collabmd 0.1.40 → 0.1.41

package/src/server/infrastructure/github/github-app-client.js

@@ -0,0 +1,205 @@
+import { createSign } from 'node:crypto';
+
+function base64UrlJson(value) {
+  return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+
+function createRequestError(statusCode, message, code) {
+  const error = new Error(message);
+  error.statusCode = statusCode;
+  error.code = code;
+  return error;
+}
+
+function normalizeBaseUrl(value) {
+  return String(value ?? 'https://api.github.com').trim().replace(/\/+$/u, '') || 'https://api.github.com';
+}
+
+function createGitHubAppJwt({ appId, privateKey }, nowSeconds = Math.floor(Date.now() / 1000)) {
+  const header = base64UrlJson({
+    alg: 'RS256',
+    typ: 'JWT',
+  });
+  const payload = base64UrlJson({
+    exp: nowSeconds + 540,
+    iat: nowSeconds - 60,
+    iss: String(appId),
+  });
+  const signingInput = `${header}.${payload}`;
+  const signer = createSign('RSA-SHA256');
+  signer.update(signingInput);
+  signer.end();
+  return `${signingInput}.${signer.sign(privateKey).toString('base64url')}`;
+}
+
+function parseRepositoryOwner(repository = {}) {
+  const ownerLogin = String(repository.owner?.login ?? '').trim();
+  if (ownerLogin) {
+    return ownerLogin;
+  }
+
+  return String(repository.full_name ?? '').split('/')[0] || '';
+}
+
+function normalizeRepository(repository = {}) {
+  const fullName = String(repository.full_name ?? '').trim();
+  const owner = parseRepositoryOwner(repository);
+  const name = String(repository.name ?? '').trim();
+  const visibility = String(repository.visibility ?? (repository.private ? 'private' : 'public')).trim() || 'private';
+
+  return {
+    defaultBranch: String(repository.default_branch ?? '').trim(),
+    fullName,
+    id: String(repository.id ?? '').trim(),
+    name,
+    owner,
+    visibility,
+  };
+}
+
+export class GitHubAppClient {
+  constructor({
+    apiBaseUrl = 'https://api.github.com',
+    appId,
+    appSlug = '',
+    fetchImpl = globalThis.fetch,
+    htmlBaseUrl = 'https://github.com',
+    privateKey,
+  } = {}) {
+    this.apiBaseUrl = normalizeBaseUrl(apiBaseUrl);
+    this.appId = String(appId ?? '').trim();
+    this.appSlug = String(appSlug ?? '').trim();
+    this.fetchImpl = fetchImpl;
+    this.htmlBaseUrl = normalizeBaseUrl(htmlBaseUrl);
+    this.privateKey = String(privateKey ?? '').replace(/\\n/g, '\n').trim();
+  }
+
+  isConfigured() {
+    return Boolean(this.appId && this.privateKey && this.fetchImpl);
+  }
+
+  createAppJwt() {
+    if (!this.isConfigured()) {
+      throw createRequestError(503, 'GitHub App setup is not configured.', 'HOSTED_GITHUB_APP_NOT_CONFIGURED');
+    }
+
+    return createGitHubAppJwt({
+      appId: this.appId,
+      privateKey: this.privateKey,
+    });
+  }
+
+  createInstallationSetupUrl({ state } = {}) {
+    if (!this.appSlug) {
+      throw createRequestError(503, 'GitHub App slug is not configured.', 'HOSTED_GITHUB_APP_NOT_CONFIGURED');
+    }
+
+    const setupUrl = new URL(`/apps/${encodeURIComponent(this.appSlug)}/installations/new`, this.htmlBaseUrl);
+    if (state) {
+      setupUrl.searchParams.set('state', state);
+    }
+    return setupUrl.href;
+  }
+
+  async request(path, {
+    authToken,
+    body = null,
+    method = 'GET',
+  } = {}) {
+    const headers = {
+      Accept: 'application/vnd.github+json',
+      'User-Agent': 'collabmd',
+      'X-GitHub-Api-Version': '2022-11-28',
+      ...(authToken ? { Authorization: `Bearer ${authToken}` } : {}),
+    };
+    const response = await this.fetchImpl(`${this.apiBaseUrl}${path}`, {
+      body: body ? JSON.stringify(body) : undefined,
+      headers: body ? { ...headers, 'Content-Type': 'application/json' } : headers,
+      method,
+    });
+    const text = await response.text();
+    let payload = null;
+    if (text) {
+      try {
+        payload = JSON.parse(text);
+      } catch {
+        payload = { message: text };
+      }
+    }
+
+    if (!response.ok) {
+      throw createRequestError(
+        response.status,
+        payload?.message || 'GitHub API request failed.',
+        'HOSTED_GITHUB_API_FAILED',
+      );
+    }
+
+    return payload ?? {};
+  }
+
+  async createInstallationAccessToken(installationId, { appJwt = null } = {}) {
+    const normalizedInstallationId = String(installationId ?? '').trim();
+    if (!normalizedInstallationId) {
+      throw createRequestError(400, 'GitHub installation id is required.', 'HOSTED_GITHUB_INSTALLATION_REQUIRED');
+    }
+
+    const payload = await this.request(`/app/installations/${encodeURIComponent(normalizedInstallationId)}/access_tokens`, {
+      authToken: appJwt || this.createAppJwt(),
+      method: 'POST',
+    });
+    const token = String(payload?.token ?? '').trim();
+    if (!token) {
+      throw createRequestError(502, 'GitHub did not return an installation access token.', 'HOSTED_GITHUB_TOKEN_MISSING');
+    }
+    return token;
+  }
+
+  async getInstallation(installationId, { appJwt = null } = {}) {
+    const normalizedInstallationId = String(installationId ?? '').trim();
+    if (!normalizedInstallationId) {
+      throw createRequestError(400, 'GitHub installation id is required.', 'HOSTED_GITHUB_INSTALLATION_REQUIRED');
+    }
+
+    return this.request(`/app/installations/${encodeURIComponent(normalizedInstallationId)}`, {
+      authToken: appJwt || this.createAppJwt(),
+    });
+  }
+
+  async listInstallationRepositories(installationToken) {
+    const payload = await this.request('/installation/repositories', {
+      authToken: installationToken,
+    });
+    return Array.isArray(payload?.repositories) ? payload.repositories : [];
+  }
+
+  async resolveVaultSourceFromInstallation(installationId) {
+    const normalizedInstallationId = String(installationId ?? '').trim();
+    if (!normalizedInstallationId) {
+      throw createRequestError(400, 'GitHub installation id is required.', 'HOSTED_GITHUB_INSTALLATION_REQUIRED');
+    }
+
+    const appJwt = this.createAppJwt();
+    const [installation, installationToken] = await Promise.all([
+      this.getInstallation(normalizedInstallationId, { appJwt }),
+      this.createInstallationAccessToken(normalizedInstallationId, { appJwt }),
+    ]);
+    const repositories = await this.listInstallationRepositories(installationToken);
+    if (repositories.length !== 1) {
+      throw createRequestError(
+        409,
+        'GitHub App installation must grant access to exactly one selected repository.',
+        'HOSTED_GITHUB_REPOSITORY_SELECTION_REQUIRED',
+      );
+    }
+
+    const repository = normalizeRepository(repositories[0]);
+    return {
+      installation: {
+        accountLogin: String(installation?.account?.login ?? repository.owner).trim(),
+        id: normalizedInstallationId,
+      },
+      repository,
+    };
+  }
+}

package/src/server/infrastructure/github/github-setup-flow.js

@@ -0,0 +1,86 @@
+import { randomUUID } from 'node:crypto';
+
+import { normalizeHostedEmail } from '../../domain/hosted-workspace-contract.js';
+
+const GITHUB_SETUP_FLOW_TTL_MS = 15 * 60 * 1000;
+
+function createFlowError(statusCode, message, code) {
+  const error = new Error(message);
+  error.statusCode = statusCode;
+  error.code = code;
+  return error;
+}
+
+export class GitHubSetupFlow {
+  constructor({
+    cookieManager,
+    githubAppClient,
+  } = {}) {
+    this.cookieManager = cookieManager;
+    this.githubAppClient = githubAppClient;
+  }
+
+  ensureConfigured() {
+    if (!this.cookieManager || !this.githubAppClient) {
+      throw createFlowError(503, 'GitHub App setup is not configured.', 'HOSTED_GITHUB_APP_NOT_CONFIGURED');
+    }
+  }
+
+  begin(req, { admin }) {
+    this.ensureConfigured();
+    const state = randomUUID();
+    const createdAt = Date.now();
+    const expiresAt = createdAt + GITHUB_SETUP_FLOW_TTL_MS;
+    return {
+      expiresAt,
+      setCookie: this.cookieManager.create(req, {
+        adminEmail: normalizeHostedEmail(admin?.email),
+        createdAt,
+        expiresAt,
+        state,
+      }, {
+        expires: new Date(expiresAt),
+      }),
+      setupUrl: this.githubAppClient.createInstallationSetupUrl({ state }),
+      state,
+    };
+  }
+
+  readValidFlow(req, requestUrl, { admin }) {
+    this.ensureConfigured();
+    const flow = this.cookieManager.read(req);
+    if (!flow || typeof flow !== 'object') {
+      throw createFlowError(400, 'GitHub setup session expired. Start setup again.', 'HOSTED_GITHUB_SETUP_EXPIRED');
+    }
+
+    if (Number(flow.expiresAt) <= Date.now()) {
+      throw createFlowError(400, 'GitHub setup session expired. Start setup again.', 'HOSTED_GITHUB_SETUP_EXPIRED');
+    }
+
+    const expectedState = String(flow.state ?? '');
+    const actualState = String(requestUrl.searchParams.get('state') ?? '');
+    if (!expectedState || actualState !== expectedState) {
+      throw createFlowError(403, 'GitHub setup state did not match.', 'HOSTED_GITHUB_SETUP_STATE_MISMATCH');
+    }
+
+    if (normalizeHostedEmail(flow.adminEmail) !== normalizeHostedEmail(admin?.email)) {
+      throw createFlowError(403, 'GitHub setup must be completed by the Team Admin who started it.', 'HOSTED_GITHUB_SETUP_ADMIN_MISMATCH');
+    }
+
+    return flow;
+  }
+
+  async complete(req, requestUrl, { admin }) {
+    this.readValidFlow(req, requestUrl, { admin });
+    const installationId = String(requestUrl.searchParams.get('installation_id') ?? '').trim();
+    if (!installationId) {
+      throw createFlowError(400, 'GitHub installation id is required.', 'HOSTED_GITHUB_INSTALLATION_REQUIRED');
+    }
+
+    return {
+      clearCookie: this.cookieManager.clear(req),
+      github: await this.githubAppClient.resolveVaultSourceFromInstallation(installationId),
+      installationId,
+    };
+  }
+}

package/src/server/infrastructure/http/create-git-api-command-handler.js

@@ -47,7 +47,7 @@ async function applyWorkspaceMutationEffects({
     return responsePayload;
   }
 
-  await workspaceMutationCoordinator?.apply?.({
+  await workspaceMutationCoordinator?.reconcileVaultChangeObservation?.({
     action,
     origin: 'git',
     requestId: readRequestId(req),

package/src/server/infrastructure/http/create-hosted-api-handler.js

@@ -0,0 +1,200 @@
+import { jsonResponse } from './http-response.js';
+import { parseJsonBody } from './request-body.js';
+
+function sendHostedError(req, res, error) {
+  const statusCode = Number(error?.statusCode || 500);
+  if (statusCode >= 500) {
+    console.error('[api] Hosted workspace request failed:', error.message);
+  }
+
+  jsonResponse(req, res, statusCode, {
+    code: error?.code || 'HOSTED_REQUEST_FAILED',
+    error: statusCode >= 500 ? 'Hosted workspace request failed' : error.message,
+  });
+}
+
+function authenticatedUser(authService, req) {
+  return authService?.getAuthenticatedUser?.(req) ?? null;
+}
+
+function readPathId(pathname, prefix) {
+  if (!pathname.startsWith(prefix)) {
+    return '';
+  }
+
+  const value = pathname.slice(prefix.length).split('/')[0] || '';
+  return decodeURIComponent(value);
+}
+
+export function createHostedApiHandler({
+  authService,
+  githubSetupFlow = null,
+  hostedWorkspaceService = null,
+}) {
+  const exactRoutes = new Map([
+    ['GET /api/hosted/status', async ({ req, res, user }) => {
+      jsonResponse(req, res, 200, await hostedWorkspaceService.getStatus(user));
+    }],
+    ['POST /api/hosted/claim', async ({ req, res, user }) => {
+      const body = await parseJsonBody(req);
+      jsonResponse(req, res, 200, await hostedWorkspaceService.claimWorkspace({
+        teamName: body?.teamName,
+        token: body?.token,
+        user,
+      }));
+    }],
+    ['GET /api/hosted/vault-source', async ({ req, res, user }) => {
+      jsonResponse(req, res, 200, { vaultSource: await hostedWorkspaceService.getVaultSource(user) });
+    }],
+    ['POST /api/hosted/vault-source/github/setup', async ({ req, res, user }) => {
+      const admin = await hostedWorkspaceService.requireAdmin(user);
+      const setup = githubSetupFlow?.begin(req, { admin });
+      if (!setup) {
+        const error = new Error('GitHub App setup is not configured.');
+        error.statusCode = 503;
+        error.code = 'HOSTED_GITHUB_APP_NOT_CONFIGURED';
+        throw error;
+      }
+      res.setHeader('Set-Cookie', setup.setCookie);
+      jsonResponse(req, res, 200, {
+        expiresAt: setup.expiresAt,
+        setupUrl: setup.setupUrl,
+      });
+    }],
+    ['GET /api/hosted/vault-source/github/callback', async ({ req, requestUrl, res, user }) => {
+      const admin = await hostedWorkspaceService.requireAdmin(user);
+      const setup = await githubSetupFlow?.complete(req, requestUrl, { admin });
+      if (!setup) {
+        const error = new Error('GitHub App setup is not configured.');
+        error.statusCode = 503;
+        error.code = 'HOSTED_GITHUB_APP_NOT_CONFIGURED';
+        throw error;
+      }
+
+      const result = await hostedWorkspaceService.configureGithubVaultSource({
+        github: setup.github,
+        user,
+      });
+      res.setHeader('Set-Cookie', setup.clearCookie);
+      jsonResponse(req, res, 200, result);
+    }],
+    ['GET /api/hosted/memberships', async ({ req, res, user }) => {
+      jsonResponse(req, res, 200, { memberships: await hostedWorkspaceService.listMemberships(user) });
+    }],
+    ['POST /api/hosted/memberships/leave', async ({ req, res, user }) => {
+      jsonResponse(req, res, 200, await hostedWorkspaceService.leaveTeam(user));
+    }],
+    ['GET /api/hosted/invitations', async ({ req, res, user }) => {
+      jsonResponse(req, res, 200, { invitations: await hostedWorkspaceService.listInvitations(user) });
+    }],
+    ['POST /api/hosted/invitations', async ({ req, res, user }) => {
+      const body = await parseJsonBody(req);
+      jsonResponse(req, res, 200, {
+        invitation: await hostedWorkspaceService.createInvitation({
+          email: body?.email,
+          role: body?.role,
+          user,
+        }),
+      });
+    }],
+    ['POST /api/hosted/invitations/accept', async ({ req, res, user }) => {
+      jsonResponse(req, res, 200, {
+        membership: await hostedWorkspaceService.acceptInvitation(user),
+      });
+    }],
+    ['GET /api/hosted/audit', async ({ req, res, user }) => {
+      jsonResponse(req, res, 200, { events: await hostedWorkspaceService.listAuditEvents(user) });
+    }],
+  ]);
+
+  const prefixRoutes = [
+    {
+      method: 'PATCH',
+      prefix: '/api/hosted/memberships/',
+      handle: async ({ req, res, requestUrl, user }) => {
+        const membershipId = readPathId(requestUrl.pathname, '/api/hosted/memberships/');
+        const body = await parseJsonBody(req);
+        jsonResponse(req, res, 200, {
+          membership: await hostedWorkspaceService.updateMembershipRole({
+            membershipId,
+            role: body?.role,
+            user,
+          }),
+        });
+      },
+    },
+    {
+      method: 'DELETE',
+      prefix: '/api/hosted/memberships/',
+      handle: async ({ req, res, requestUrl, user }) => {
+        const membershipId = readPathId(requestUrl.pathname, '/api/hosted/memberships/');
+        jsonResponse(req, res, 200, await hostedWorkspaceService.removeMembership({ membershipId, user }));
+      },
+    },
+    {
+      method: 'PATCH',
+      prefix: '/api/hosted/invitations/',
+      handle: async ({ req, res, requestUrl, user }) => {
+        const invitationId = readPathId(requestUrl.pathname, '/api/hosted/invitations/');
+        const body = await parseJsonBody(req);
+        jsonResponse(req, res, 200, {
+          invitation: await hostedWorkspaceService.updateInvitationRole({
+            invitationId,
+            role: body?.role,
+            user,
+          }),
+        });
+      },
+    },
+    {
+      method: 'DELETE',
+      prefix: '/api/hosted/invitations/',
+      handle: async ({ req, res, requestUrl, user }) => {
+        const invitationId = readPathId(requestUrl.pathname, '/api/hosted/invitations/');
+        jsonResponse(req, res, 200, await hostedWorkspaceService.revokeInvitation({ invitationId, user }));
+      },
+    },
+  ];
+
+  return async function handleHostedApi(req, res, requestUrl) {
+    if (!requestUrl.pathname.startsWith('/api/hosted')) {
+      return false;
+    }
+
+    if (!hostedWorkspaceService?.enabled) {
+      jsonResponse(req, res, 404, { error: 'Hosted workspace API is not enabled' });
+      return true;
+    }
+
+    const auth = authService.authorizeApiRequest(req);
+    if (!auth.ok) {
+      jsonResponse(req, res, auth.statusCode, auth.body);
+      return true;
+    }
+
+    const user = authenticatedUser(authService, req);
+
+    try {
+      const routeContext = { req, requestUrl, res, user };
+      const exactRoute = exactRoutes.get(`${req.method} ${requestUrl.pathname}`);
+      if (exactRoute) {
+        await exactRoute(routeContext);
+        return true;
+      }
+
+      const prefixRoute = prefixRoutes.find((route) => (
+        route.method === req.method && requestUrl.pathname.startsWith(route.prefix)
+      ));
+      if (prefixRoute) {
+        await prefixRoute.handle(routeContext);
+        return true;
+      }
+
+      jsonResponse(req, res, 404, { error: 'Hosted workspace endpoint not found' });
+      return true;
+    } catch (error) {
+      sendHostedError(req, res, error);
+      return true;
+    }
+  };
+}

package/src/server/infrastructure/http/create-request-handler.js

@@ -1,5 +1,6 @@
 import { createAuthApiHandler } from './create-auth-api-handler.js';
 import { createGitApiHandler } from './create-git-api-handler.js';
+import { createHostedApiHandler } from './create-hosted-api-handler.js';
 import { createEsmProxyHandler } from './create-esm-proxy-handler.js';
 import { createStaticHandler } from './create-static-handler.js';
 import { createVaultApiHandler } from './create-vault-api-handler.js';
@@ -49,10 +50,17 @@ export function createRequestHandler(
   testControls = { wsRoomHydrateDelayMs: 0 },
   workspaceMutationCoordinator = null,
   fileSystemSyncService = null,
+  hostedWorkspaceService = null,
+  githubSetupFlow = null,
 ) {
   const handleEsmProxy = createEsmProxyHandler();
   const handleStaticRequest = createStaticHandler(config, authService, searchService);
   const handleAuthApi = createAuthApiHandler({ authService });
+  const handleHostedApi = createHostedApiHandler({
+    authService,
+    githubSetupFlow,
+    hostedWorkspaceService,
+  });
   const handleGitApi = createGitApiHandler({
     authService,
     backlinkIndex,
@@ -177,6 +185,10 @@ export function createRequestHandler(
       return;
     }
 
+    if (await handleHostedApi(req, res, requestUrl)) {
+      return;
+    }
+
     if (await handleEsmProxy(req, res, requestUrl)) {
       return;
     }
@@ -187,6 +199,14 @@ export function createRequestHandler(
         jsonResponse(req, res, authorization.statusCode, authorization.body);
         return;
       }
+
+      const hostedAuthorization = await hostedWorkspaceService?.authorizeWorkspaceAccess?.({
+        user: authService.getAuthenticatedUser?.(req) ?? null,
+      });
+      if (hostedAuthorization && !hostedAuthorization.ok) {
+        jsonResponse(req, res, hostedAuthorization.statusCode, hostedAuthorization.body);
+        return;
+      }
     }
 
     if (await handleVaultApi(req, res, requestUrl)) {

package/src/server/infrastructure/http/create-static-handler.js

@@ -49,6 +49,7 @@ function buildRuntimeConfig({
   build,
   drawioBaseUrl,
   gitEnabled,
+  hosted,
   nodeEnv,
   publicWsBaseUrl,
   search,
@@ -62,6 +63,9 @@ function buildRuntimeConfig({
     drawioBaseUrl,
     environment: nodeEnv,
     gitEnabled,
+    hosted: {
+      enabled: Boolean(hosted?.enabled),
+    },
     publicWsBaseUrl,
     search,
     wikiLinkAutoCreate,