chapterhouse 0.1.1

package/dist/api/errors.js

@@ -0,0 +1,95 @@
+import { ZodError } from "zod";
+export class HttpError extends Error {
+    statusCode;
+    expose;
+    constructor(statusCode, message, expose = statusCode < 500) {
+        super(message);
+        this.statusCode = statusCode;
+        this.expose = expose;
+        this.name = new.target.name;
+    }
+}
+export class BadRequestError extends HttpError {
+    constructor(message) {
+        super(400, message);
+    }
+}
+export class UnauthorizedError extends HttpError {
+    constructor(message = "Unauthorized") {
+        super(401, message);
+    }
+}
+export class ForbiddenError extends HttpError {
+    constructor(message = "Forbidden") {
+        super(403, message);
+    }
+}
+export class NotFoundError extends HttpError {
+    constructor(message = "Not found") {
+        super(404, message);
+    }
+}
+export class InternalServerError extends HttpError {
+    constructor(message = "Internal server error", expose = false) {
+        super(500, message, expose);
+    }
+}
+function isBodyParserSyntaxError(error) {
+    if (!(error instanceof SyntaxError)) {
+        return false;
+    }
+    const candidate = error;
+    return candidate.status === 400 && candidate.type === "entity.parse.failed";
+}
+function formatZodError(error) {
+    return error.issues[0]?.message ?? "Invalid request";
+}
+export function parseRequest(schema, input) {
+    const parsed = schema.safeParse(input);
+    if (!parsed.success) {
+        throw new BadRequestError(formatZodError(parsed.error));
+    }
+    return parsed.data;
+}
+export function asBadRequest(error) {
+    if (error instanceof HttpError) {
+        throw error;
+    }
+    throw new BadRequestError(error instanceof Error ? error.message : "Invalid request");
+}
+export function apiNotFoundHandler(req, _res, next) {
+    if (req.path === "/stream" || req.path.startsWith("/api/")) {
+        next(new NotFoundError("Not found"));
+        return;
+    }
+    next();
+}
+export function createApiErrorHandler() {
+    return (error, req, res, next) => {
+        if (res.headersSent) {
+            next(error);
+            return;
+        }
+        if (isBodyParserSyntaxError(error)) {
+            res.status(400).json({ error: "Invalid JSON request body" });
+            return;
+        }
+        if (error instanceof ZodError) {
+            res.status(400).json({ error: formatZodError(error) });
+            return;
+        }
+        if (error instanceof HttpError) {
+            if (error.statusCode >= 500) {
+                console.error(`[api] ${req.method} ${req.originalUrl} failed:`, error);
+            }
+            else if (error.statusCode === 401 || error.statusCode === 403) {
+                console.warn(`[api] ${req.method} ${req.originalUrl} denied: ${error.message}`);
+            }
+            res.status(error.statusCode).json({ error: error.expose ? error.message : "Internal server error" });
+            return;
+        }
+        console.error(`[api] ${req.method} ${req.originalUrl} failed:`, error);
+        res.status(500).json({ error: "Internal server error" });
+    };
+}
+//# sourceMappingURL=errors.js.map

package/dist/api/errors.test.js

@@ -0,0 +1,89 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { createServer } from "node:http";
+import express from "express";
+import { z } from "zod";
+import { BadRequestError, InternalServerError, NotFoundError, apiNotFoundHandler, createApiErrorHandler, parseRequest } from "./errors.js";
+async function withServer(app, run) {
+    const server = createServer(app);
+    await new Promise((resolve) => {
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const address = server.address();
+    assert.ok(address && typeof address === "object", "server should expose a bound address");
+    try {
+        await run(`http://127.0.0.1:${address.port}`);
+    }
+    finally {
+        await new Promise((resolve, reject) => {
+            server.close((err) => (err ? reject(err) : resolve()));
+        });
+    }
+}
+test("centralized error handler returns JSON for invalid JSON bodies", async () => {
+    const app = express();
+    app.use(express.json());
+    app.post("/api/test", (_req, res) => {
+        res.json({ ok: true });
+    });
+    app.use(createApiErrorHandler());
+    await withServer(app, async (baseUrl) => {
+        const response = await fetch(`${baseUrl}/api/test`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: "{bad json",
+        });
+        assert.equal(response.status, 400);
+        assert.deepEqual(await response.json(), { error: "Invalid JSON request body" });
+    });
+});
+test("centralized error handler returns HTTP errors as JSON", async () => {
+    const app = express();
+    app.get("/api/missing", () => {
+        throw new NotFoundError("Task not found");
+    });
+    app.use(createApiErrorHandler());
+    await withServer(app, async (baseUrl) => {
+        const response = await fetch(`${baseUrl}/api/missing`);
+        assert.equal(response.status, 404);
+        assert.deepEqual(await response.json(), { error: "Task not found" });
+    });
+});
+test("parseRequest converts Zod failures into bad-request errors", () => {
+    assert.throws(() => parseRequest(z.object({ prompt: z.string({ error: "Missing 'prompt' in request body" }).min(1, "Missing 'prompt' in request body") }), {}), (error) => error instanceof BadRequestError && error.message === "Missing 'prompt' in request body");
+});
+test("api not-found handler returns JSON for unknown API routes", async () => {
+    const app = express();
+    app.use(apiNotFoundHandler);
+    app.use(createApiErrorHandler());
+    await withServer(app, async (baseUrl) => {
+        const response = await fetch(`${baseUrl}/api/unknown`);
+        assert.equal(response.status, 404);
+        assert.deepEqual(await response.json(), { error: "Not found" });
+    });
+});
+test("centralized error handler hides internal error details", async () => {
+    const app = express();
+    const originalConsoleError = console.error;
+    const logged = [];
+    console.error = (...args) => {
+        logged.push(args);
+    };
+    try {
+        app.get("/api/failure", () => {
+            throw new InternalServerError("do not leak", false);
+        });
+        app.use(createApiErrorHandler());
+        await withServer(app, async (baseUrl) => {
+            const response = await fetch(`${baseUrl}/api/failure`);
+            assert.equal(response.status, 500);
+            assert.deepEqual(await response.json(), { error: "Internal server error" });
+        });
+        assert.equal(logged.length, 1);
+        assert.equal(logged[0]?.[0], "[api] GET /api/failure failed:");
+    }
+    finally {
+        console.error = originalConsoleError;
+    }
+});
+//# sourceMappingURL=errors.test.js.map

package/dist/api/rate-limit.js

@@ -0,0 +1,85 @@
+export function getClientIp(req) {
+    const ip = typeof req.ip === "string" && req.ip.trim().length > 0
+        ? req.ip.trim()
+        : req.socket.remoteAddress?.trim() || "unknown";
+    return ip.startsWith("::ffff:") ? ip.slice(7) : ip;
+}
+function writeRateLimitResponse(req, res, retryAfterSeconds, fallbackMessage, onLimit) {
+    if (onLimit) {
+        onLimit(req, res, retryAfterSeconds);
+        return;
+    }
+    res.setHeader("Retry-After", String(retryAfterSeconds));
+    res.status(429).json({ error: fallbackMessage.replace("{retryAfterSeconds}", String(retryAfterSeconds)) });
+}
+export function createFixedWindowRateLimiter(options) {
+    const buckets = new Map();
+    const keyGenerator = options.keyGenerator ?? getClientIp;
+    const now = options.now ?? (() => Date.now());
+    let seenRequests = 0;
+    function pruneExpiredBuckets(currentTime) {
+        for (const [key, bucket] of buckets) {
+            if (bucket.resetAt <= currentTime) {
+                buckets.delete(key);
+            }
+        }
+    }
+    return function fixedWindowRateLimiter(req, res, next) {
+        if (options.skip?.(req)) {
+            next();
+            return;
+        }
+        const currentTime = now();
+        const key = keyGenerator(req);
+        const currentBucket = buckets.get(key);
+        const bucket = !currentBucket || currentBucket.resetAt <= currentTime
+            ? { count: 0, resetAt: currentTime + options.windowMs }
+            : currentBucket;
+        bucket.count += 1;
+        buckets.set(key, bucket);
+        const retryAfterSeconds = Math.max(1, Math.ceil((bucket.resetAt - currentTime) / 1000));
+        res.setHeader("X-RateLimit-Limit", String(options.maxRequests));
+        res.setHeader("X-RateLimit-Remaining", String(Math.max(0, options.maxRequests - bucket.count)));
+        res.setHeader("X-RateLimit-Reset", String(Math.ceil(bucket.resetAt / 1000)));
+        if (bucket.count > options.maxRequests) {
+            writeRateLimitResponse(req, res, retryAfterSeconds, "Too many requests. Retry after {retryAfterSeconds} seconds.", options.onLimit);
+            return;
+        }
+        seenRequests += 1;
+        if (seenRequests % 250 === 0) {
+            pruneExpiredBuckets(currentTime);
+        }
+        next();
+    };
+}
+export function createConcurrentConnectionLimiter(options) {
+    const activeConnections = new Map();
+    const keyGenerator = options.keyGenerator ?? getClientIp;
+    return function concurrentConnectionLimiter(req, res, next) {
+        const key = keyGenerator(req);
+        const current = activeConnections.get(key) ?? 0;
+        if (current >= options.maxConnections) {
+            writeRateLimitResponse(req, res, 60, "Too many concurrent stream connections. Retry after {retryAfterSeconds} seconds.", options.onLimit);
+            return;
+        }
+        activeConnections.set(key, current + 1);
+        let released = false;
+        const release = () => {
+            if (released) {
+                return;
+            }
+            released = true;
+            const remaining = activeConnections.get(key) ?? 0;
+            if (remaining <= 1) {
+                activeConnections.delete(key);
+                return;
+            }
+            activeConnections.set(key, remaining - 1);
+        };
+        res.on("finish", release);
+        res.on("close", release);
+        req.on("close", release);
+        next();
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/api/server-runtime.js

@@ -0,0 +1,62 @@
+import { existsSync, readFileSync } from "fs";
+export function resolveApiToken({ envToken, tokenPath, exists = existsSync, readFile = readFileSync, }) {
+    const trimmedEnvToken = envToken?.trim();
+    if (trimmedEnvToken) {
+        return trimmedEnvToken;
+    }
+    if (exists(tokenPath)) {
+        const persistedToken = readFile(tokenPath, "utf-8").trim();
+        return persistedToken.length > 0 ? persistedToken : null;
+    }
+    return null;
+}
+export function assertAuthenticationConfigured(options) {
+    void options;
+}
+export function createHealthPayload(now = new Date()) {
+    return {
+        status: "ok",
+        timestamp: now.toISOString(),
+    };
+}
+export function createPublicConfigPayload(config) {
+    if (!config.entraAuthEnabled) {
+        return {
+            appName: "Chapterhouse",
+            entraAuthEnabled: false,
+            standalone: config.standaloneMode,
+        };
+    }
+    return {
+        appName: "Chapterhouse",
+        entraAuthEnabled: true,
+        entraClientId: config.entraClientId,
+        entraTenantId: config.entraTenantId,
+    };
+}
+export function shouldServeSpaPath(pathname) {
+    return !pathname.startsWith("/api/")
+        && pathname !== "/stream"
+        && pathname !== "/status"
+        && pathname !== "/health";
+}
+export function getDisplayHost(host) {
+    return host === "0.0.0.0" || host === "::" || host === "127.0.0.1" || host === "::1" ? "localhost" : host;
+}
+export function buildHistoryEntries(pageIds, options) {
+    const resolveWikiPath = options?.resolveWikiPath ?? ((pageId) => pageId);
+    const stat = options?.stat;
+    return pageIds
+        .map((pageId) => {
+        try {
+            const fullPath = resolveWikiPath(pageId);
+            const mtime = stat ? stat(fullPath).mtimeMs : 0;
+            return { path: pageId, mtime };
+        }
+        catch {
+            return { path: pageId, mtime: 0 };
+        }
+    })
+        .sort((a, b) => b.mtime - a.mtime);
+}
+//# sourceMappingURL=server-runtime.js.map