collabmd 0.1.18

package/src/domain/file-kind.js

@@ -0,0 +1,104 @@
+const MARKDOWN_FILE_EXTENSIONS = Object.freeze(['.md', '.markdown', '.mdx']);
+const EXCALIDRAW_FILE_EXTENSION = '.excalidraw';
+const MERMAID_FILE_EXTENSIONS = Object.freeze(['.mmd', '.mermaid']);
+const PLANTUML_FILE_EXTENSIONS = Object.freeze(['.puml', '.plantuml']);
+const DIAGRAM_FILE_EXTENSIONS = Object.freeze([
+  EXCALIDRAW_FILE_EXTENSION,
+  ...MERMAID_FILE_EXTENSIONS,
+  ...PLANTUML_FILE_EXTENSIONS,
+]);
+const VAULT_FILE_EXTENSIONS = Object.freeze([
+  ...MARKDOWN_FILE_EXTENSIONS,
+  ...DIAGRAM_FILE_EXTENSIONS,
+]);
+const STRIP_VAULT_EXTENSION_PATTERN = /\.(?:md|markdown|mdx|excalidraw|mmd|mermaid|puml|plantuml)$/i;
+
+function normalizeFilePath(filePath) {
+  return String(filePath ?? '').trim().toLowerCase();
+}
+
+function hasFileExtension(filePath, extensions) {
+  const normalized = normalizeFilePath(filePath);
+  return extensions.some((extension) => normalized.endsWith(extension));
+}
+
+export {
+  DIAGRAM_FILE_EXTENSIONS,
+  EXCALIDRAW_FILE_EXTENSION,
+  MARKDOWN_FILE_EXTENSIONS,
+  MERMAID_FILE_EXTENSIONS,
+  PLANTUML_FILE_EXTENSIONS,
+  VAULT_FILE_EXTENSIONS,
+};
+
+export function getVaultFileKind(filePath) {
+  if (hasFileExtension(filePath, MARKDOWN_FILE_EXTENSIONS)) {
+    return 'markdown';
+  }
+
+  if (hasFileExtension(filePath, [EXCALIDRAW_FILE_EXTENSION])) {
+    return 'excalidraw';
+  }
+
+  if (hasFileExtension(filePath, MERMAID_FILE_EXTENSIONS)) {
+    return 'mermaid';
+  }
+
+  if (hasFileExtension(filePath, PLANTUML_FILE_EXTENSIONS)) {
+    return 'plantuml';
+  }
+
+  return null;
+}
+
+export function getVaultTreeNodeType(filePath) {
+  const kind = getVaultFileKind(filePath);
+  if (!kind) {
+    return null;
+  }
+
+  return kind === 'markdown' ? 'file' : kind;
+}
+
+export function getVaultFileExtension(filePath) {
+  const normalized = normalizeFilePath(filePath);
+  return VAULT_FILE_EXTENSIONS.find((extension) => normalized.endsWith(extension)) ?? '';
+}
+
+export function isMarkdownFilePath(filePath) {
+  return getVaultFileKind(filePath) === 'markdown';
+}
+
+export function isExcalidrawFilePath(filePath) {
+  return getVaultFileKind(filePath) === 'excalidraw';
+}
+
+export function isMermaidFilePath(filePath) {
+  return getVaultFileKind(filePath) === 'mermaid';
+}
+
+export function isPlantUmlFilePath(filePath) {
+  return getVaultFileKind(filePath) === 'plantuml';
+}
+
+export function isDiagramFilePath(filePath) {
+  const kind = getVaultFileKind(filePath);
+  return kind === 'excalidraw' || kind === 'mermaid' || kind === 'plantuml';
+}
+
+export function isVaultFilePath(filePath) {
+  return getVaultFileKind(filePath) !== null;
+}
+
+export function supportsCommentsForFilePath(filePath) {
+  const kind = getVaultFileKind(filePath);
+  return kind === 'markdown' || kind === 'mermaid' || kind === 'plantuml';
+}
+
+export function supportsBacklinksForFilePath(filePath) {
+  return isMarkdownFilePath(filePath);
+}
+
+export function stripVaultFileExtension(name) {
+  return String(name ?? '').replace(STRIP_VAULT_EXTENSION_PATTERN, '');
+}

package/src/domain/wiki-link-resolver.js

@@ -0,0 +1,75 @@
+function normalizeWikiTarget(target) {
+  const trimmed = String(target ?? '').trim();
+  if (!trimmed) {
+    return null;
+  }
+
+  return trimmed.endsWith('.md') ? trimmed : `${trimmed}.md`;
+}
+
+export function createWikiTargetIndex(files = []) {
+  const exactPaths = new Set();
+  const pathWithoutMd = new Map();
+  const suffixMatch = new Map();
+
+  for (const filePath of files) {
+    if (typeof filePath !== 'string' || filePath.length === 0) {
+      continue;
+    }
+
+    exactPaths.add(filePath);
+
+    const rawPath = filePath.replace(/\.md$/i, '');
+    if (!pathWithoutMd.has(rawPath)) {
+      pathWithoutMd.set(rawPath, filePath);
+    }
+
+    const segments = filePath.split('/');
+    for (let index = 0; index < segments.length; index += 1) {
+      const suffix = segments.slice(index).join('/');
+      if (!suffixMatch.has(suffix)) {
+        suffixMatch.set(suffix, filePath);
+      }
+    }
+  }
+
+  return {
+    exactPaths,
+    pathWithoutMd,
+    suffixMatch,
+  };
+}
+
+export function resolveWikiTargetWithIndex(target, index) {
+  const normalizedTarget = normalizeWikiTarget(target);
+  if (!normalizedTarget || !index) {
+    return null;
+  }
+
+  if (index.exactPaths?.has(normalizedTarget)) {
+    return normalizedTarget;
+  }
+
+  const suffixMatch = index.suffixMatch?.get(normalizedTarget);
+  if (suffixMatch) {
+    return suffixMatch;
+  }
+
+  const rawTarget = String(target ?? '').trim();
+  return index.pathWithoutMd?.get(rawTarget) ?? null;
+}
+
+export function resolveWikiTargetPath(target, files) {
+  const normalizedTarget = normalizeWikiTarget(target);
+  if (!normalizedTarget || !Array.isArray(files) || files.length === 0) {
+    return null;
+  }
+
+  const rawTarget = String(target ?? '').trim();
+
+  return files.find((filePath) => (
+    filePath === normalizedTarget
+      || filePath.endsWith(`/${normalizedTarget}`)
+      || filePath.replace(/\.md$/i, '') === rawTarget
+  )) ?? null;
+}

package/src/server/auth/create-auth-service.js

@@ -0,0 +1,272 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+
+import { createSessionCookieManager } from './session-cookie.js';
+
+export const AUTH_STRATEGY_NONE = 'none';
+export const AUTH_STRATEGY_PASSWORD = 'password';
+export const AUTH_STRATEGY_OIDC = 'oidc';
+
+export const SUPPORTED_AUTH_STRATEGIES = new Set([
+  AUTH_STRATEGY_NONE,
+  AUTH_STRATEGY_PASSWORD,
+  AUTH_STRATEGY_OIDC,
+]);
+
+export function createRandomAuthPassword(length = 18) {
+  const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789';
+  const bytes = randomBytes(length);
+  let password = '';
+
+  for (let index = 0; index < length; index += 1) {
+    password += alphabet[bytes[index] % alphabet.length];
+  }
+
+  return password;
+}
+
+export function createRandomSessionSecret() {
+  return randomBytes(32).toString('base64url');
+}
+
+function hashPassword(value) {
+  return createHash('sha256').update(String(value ?? ''), 'utf8').digest();
+}
+
+function createResponse(statusCode, body, options = {}) {
+  return {
+    body,
+    kind: options.kind || 'response',
+    setCookie: options.setCookie || null,
+    statusCode,
+  };
+}
+
+function createUnauthorizedBody(clientConfig, {
+  error = 'Authentication required',
+  code = 'AUTH_REQUIRED',
+} = {}) {
+  return {
+    auth: clientConfig,
+    code,
+    error,
+  };
+}
+
+function prependBasePath(basePath, pathname) {
+  if (!basePath) {
+    return pathname;
+  }
+
+  return pathname === '/' ? basePath : `${basePath}${pathname}`;
+}
+
+function buildClientConfig(authConfig, { basePath = '' } = {}) {
+  const sessionEndpoint = prependBasePath(basePath, '/api/auth/session');
+  const statusEndpoint = prependBasePath(basePath, '/api/auth/status');
+
+  if (authConfig.strategy === AUTH_STRATEGY_NONE) {
+    return {
+      enabled: false,
+      implemented: true,
+      requiresLogin: false,
+      sessionEndpoint,
+      statusEndpoint,
+      strategy: AUTH_STRATEGY_NONE,
+    };
+  }
+
+  if (authConfig.strategy === AUTH_STRATEGY_PASSWORD) {
+    return {
+      enabled: true,
+      implemented: true,
+      passwordLabel: 'Host password',
+      requiresLogin: true,
+      sessionEndpoint,
+      statusEndpoint,
+      strategy: AUTH_STRATEGY_PASSWORD,
+      submitLabel: 'Join session',
+    };
+  }
+
+  return {
+    enabled: true,
+    implemented: false,
+    requiresLogin: true,
+    sessionEndpoint,
+    statusEndpoint,
+    strategy: AUTH_STRATEGY_OIDC,
+  };
+}
+
+function createPasswordStrategy(authConfig, sessionCookieManager, clientConfig) {
+  const expectedPasswordHash = hashPassword(authConfig.password);
+
+  function hasValidSession(req) {
+    const session = sessionCookieManager.readSession(req);
+    return session?.strategy === AUTH_STRATEGY_PASSWORD;
+  }
+
+  return {
+    createSession(req, body = {}) {
+      if (typeof body.password !== 'string' || !body.password) {
+        return createResponse(400, { error: 'Missing password' }, { kind: 'invalid_request' });
+      }
+
+      const submittedPasswordHash = hashPassword(body.password);
+      const isValidPassword = submittedPasswordHash.length === expectedPasswordHash.length
+        && timingSafeEqual(submittedPasswordHash, expectedPasswordHash);
+
+      if (!isValidPassword) {
+        return createResponse(401, {
+          auth: clientConfig,
+          code: 'AUTH_INVALID_CREDENTIALS',
+          error: 'Incorrect password',
+        }, { kind: 'invalid_credentials' });
+      }
+
+      return createResponse(200, {
+        auth: clientConfig,
+        authenticated: true,
+        ok: true,
+      }, {
+        kind: 'session_created',
+        setCookie: sessionCookieManager.createSessionCookie(req, {
+          authenticatedAt: Date.now(),
+          strategy: AUTH_STRATEGY_PASSWORD,
+        }),
+      });
+    },
+
+    getStatus(req) {
+      return createResponse(200, {
+        authenticated: hasValidSession(req),
+        auth: clientConfig,
+      }, { kind: 'status' });
+    },
+
+    isAuthenticated(req) {
+      return hasValidSession(req);
+    },
+  };
+}
+
+function createNoneStrategy(clientConfig) {
+  return {
+    createSession() {
+      return createResponse(405, { error: 'Authentication is disabled' }, { kind: 'disabled' });
+    },
+
+    getStatus() {
+      return createResponse(200, {
+        authenticated: true,
+        auth: clientConfig,
+      }, { kind: 'status' });
+    },
+
+    isAuthenticated() {
+      return true;
+    },
+  };
+}
+
+function createOidcStrategy(clientConfig, sessionCookieManager) {
+  return {
+    createSession() {
+      return createResponse(501, {
+        auth: clientConfig,
+        code: 'AUTH_NOT_IMPLEMENTED',
+        error: 'OIDC authentication is not implemented yet',
+      }, { kind: 'not_implemented' });
+    },
+
+    getStatus() {
+      return createResponse(200, {
+        authenticated: false,
+        auth: clientConfig,
+      }, { kind: 'status' });
+    },
+
+    isAuthenticated(req) {
+      return sessionCookieManager.readSession(req)?.strategy === AUTH_STRATEGY_OIDC;
+    },
+  };
+}
+
+export function createAuthService(config) {
+  const authConfig = config.auth ?? { strategy: AUTH_STRATEGY_NONE };
+  const clientConfig = buildClientConfig(authConfig, {
+    basePath: config.basePath ?? '',
+  });
+  const sessionCookieManager = createSessionCookieManager({
+    cookieName: authConfig.sessionCookieName,
+    cookiePath: config.basePath || '/',
+    secret: authConfig.sessionSecret,
+  });
+
+  let strategy;
+  if (authConfig.strategy === AUTH_STRATEGY_PASSWORD) {
+    strategy = createPasswordStrategy(authConfig, sessionCookieManager, clientConfig);
+  } else if (authConfig.strategy === AUTH_STRATEGY_OIDC) {
+    strategy = createOidcStrategy(clientConfig, sessionCookieManager);
+  } else {
+    strategy = createNoneStrategy(clientConfig);
+  }
+
+  return {
+    authorizeApiRequest(req) {
+      if (strategy.isAuthenticated(req)) {
+        return { ok: true };
+      }
+
+      return {
+        body: createUnauthorizedBody(clientConfig),
+        ok: false,
+        statusCode: 401,
+      };
+    },
+
+    authorizeWebSocketRequest(req) {
+      if (strategy.isAuthenticated(req)) {
+        return { ok: true };
+      }
+
+      return {
+        body: 'Authentication required',
+        headers: {
+          'Content-Type': 'text/plain; charset=utf-8',
+        },
+        ok: false,
+        statusCode: 401,
+        statusMessage: 'Unauthorized',
+      };
+    },
+
+    clearSession(req) {
+      return createResponse(200, { ok: true }, {
+        kind: 'logout_ok',
+        setCookie: sessionCookieManager.clearSession(req),
+      });
+    },
+
+    createSession(req, body) {
+      return strategy.createSession(req, body);
+    },
+
+    getClientConfig() {
+      return clientConfig;
+    },
+
+    getStartupInfo() {
+      return {
+        generatedPassword: authConfig.generatedPassword || '',
+        password: authConfig.password || '',
+        passwordWasGenerated: Boolean(authConfig.passwordWasGenerated),
+        strategy: authConfig.strategy,
+      };
+    },
+
+    getStatus(req) {
+      return strategy.getStatus(req);
+    },
+  };
+}

package/src/server/auth/session-cookie.js

@@ -0,0 +1,125 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+
+function decodeBase64Url(value) {
+  const normalized = String(value ?? '')
+    .replace(/-/g, '+')
+    .replace(/_/g, '/');
+  const paddingLength = (4 - (normalized.length % 4)) % 4;
+  return Buffer.from(`${normalized}${'='.repeat(paddingLength)}`, 'base64');
+}
+
+function encodeBase64Url(value) {
+  return Buffer.from(value)
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/g, '');
+}
+
+function parseCookieHeader(headerValue) {
+  const cookies = new Map();
+  const rawPairs = String(headerValue ?? '').split(';');
+
+  for (const rawPair of rawPairs) {
+    const separatorIndex = rawPair.indexOf('=');
+    if (separatorIndex <= 0) {
+      continue;
+    }
+
+    const key = rawPair.slice(0, separatorIndex).trim();
+    const value = rawPair.slice(separatorIndex + 1).trim();
+    if (!key) {
+      continue;
+    }
+
+    cookies.set(key, value);
+  }
+
+  return cookies;
+}
+
+function createSignature(payload, secret) {
+  return createHmac('sha256', secret).update(payload).digest();
+}
+
+function hasSecureRequestHeaders(req) {
+  const forwardedProto = String(req.headers['x-forwarded-proto'] ?? '').toLowerCase();
+  return forwardedProto === 'https';
+}
+
+export function createSessionCookieManager({
+  cookieName,
+  cookiePath = '/',
+  secret,
+}) {
+  function createCookieAttributes(req, { expires = null } = {}) {
+    const attributes = [
+      'HttpOnly',
+      `Path=${cookiePath}`,
+      'SameSite=Lax',
+    ];
+
+    if (hasSecureRequestHeaders(req)) {
+      attributes.push('Secure');
+    }
+
+    if (expires instanceof Date) {
+      attributes.push(`Expires=${expires.toUTCString()}`);
+    }
+
+    return attributes;
+  }
+
+  return {
+    clearSession(req) {
+      return [
+        `${cookieName}=`,
+        ...createCookieAttributes(req, { expires: new Date(0) }),
+      ].join('; ');
+    },
+
+    createSessionCookie(req, payload) {
+      const serializedPayload = JSON.stringify(payload);
+      const encodedPayload = encodeBase64Url(serializedPayload);
+      const signature = encodeBase64Url(createSignature(encodedPayload, secret));
+      return [
+        `${cookieName}=${encodedPayload}.${signature}`,
+        ...createCookieAttributes(req),
+      ].join('; ');
+    },
+
+    readSession(req) {
+      const token = parseCookieHeader(req.headers.cookie).get(cookieName);
+      if (!token) {
+        return null;
+      }
+
+      const separatorIndex = token.lastIndexOf('.');
+      if (separatorIndex <= 0) {
+        return null;
+      }
+
+      const encodedPayload = token.slice(0, separatorIndex);
+      const encodedSignature = token.slice(separatorIndex + 1);
+
+      try {
+        const expectedSignature = createSignature(encodedPayload, secret);
+        const actualSignature = decodeBase64Url(encodedSignature);
+
+        if (actualSignature.length !== expectedSignature.length) {
+          return null;
+        }
+
+        if (!timingSafeEqual(actualSignature, expectedSignature)) {
+          return null;
+        }
+
+        const payloadBuffer = decodeBase64Url(encodedPayload);
+        const payload = JSON.parse(payloadBuffer.toString('utf8'));
+        return payload && typeof payload === 'object' ? payload : null;
+      } catch {
+        return null;
+      }
+    },
+  };
+}