collabmd 0.1.31 → 0.1.33

package/src/client/styles/foundation/themes.css

@@ -21,6 +21,7 @@
   --color-primary: #4f46e5;
   --color-primary-hover: #4338ca;
   --color-primary-active: #3730a3;
+  --color-primary-contrast: #f5f5f7;
   --color-primary-highlight: #e0e0ff;
   --color-comment: #4f46e5;
   --color-comment-soft: rgba(79, 70, 229, 0.08);
@@ -28,6 +29,7 @@
   --color-comment-text: #3730a3;
 
   --color-error: #dc2626;
+  --color-danger: #dc2626;
   --color-error-highlight: #fce8e8;
   --color-success: #16a34a;
   --color-success-highlight: #dcfce7;
@@ -140,6 +142,7 @@
   --color-primary: #818cf8;
   --color-primary-hover: #6366f1;
   --color-primary-active: #4f46e5;
+  --color-primary-contrast: #0f1117;
   --color-primary-highlight: #1e1e3a;
   --color-comment: #818cf8;
   --color-comment-soft: rgba(129, 140, 248, 0.1);
@@ -147,6 +150,7 @@
   --color-comment-text: #c7d2fe;
 
   --color-error: #f87171;
+  --color-danger: #f87171;
   --color-error-highlight: #2a1a1a;
   --color-success: #4ade80;
   --color-success-highlight: #1a2a1a;

package/src/client/styles/foundation/tokens.css

@@ -17,9 +17,10 @@
   --text-title-sm: 15px;
   --text-title-md: 18px;
 
-  --font-body: 'Inter', system-ui, sans-serif;
-  --font-display: 'Geist', 'Cal Sans', 'Inter', system-ui, sans-serif;
-  --font-mono: 'JetBrains Mono', 'Fira Code', monospace;
+  --font-body: 'Inter Variable', 'Inter', system-ui, sans-serif;
+  --font-display: 'Inter Variable', 'Inter', system-ui, sans-serif;
+  --font-prose: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', 'Noto Sans', 'Liberation Sans', Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol', 'Noto Color Emoji';
+  --font-mono: 'JetBrains Mono', ui-monospace, 'SFMono-Regular', 'SF Mono', monospace;
 
   --space-1: 0.25rem;
   --space-2: 0.5rem;

package/src/client/styles/layout/sidebar.css

@@ -118,6 +118,17 @@
   overflow-x: hidden;
   overflow-y: auto;
   padding: var(--space-2) 0;
+  transition: box-shadow var(--transition-interactive), background var(--transition-interactive);
+}
+
+.file-tree.is-drop-target-root {
+  background: color-mix(in oklab, var(--color-primary-highlight) 58%, transparent);
+  box-shadow: inset 0 0 0 1px color-mix(in oklab, var(--color-primary) 48%, transparent);
+}
+
+.file-tree.is-drop-invalid {
+  background: color-mix(in oklab, var(--color-danger) 8%, transparent);
+  box-shadow: inset 0 0 0 1px color-mix(in oklab, var(--color-danger) 42%, transparent);
 }
 
 .file-tree-empty {
@@ -127,6 +138,43 @@
   font-size: var(--text-xs);
 }
 
+.file-tree-root-drop-zone {
+  display: block;
+  margin: 0 var(--space-2);
+  margin-bottom: var(--space-2);
+  padding: var(--space-2) var(--space-3);
+  border: 1px dashed transparent;
+  border-radius: var(--radius-lg);
+  background: transparent;
+  color: var(--color-text-faint);
+  font-size: var(--text-xs);
+  line-height: 1.3;
+  opacity: 0.88;
+  transition:
+    opacity var(--transition-interactive),
+    border-color var(--transition-interactive),
+    background var(--transition-interactive),
+    color var(--transition-interactive);
+}
+
+.file-tree-root-drop-zone:hover {
+  border-color: color-mix(in oklab, var(--color-border) 85%, transparent);
+  background: color-mix(in oklab, var(--color-surface-offset) 72%, transparent);
+  color: var(--color-text);
+}
+
+.file-tree-root-drop-zone.is-drop-target {
+  border-color: color-mix(in oklab, var(--color-primary) 54%, transparent);
+  background: color-mix(in oklab, var(--color-primary-highlight) 72%, transparent);
+  color: var(--color-primary);
+}
+
+.file-tree-root-drop-zone.is-drop-invalid {
+  border-color: color-mix(in oklab, var(--color-danger) 48%, transparent);
+  background: color-mix(in oklab, var(--color-danger) 10%, transparent);
+  color: var(--color-danger);
+}
+
 .file-tree-item {
   position: relative;
   display: flex;
@@ -151,6 +199,16 @@
   font-size: var(--text-ui-sm);
 }
 
+.file-tree-item.is-dragging,
+.file-tree-item[draggable='true']:active {
+  cursor: grabbing;
+}
+
+body.is-file-tree-dragging,
+body.is-file-tree-dragging * {
+  cursor: grabbing !important;
+}
+
 .file-tree-item:not([data-depth='0'])::before {
   content: '';
   position: absolute;
@@ -171,6 +229,20 @@
   color: var(--color-text);
 }
 
+.file-tree-item.is-dragging {
+  opacity: 0.52;
+}
+
+.file-tree-dir.is-drop-target {
+  background: color-mix(in oklab, var(--color-primary-highlight) 78%, transparent);
+  color: var(--color-primary);
+}
+
+.file-tree-dir.is-drop-invalid {
+  background: color-mix(in oklab, var(--color-danger) 10%, transparent);
+  color: var(--color-danger);
+}
+
 .file-tree-file.active {
   background: var(--color-primary-highlight);
   color: var(--color-primary);

package/src/server/auth/auth-common.js

@@ -0,0 +1,224 @@
+import { createHash } from 'node:crypto';
+
+import {
+  AUTH_STRATEGY_NONE,
+  AUTH_STRATEGY_OIDC,
+  AUTH_STRATEGY_PASSWORD,
+  OIDC_PROVIDER_GOOGLE,
+} from './auth-constants.js';
+
+export function hashPassword(value) {
+  return createHash('sha256').update(String(value ?? ''), 'utf8').digest();
+}
+
+export function createResponse(statusCode, body, options = {}) {
+  return {
+    body,
+    kind: options.kind || 'response',
+    redirectTo: options.redirectTo || '',
+    setCookie: options.setCookie || null,
+    statusCode,
+  };
+}
+
+export function createUnauthorizedBody(clientConfig, {
+  error = 'Authentication required',
+  code = 'AUTH_REQUIRED',
+} = {}) {
+  return {
+    auth: clientConfig,
+    code,
+    error,
+  };
+}
+
+export function prependBasePath(basePath, pathname) {
+  if (!basePath) {
+    return pathname;
+  }
+
+  return pathname === '/' ? basePath : `${basePath}${pathname}`;
+}
+
+export function appendHashParam(path, key, value, publicBaseUrl) {
+  const url = new URL(path, publicBaseUrl);
+  const hashParams = new URLSearchParams(url.hash.startsWith('#') ? url.hash.slice(1) : url.hash);
+  hashParams.set(key, value);
+  url.hash = hashParams.toString();
+  return `${url.pathname}${url.search}${url.hash}`;
+}
+
+export function getDefaultReturnTo(basePath) {
+  return basePath ? `${basePath}/` : '/';
+}
+
+export function sanitizeReturnTo(rawValue, { basePath = '', publicBaseUrl = '' } = {}) {
+  const fallback = getDefaultReturnTo(basePath);
+  const candidate = String(rawValue ?? '').trim();
+  if (!candidate) {
+    return fallback;
+  }
+
+  try {
+    const resolved = new URL(candidate, `${publicBaseUrl || 'http://localhost'}/`);
+    const publicOrigin = publicBaseUrl ? new URL(publicBaseUrl).origin : resolved.origin;
+    if (resolved.origin !== publicOrigin) {
+      return fallback;
+    }
+
+    if (basePath) {
+      const withinBasePath = resolved.pathname === basePath || resolved.pathname.startsWith(`${basePath}/`);
+      if (!withinBasePath) {
+        return fallback;
+      }
+    }
+
+    return `${resolved.pathname}${resolved.search}${resolved.hash}`;
+  } catch {
+    return fallback;
+  }
+}
+
+export function isNonEmptyString(value) {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+export function normalizeEmailAddress(value) {
+  return String(value ?? '').trim().toLowerCase();
+}
+
+export function getEmailDomain(email) {
+  const normalized = normalizeEmailAddress(email);
+  const atIndex = normalized.lastIndexOf('@');
+  if (atIndex <= 0 || atIndex === normalized.length - 1) {
+    return '';
+  }
+
+  return normalized.slice(atIndex + 1);
+}
+
+export function isOidcUserAllowed(oidcConfig, email) {
+  const normalizedEmail = normalizeEmailAddress(email);
+  const emailDomain = getEmailDomain(normalizedEmail);
+  const allowedEmails = Array.isArray(oidcConfig?.allowedEmails) ? oidcConfig.allowedEmails : [];
+  const allowedDomains = Array.isArray(oidcConfig?.allowedDomains) ? oidcConfig.allowedDomains : [];
+
+  if (allowedEmails.length === 0 && allowedDomains.length === 0) {
+    return { allowed: true };
+  }
+
+  if (allowedEmails.includes(normalizedEmail)) {
+    return { allowed: true, reason: 'email' };
+  }
+
+  if (allowedDomains.includes(emailDomain)) {
+    return { allowed: true, reason: 'domain' };
+  }
+
+  return {
+    allowed: false,
+    error: allowedEmails.length > 0 && allowedDomains.length > 0
+      ? 'This Google account is not in the allowed email or domain list.'
+      : allowedEmails.length > 0
+        ? 'This Google account is not in the allowed email list.'
+        : 'This Google account is not in an allowed domain.',
+  };
+}
+
+export function hasExpiredSession(session) {
+  const expiresAt = Number(session?.expiresAt);
+  return Number.isFinite(expiresAt) && expiresAt <= Date.now();
+}
+
+export function readAuthenticatedOidcSession(sessionCookieManager, req) {
+  const session = sessionCookieManager.readSession(req);
+  if (session?.strategy !== AUTH_STRATEGY_OIDC) {
+    return null;
+  }
+
+  const user = session.user;
+  if (
+    !user
+    || typeof user !== 'object'
+    || !isNonEmptyString(user.sub)
+    || !isNonEmptyString(user.email)
+    || !isNonEmptyString(user.name)
+  ) {
+    return null;
+  }
+
+  if (hasExpiredSession(session)) {
+    return null;
+  }
+
+  return {
+    ...session,
+    user: {
+      email: user.email,
+      emailVerified: user.emailVerified === true,
+      name: user.name,
+      picture: typeof user.picture === 'string' ? user.picture : '',
+      sub: user.sub,
+    },
+  };
+}
+
+export function resolveSessionExpiresAt(sessionMaxAgeMs, fallbackExpiresAt = null) {
+  if (Number.isFinite(sessionMaxAgeMs) && sessionMaxAgeMs > 0) {
+    return Date.now() + sessionMaxAgeMs;
+  }
+
+  return Number.isFinite(fallbackExpiresAt) ? fallbackExpiresAt : null;
+}
+
+export function createSessionCookieOptions(expiresAt) {
+  if (!Number.isFinite(expiresAt)) {
+    return {};
+  }
+
+  return {
+    expires: new Date(expiresAt),
+  };
+}
+
+export function buildClientConfig(authConfig, { basePath = '' } = {}) {
+  const loginEndpoint = prependBasePath(basePath, '/api/auth/oidc/login');
+  const sessionEndpoint = prependBasePath(basePath, '/api/auth/session');
+  const statusEndpoint = prependBasePath(basePath, '/api/auth/status');
+
+  if (authConfig.strategy === AUTH_STRATEGY_NONE) {
+    return {
+      enabled: false,
+      implemented: true,
+      requiresLogin: false,
+      sessionEndpoint,
+      statusEndpoint,
+      strategy: AUTH_STRATEGY_NONE,
+    };
+  }
+
+  if (authConfig.strategy === AUTH_STRATEGY_PASSWORD) {
+    return {
+      enabled: true,
+      implemented: true,
+      passwordLabel: 'Host password',
+      requiresLogin: true,
+      sessionEndpoint,
+      statusEndpoint,
+      strategy: AUTH_STRATEGY_PASSWORD,
+      submitLabel: 'Join session',
+    };
+  }
+
+  return {
+    enabled: true,
+    implemented: true,
+    loginEndpoint,
+    provider: OIDC_PROVIDER_GOOGLE,
+    requiresLogin: true,
+    sessionEndpoint,
+    statusEndpoint,
+    strategy: AUTH_STRATEGY_OIDC,
+    submitLabel: 'Continue with Google',
+  };
+}

package/src/server/auth/auth-constants.js

@@ -0,0 +1,30 @@
+import { randomBytes } from 'node:crypto';
+
+export const AUTH_STRATEGY_NONE = 'none';
+export const AUTH_STRATEGY_PASSWORD = 'password';
+export const AUTH_STRATEGY_OIDC = 'oidc';
+
+export const SUPPORTED_AUTH_STRATEGIES = new Set([
+  AUTH_STRATEGY_NONE,
+  AUTH_STRATEGY_PASSWORD,
+  AUTH_STRATEGY_OIDC,
+]);
+
+export const OIDC_FLOW_TTL_MS = 10 * 60 * 1000;
+export const OIDC_PROVIDER_GOOGLE = 'google';
+
+export function createRandomAuthPassword(length = 18) {
+  const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789';
+  const bytes = randomBytes(length);
+  let password = '';
+
+  for (let index = 0; index < length; index += 1) {
+    password += alphabet[bytes[index] % alphabet.length];
+  }
+
+  return password;
+}
+
+export function createRandomSessionSecret() {
+  return randomBytes(32).toString('base64url');
+}