) {
+ *     return NextResponse.json(authCheck.error, { status: 401 });
+ *   }
+ *   
+ *   // Continue with authenticated request...
+ * }
+ * ```
+ */
+export async function requireAuth(request: NextRequest): Promise<{
+  authenticated: boolean;
+  error?: PublishResult;
+  context?: Record<string, unknown>;
+}> {
+  const auth = await authenticateRequest(request);
+  
+  if (!auth.authenticated) {
+    return {
+      authenticated: false,
+      error: createAuthErrorResponse(auth.result),
+    };
+  }
+
+  return {
+    authenticated: true,
+    context: auth.result.context,
+  };
+}
+
+/**
+ * Utility to check if current environment should skip authentication
+ * Useful for development and testing
+ */
+export function shouldSkipAuth(): boolean {
+  const skipAuth = process.env.SKIP_BLOG_PLATFORM_AUTH;
+  return skipAuth === "true" || skipAuth === "1" || process.env.NODE_ENV === "test";
+}