collabmd 0.1.18

package/src/server/infrastructure/http/http-errors.js

@@ -0,0 +1,13 @@
+export function createRequestError(statusCode, message) {
+  const error = new Error(message);
+  error.statusCode = statusCode;
+  return error;
+}
+
+export function getRequestErrorStatusCode(error) {
+  if (!Number.isInteger(error?.statusCode)) {
+    return false;
+  }
+
+  return error.statusCode;
+}

package/src/server/infrastructure/http/http-response.js

@@ -0,0 +1,167 @@
+import { brotliCompressSync, constants as zlibConstants, gzipSync } from 'node:zlib';
+
+const COMPRESSIBLE_CONTENT_TYPE_PATTERN = /^(?:text\/|application\/(?:javascript|json|xml)|image\/svg\+xml)/i;
+const MIN_COMPRESSIBLE_BYTES = 1024;
+
+export const SECURITY_HEADERS = {
+  'Referrer-Policy': 'strict-origin-when-cross-origin',
+  'X-Content-Type-Options': 'nosniff',
+  'X-Frame-Options': 'SAMEORIGIN',
+};
+
+export const WRITE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
+function appendVaryHeader(res, token) {
+  const normalizedToken = String(token || '').trim();
+  if (!normalizedToken) {
+    return;
+  }
+
+  const existingHeader = String(res.getHeader('Vary') || '');
+  const varyTokens = new Set(
+    existingHeader
+      .split(',')
+      .map((value) => value.trim())
+      .filter(Boolean),
+  );
+  varyTokens.add(normalizedToken);
+  res.setHeader('Vary', Array.from(varyTokens).join(', '));
+}
+
+function resolveCompressionEncoding(acceptEncodingHeader) {
+  const value = String(acceptEncodingHeader || '').toLowerCase();
+  if (value.includes('br')) {
+    return 'br';
+  }
+
+  if (value.includes('gzip')) {
+    return 'gzip';
+  }
+
+  return null;
+}
+
+function maybeCompressBody(req, body, contentType) {
+  if (body === undefined || body === null) {
+    return { body: null, compressed: false, encoding: null };
+  }
+
+  const bodyBuffer = Buffer.isBuffer(body)
+    ? body
+    : Buffer.from(String(body), 'utf8');
+
+  if (
+    bodyBuffer.byteLength < MIN_COMPRESSIBLE_BYTES
+    || !COMPRESSIBLE_CONTENT_TYPE_PATTERN.test(String(contentType || ''))
+  ) {
+    return { body: bodyBuffer, compressed: false, encoding: null };
+  }
+
+  const encoding = resolveCompressionEncoding(req.headers['accept-encoding']);
+  if (!encoding) {
+    return { body: bodyBuffer, compressed: false, encoding: null };
+  }
+
+  const compressedBody = encoding === 'br'
+    ? brotliCompressSync(bodyBuffer, {
+      params: {
+        [zlibConstants.BROTLI_PARAM_QUALITY]: 5,
+      },
+    })
+    : gzipSync(bodyBuffer, { level: 6 });
+
+  if (compressedBody.byteLength >= bodyBuffer.byteLength) {
+    return { body: bodyBuffer, compressed: false, encoding: null };
+  }
+
+  return { body: compressedBody, compressed: true, encoding };
+}
+
+export function setHeaders(res, headers) {
+  for (const [key, value] of Object.entries(headers)) {
+    res.setHeader(key, value);
+  }
+}
+
+export function isSameOriginWriteRequest(req, requestUrl) {
+  const origin = req.headers.origin;
+  if (!origin) {
+    return true;
+  }
+
+  try {
+    const originUrl = new URL(origin);
+    return originUrl.host === requestUrl.host;
+  } catch {
+    return false;
+  }
+}
+
+export function applyCorsHeaders(res, origin) {
+  if (!origin) {
+    return;
+  }
+
+  appendVaryHeader(res, 'Origin');
+  setHeaders(res, {
+    'Access-Control-Allow-Origin': origin,
+    'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type',
+  });
+}
+
+export function sendResponse(req, res, {
+  body = null,
+  headers = {},
+  statusCode = 200,
+} = {}) {
+  const contentType = headers['Content-Type'] || headers['content-type'] || '';
+  const prepared = maybeCompressBody(req, body, contentType);
+
+  if (body !== null) {
+    appendVaryHeader(res, 'Accept-Encoding');
+  }
+
+  const responseHeaders = { ...headers };
+
+  if (prepared.compressed && prepared.encoding) {
+    responseHeaders['Content-Encoding'] = prepared.encoding;
+  }
+
+  if (prepared.body) {
+    responseHeaders['Content-Length'] = String(prepared.body.byteLength);
+  }
+
+  res.writeHead(statusCode, responseHeaders);
+
+  if (req.method === 'HEAD' || statusCode === 204 || statusCode === 304) {
+    res.end();
+    return;
+  }
+
+  res.end(prepared.body ?? undefined);
+}
+
+export function jsonResponse(req, res, statusCode, data) {
+  const body = JSON.stringify(data);
+  sendResponse(req, res, {
+    body,
+    headers: {
+      'Content-Type': 'application/json; charset=utf-8',
+      'Cache-Control': 'no-store',
+    },
+    statusCode,
+  });
+}
+
+export function textResponse(req, res, statusCode, body, headers = {}) {
+  sendResponse(req, res, {
+    body,
+    headers: {
+      'Content-Type': 'text/plain; charset=utf-8',
+      ...headers,
+    },
+    statusCode,
+  });
+  return true;
+}

package/src/server/infrastructure/http/request-body.js

@@ -0,0 +1,56 @@
+import { createRequestError } from './http-errors.js';
+
+export const REQUEST_BODY_LIMIT_BYTES = 8_388_608;
+
+export async function readRequestBody(req, maxBytes = REQUEST_BODY_LIMIT_BYTES) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    let done = false;
+
+    const finish = (callback, value) => {
+      if (done) {
+        return;
+      }
+
+      done = true;
+      req.off('data', onData);
+      req.off('end', onEnd);
+      req.off('error', onError);
+      callback(value);
+    };
+
+    const onData = (chunk) => {
+      size += chunk.length;
+      if (size > maxBytes) {
+        req.resume();
+        finish(reject, createRequestError(413, 'Request body too large'));
+        return;
+      }
+
+      chunks.push(chunk);
+    };
+
+    const onEnd = () => {
+      finish(resolve, Buffer.concat(chunks).toString('utf-8'));
+    };
+
+    const onError = (error) => {
+      finish(reject, error);
+    };
+
+    req.on('data', onData);
+    req.on('end', onEnd);
+    req.on('error', onError);
+  });
+}
+
+export async function parseJsonBody(req) {
+  const rawBody = await readRequestBody(req);
+
+  try {
+    return JSON.parse(rawBody);
+  } catch {
+    throw createRequestError(400, 'Invalid JSON payload');
+  }
+}

package/src/server/infrastructure/persistence/path-utils.js

@@ -0,0 +1,90 @@
+import { isAbsolute, normalize, relative, resolve } from 'path';
+
+import { isVaultFilePath } from '../../../domain/file-kind.js';
+
+export const IGNORED_DIRECTORIES = new Set(['.git', '.obsidian', '.trash', 'node_modules', '.DS_Store']);
+export const VAULT_FILE_PATH_REQUIREMENT = '.md, .excalidraw, .mmd, .mermaid, .puml, or .plantuml';
+export const INVALID_VAULT_FILE_PATH_ERROR = `Invalid file path — must end in ${VAULT_FILE_PATH_REQUIREMENT}`;
+export const INVALID_DIRECTORY_PATH_ERROR = 'Invalid directory path';
+
+export function isIgnoredVaultEntry(name) {
+  return IGNORED_DIRECTORIES.has(name) || name.startsWith('.');
+}
+
+function normalizeRequestedPath(requestedPath) {
+  const normalized = normalize(String(requestedPath ?? '').trim().replace(/\\/g, '/'));
+  if (!normalized || normalized === '.') {
+    return '';
+  }
+
+  return normalized;
+}
+
+export function sanitizeVaultPath(vaultDir, requestedPath) {
+  const normalized = normalizeRequestedPath(requestedPath);
+  if (!normalized) {
+    return null;
+  }
+
+  const absolute = resolve(vaultDir, normalized);
+  const relativePath = relative(vaultDir, absolute);
+
+  if (
+    relativePath.startsWith('..')
+    || relativePath === '..'
+    || isAbsolute(relativePath)
+  ) {
+    return null;
+  }
+
+  return absolute;
+}
+
+export function resolveVaultFilePath(vaultDir, requestedPath) {
+  const absolute = sanitizeVaultPath(vaultDir, requestedPath);
+  if (!absolute || !isVaultFilePath(absolute)) {
+    return { absolute: null, error: INVALID_VAULT_FILE_PATH_ERROR };
+  }
+
+  return { absolute, error: null };
+}
+
+export function resolveVaultDirectoryPath(vaultDir, requestedPath) {
+  const absolute = sanitizeVaultPath(vaultDir, requestedPath);
+  if (!absolute) {
+    return { absolute: null, error: INVALID_DIRECTORY_PATH_ERROR };
+  }
+
+  return { absolute, error: null };
+}
+
+export function resolveVaultRenamePaths(vaultDir, oldPath, newPath) {
+  const absoluteOld = sanitizeVaultPath(vaultDir, oldPath);
+  const absoluteNew = sanitizeVaultPath(vaultDir, newPath);
+
+  if (!absoluteOld || !absoluteNew) {
+    return { absoluteNew: null, absoluteOld: null, error: 'Invalid file path' };
+  }
+
+  if (!isVaultFilePath(absoluteOld)) {
+    return {
+      absoluteNew: null,
+      absoluteOld: null,
+      error: `Old path must be a vault file (${VAULT_FILE_PATH_REQUIREMENT})`,
+    };
+  }
+
+  if (!isVaultFilePath(absoluteNew)) {
+    return {
+      absoluteNew: null,
+      absoluteOld: null,
+      error: `New path must be a vault file (${VAULT_FILE_PATH_REQUIREMENT})`,
+    };
+  }
+
+  return { absoluteNew, absoluteOld, error: null };
+}
+
+export function toVaultRelativePath(vaultDir, absolutePath) {
+  return relative(vaultDir, absolutePath);
+}

package/src/server/infrastructure/persistence/sidecar-store.js

@@ -0,0 +1,150 @@
+import { dirname, resolve } from 'path';
+import { mkdir, readFile, rename, rm, stat, writeFile } from 'fs/promises';
+
+import { resolveVaultFilePath, toVaultRelativePath } from './path-utils.js';
+
+const COMMENT_STORAGE_ROOT = '.collabmd/comments';
+const YJS_SNAPSHOT_STORAGE_ROOT = '.collabmd/yjs';
+
+function resolveSidecarPath(vaultDir, filePath, storageRoot, extension) {
+  const { absolute: absoluteVaultPath } = resolveVaultFilePath(vaultDir, filePath);
+  if (!absoluteVaultPath) {
+    return null;
+  }
+
+  const relativeVaultPath = toVaultRelativePath(vaultDir, absoluteVaultPath);
+  return resolve(vaultDir, storageRoot, `${relativeVaultPath}${extension}`);
+}
+
+async function renameIfPresent(sourcePath, targetPath) {
+  if (!sourcePath || !targetPath) {
+    return;
+  }
+
+  try {
+    await stat(sourcePath);
+    await mkdir(dirname(targetPath), { recursive: true });
+    await rename(sourcePath, targetPath);
+  } catch (error) {
+    if (error.code !== 'ENOENT') {
+      throw error;
+    }
+  }
+}
+
+export class SidecarStore {
+  constructor({ vaultDir }) {
+    this.vaultDir = vaultDir;
+  }
+
+  getCommentThreadPath(filePath) {
+    return resolveSidecarPath(this.vaultDir, filePath, COMMENT_STORAGE_ROOT, '.json');
+  }
+
+  getSnapshotPath(filePath) {
+    return resolveSidecarPath(this.vaultDir, filePath, YJS_SNAPSHOT_STORAGE_ROOT, '.bin');
+  }
+
+  async readCommentThreads(filePath) {
+    const absolute = this.getCommentThreadPath(filePath);
+    if (!absolute) {
+      return [];
+    }
+
+    try {
+      const raw = await readFile(absolute, 'utf-8');
+      const parsed = JSON.parse(raw);
+      if (Array.isArray(parsed)) {
+        return parsed;
+      }
+
+      return Array.isArray(parsed?.threads) ? parsed.threads : [];
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        return [];
+      }
+
+      throw error;
+    }
+  }
+
+  async writeCommentThreads(filePath, threads = []) {
+    const absolute = this.getCommentThreadPath(filePath);
+    if (!absolute) {
+      return { ok: false, error: 'Invalid file path' };
+    }
+
+    try {
+      if (!Array.isArray(threads) || threads.length === 0) {
+        await rm(absolute, { force: true });
+        return { ok: true };
+      }
+
+      await mkdir(dirname(absolute), { recursive: true });
+      await writeFile(absolute, `${JSON.stringify({
+        threads,
+        version: 1,
+      }, null, 2)}\n`, 'utf-8');
+      return { ok: true };
+    } catch (error) {
+      return { ok: false, error: error.message };
+    }
+  }
+
+  async readSnapshot(filePath) {
+    const absolute = this.getSnapshotPath(filePath);
+    if (!absolute) {
+      return null;
+    }
+
+    try {
+      const content = await readFile(absolute);
+      return new Uint8Array(content);
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        return null;
+      }
+
+      throw error;
+    }
+  }
+
+  async writeSnapshot(filePath, snapshot) {
+    const absolute = this.getSnapshotPath(filePath);
+    if (!absolute) {
+      return { ok: false, error: 'Invalid file path' };
+    }
+
+    try {
+      await mkdir(dirname(absolute), { recursive: true });
+      await writeFile(absolute, Buffer.from(snapshot));
+      return { ok: true };
+    } catch (error) {
+      return { ok: false, error: error.message };
+    }
+  }
+
+  async deleteSnapshot(filePath) {
+    const absolute = this.getSnapshotPath(filePath);
+    if (!absolute) {
+      return { ok: false, error: 'Invalid file path' };
+    }
+
+    try {
+      await rm(absolute, { force: true });
+      return { ok: true };
+    } catch (error) {
+      return { ok: false, error: error.message };
+    }
+  }
+
+  async deleteAllForFile(filePath) {
+    const paths = [this.getCommentThreadPath(filePath), this.getSnapshotPath(filePath)];
+    await Promise.all(paths.filter(Boolean).map(async (pathValue) => rm(pathValue, { force: true })));
+  }
+
+  async renameAllForFile(oldPath, newPath) {
+    await renameIfPresent(this.getCommentThreadPath(oldPath), this.getCommentThreadPath(newPath));
+    await renameIfPresent(this.getSnapshotPath(oldPath), this.getSnapshotPath(newPath));
+  }
+}

package/src/server/infrastructure/persistence/vault-content-adapter.js

@@ -0,0 +1,49 @@
+import {
+  isExcalidrawFilePath,
+  isMarkdownFilePath,
+  isMermaidFilePath,
+  isPlantUmlFilePath,
+} from '../../../domain/file-kind.js';
+
+export class VaultContentAdapter {
+  constructor({
+    invalidPathError,
+    kind,
+    matches,
+  }) {
+    this.invalidPathError = invalidPathError;
+    this.kind = kind;
+    this.matches = matches;
+  }
+
+  supports(filePath) {
+    return this.matches(filePath);
+  }
+}
+
+const adapters = [
+  new VaultContentAdapter({
+    invalidPathError: 'Invalid file path',
+    kind: 'markdown',
+    matches: isMarkdownFilePath,
+  }),
+  new VaultContentAdapter({
+    invalidPathError: 'Invalid file path — must end in .excalidraw',
+    kind: 'excalidraw',
+    matches: isExcalidrawFilePath,
+  }),
+  new VaultContentAdapter({
+    invalidPathError: 'Invalid file path — must end in .mmd or .mermaid',
+    kind: 'mermaid',
+    matches: isMermaidFilePath,
+  }),
+  new VaultContentAdapter({
+    invalidPathError: 'Invalid file path — must end in .puml or .plantuml',
+    kind: 'plantuml',
+    matches: isPlantUmlFilePath,
+  }),
+];
+
+export function getVaultContentAdapter(filePath) {
+  return adapters.find((adapter) => adapter.supports(filePath)) ?? null;
+}