create-feedbax 0.1.0 → 0.2.1

package/template/src/feedbax/feedback/identity-handoff.test.ts

@@ -0,0 +1,81 @@
+import { expect, it } from "vitest";
+import { signIdentityHandoff, verifyIdentityHandoff } from "./identity-handoff";
+const secret = "test-secret-for-identity-handoff-32-bytes";
+const claims = {
+  subject: "alice",
+  displayName: "Alice",
+  audience: "https://feedback.example",
+  issuer: "https://app.example",
+  state: "browser-state",
+  nonce: "unique-nonce",
+  issuedAt: 1000,
+  expiresAt: 1100,
+};
+it("accepts only a signed identity bound to this Installation, browser and time", () => {
+  const token = signIdentityHandoff(claims, secret);
+  expect(
+    verifyIdentityHandoff(token, secret, {
+      audience: claims.audience,
+      issuer: claims.issuer,
+      state: claims.state,
+      now: 1020,
+    }),
+  ).toEqual(claims);
+  expect(() =>
+    verifyIdentityHandoff(token, secret, {
+      audience: "https://other.example",
+      issuer: claims.issuer,
+      state: claims.state,
+      now: 1020,
+    }),
+  ).toThrow();
+  expect(() =>
+    verifyIdentityHandoff(token, secret, {
+      audience: claims.audience,
+      issuer: claims.issuer,
+      state: "different-browser",
+      now: 1020,
+    }),
+  ).toThrow();
+  expect(() =>
+    verifyIdentityHandoff(token, secret, {
+      audience: claims.audience,
+      issuer: claims.issuer,
+      state: claims.state,
+      now: 1101,
+    }),
+  ).toThrow();
+  expect(() =>
+    verifyIdentityHandoff(token + "x", secret, {
+      audience: claims.audience,
+      issuer: claims.issuer,
+      state: claims.state,
+      now: 1020,
+    }),
+  ).toThrow();
+});
+
+it("accepts email delivery addresses only when the trusted application signs a verified assertion", () => {
+  const expected = {
+    audience: claims.audience,
+    issuer: claims.issuer,
+    state: claims.state,
+    now: 1020,
+  };
+  const verify = (value: Parameters<typeof signIdentityHandoff>[0]) =>
+    verifyIdentityHandoff(signIdentityHandoff(value, secret), secret, expected);
+  expect(
+    verify({ ...claims, email: "private@example.com" }),
+  ).not.toHaveProperty("email");
+  expect(
+    verify({ ...claims, email: "private@example.com", emailVerified: true }),
+  ).toMatchObject({ email: "private@example.com", emailVerified: true });
+  expect(() => verify({ ...claims, emailVerified: true })).toThrow();
+  expect(() =>
+    verify({
+      ...claims,
+      email: "bad\r\naddress@example.com",
+      emailVerified: true,
+    }),
+  ).toThrow();
+});

package/template/src/feedbax/feedback/identity-handoff.ts

@@ -0,0 +1,119 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+export interface IdentityHandoff {
+  email?: string;
+  emailVerified?: boolean;
+  subject: string;
+  displayName: string;
+  issuer: string;
+  audience: string;
+  state: string;
+  nonce: string;
+  issuedAt: number;
+  expiresAt: number;
+}
+export function signIdentityHandoff(
+  claims: IdentityHandoff,
+  secret: string,
+): string {
+  requireSecret(secret);
+  const payload = Buffer.from(
+    JSON.stringify({ purpose: "feedbax-identity-v1", ...claims }),
+  ).toString("base64url");
+  return `${payload}.${signature(payload, secret)}`;
+}
+export function verifyIdentityHandoff(
+  token: string,
+  secret: string,
+  expected: { audience: string; issuer: string; state: string; now: number },
+): IdentityHandoff {
+  requireSecret(secret);
+  if (token.length > 8192) throw invalid();
+  const [payload, mac, extra] = token.split(".");
+  if (!payload || !mac || extra) throw invalid();
+  const received = Buffer.from(mac);
+  const wanted = Buffer.from(signature(payload, secret));
+  if (wanted.length !== received.length || !timingSafeEqual(wanted, received))
+    throw invalid();
+  let value: Record<string, unknown>;
+  try {
+    value = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+  } catch {
+    throw invalid();
+  }
+  if (!value || value.purpose !== "feedbax-identity-v1") throw invalid();
+  for (const key of [
+    "subject",
+    "displayName",
+    "issuer",
+    "audience",
+    "state",
+    "nonce",
+  ])
+    if (
+      typeof value[key] !== "string" ||
+      !value[key].trim() ||
+      value[key].length > 512
+    )
+      throw invalid();
+  if (
+    value.audience !== expected.audience ||
+    value.issuer !== expected.issuer ||
+    value.state !== expected.state ||
+    !expected.state ||
+    !Number.isSafeInteger(value.issuedAt) ||
+    !Number.isSafeInteger(value.expiresAt)
+  )
+    throw invalid();
+  const issuedAt = Number(value.issuedAt),
+    expiresAt = Number(value.expiresAt);
+  if (
+    issuedAt > expected.now + 30 ||
+    expiresAt <= expected.now ||
+    expiresAt <= issuedAt ||
+    expiresAt - issuedAt > 120
+  )
+    throw invalid();
+  if (
+    value.emailVerified !== undefined &&
+    typeof value.emailVerified !== "boolean"
+  )
+    throw invalid();
+  if (
+    value.email !== undefined &&
+    (typeof value.email !== "string" ||
+      value.email.length > 254 ||
+      !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.email))
+  )
+    throw invalid();
+  if (value.emailVerified === true && !value.email) throw invalid();
+  return {
+    ...(value.emailVerified === true
+      ? { email: String(value.email), emailVerified: true }
+      : {}),
+    subject: String(value.subject),
+    displayName: String(value.displayName),
+    issuer: String(value.issuer),
+    audience: String(value.audience),
+    state: String(value.state),
+    nonce: String(value.nonce),
+    issuedAt,
+    expiresAt,
+  };
+}
+function signature(payload: string, secret: string) {
+  return createHmac("sha256", secret)
+    .update(`feedbax-identity-v1:${payload}`)
+    .digest("base64url");
+}
+function requireSecret(secret: string) {
+  if (secret.length < 32)
+    throw new Error(
+      "Identity handoff secret must contain at least 32 characters.",
+    );
+}
+function invalid() {
+  return new Error(
+    "Identity handoff is invalid or expired. Start sign-in again.",
+  );
+}

package/template/src/feedbax/feedback/image-feedback.ts

@@ -0,0 +1,101 @@
+import type { FeedbackModule, CreateCommentInput } from "./index";
+import type { createImageModule, ImageAttachment } from "./images";
+
+export function createImageFeedbackModule(
+  base: FeedbackModule,
+  images: ReturnType<typeof createImageModule>,
+  writeReview?: (postId: string, images: ImageAttachment[]) => Promise<void>,
+): FeedbackModule {
+  const create = async (
+    input: CreateCommentInput & { discussionId?: string },
+  ) => {
+    const ids = input.imageIds ?? [];
+    await images.validatePending(ids);
+    const comment = input.discussionId
+      ? await base.replyToCommentThread({
+          ...input,
+          discussionId: input.discussionId,
+        })
+      : await base.createComment(input);
+    if (!ids.length) return comment;
+    try {
+      return {
+        ...comment,
+        images: await images.attachComment({
+          ids,
+          slug: input.slug,
+          commentId: comment.id,
+        }),
+      };
+    } catch (error) {
+      try {
+        await base.deleteComment({ commentId: comment.id });
+        await images.discardAttached(input.slug, comment.id);
+      } catch {
+        /* External cleanup remains best effort; never expose an unpublished attachment. */
+      }
+      throw error;
+    }
+  };
+  return {
+    ...base,
+    async submitPost(input) {
+      const ids = input.imageIds ?? [];
+      await images.validatePending(ids);
+      const post = await base.submitPost(input);
+      if (!ids.length) return post;
+      try {
+        const attached = await images.attachPost({
+          ids,
+          id: post.id,
+          browserCapability: post.browserCapability,
+        });
+        await writeReview?.(post.id, attached);
+        return { ...post, images: attached };
+      } catch (error) {
+        try {
+          await base.withdrawDraftPost({
+            id: post.id,
+            browserCapability: post.browserCapability,
+          });
+          await images.discardAttached(post.slug);
+        } catch {
+          /* Preserve the private record for failed external cleanup. */
+        }
+        throw error;
+      }
+    },
+    async getPublicPost(slug) {
+      const post = await base.getPublicPost(slug);
+      if (!post) return;
+      const attached = await images.forPost(slug);
+      return attached.length ? { ...post, images: attached } : post;
+    },
+    async getDraftPost(input) {
+      const post = await base.getDraftPost(input);
+      const attached = await images.forPost(post.slug);
+      return attached.length ? { ...post, images: attached } : post;
+    },
+    createComment: create,
+    replyToCommentThread: create,
+    async listCommentThreads(input) {
+      const page = await base.listCommentThreads(input);
+      const attachments = await images.forComments(
+        input.slug,
+        page.items.flatMap((thread) =>
+          thread.comments.map((comment) => comment.id),
+        ),
+      );
+      return {
+        ...page,
+        items: page.items.map((thread) => ({
+          ...thread,
+          comments: thread.comments.map((comment) => {
+            const attached = attachments.get(comment.id) ?? [];
+            return attached.length ? { ...comment, images: attached } : comment;
+          }),
+        })),
+      };
+    },
+  };
+}

package/template/src/feedbax/feedback/images.test.ts

@@ -0,0 +1,223 @@
+import { afterEach, expect, it } from "vitest";
+import { Miniflare } from "miniflare";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { createConnectedStore } from "./connected";
+import { createFeedbackModule } from "./index";
+import { createImageModule } from "./images";
+let runtime: Miniflare | undefined;
+afterEach(async () => {
+  const previous = runtime;
+  runtime = undefined;
+  await previous?.dispose();
+});
+const participant = { subject: "alice", displayName: "Alice" };
+const png = Uint8Array.from(
+  Buffer.from(
+    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aE2sAAAAASUVORK5CYII=",
+    "base64",
+  ),
+);
+async function setup() {
+  runtime = new Miniflare({
+    modules: true,
+    script: "export default {fetch(){return new Response('ok')}}",
+    compatibilityDate: "2026-07-30",
+    d1Databases: ["DB"],
+    r2Buckets: ["IMAGES"],
+  });
+  const database = await runtime.getD1Database("DB");
+  for (const file of [
+    "0001_connected.sql",
+    "0002_participation.sql",
+    "0003_images.sql",
+  ])
+    await database.exec(
+      await readFile(
+        `${existsSync("apps/portal/migrations") ? "apps/portal/migrations" : "migrations"}/${file}`,
+        "utf8",
+      ),
+    );
+  await createConnectedStore(database).acceptIdentity({
+    ...participant,
+    nonce: "a",
+    sessionHash: "a",
+    expiresAt: Date.now() + 60000,
+  });
+  const feedback = createFeedbackModule();
+  return {
+    database,
+    bucket: await runtime.getR2Bucket("IMAGES"),
+    feedback,
+    reviewSecret: "s".repeat(32),
+  };
+}
+it("keeps uploads private, binds images to an authorized draft, and never serves an unpublished image publicly", async () => {
+  const options = await setup();
+  const { feedback } = options;
+  const owner = createImageModule({ ...options, participant });
+  const uploaded = await owner.upload(png, "image/png");
+  expect((await owner.read(uploaded.id))?.contentType).toBe("image/png");
+  expect(await createImageModule(options).read(uploaded.id)).toBeUndefined();
+  await expect(
+    owner.upload(new TextEncoder().encode("<svg>bad</svg>"), "image/svg+xml"),
+  ).rejects.toThrow("JPEG, PNG, or WebP");
+  await expect(
+    owner.upload(new Uint8Array(5 * 1024 * 1024 + 1), "image/png"),
+  ).rejects.toThrow("5 MiB");
+  const draft = await feedback.submitPost({
+    title: "Image Post",
+    description: "Description",
+    type: "Feature Request",
+  });
+  await owner.attachPost({
+    ids: [uploaded.id],
+    id: draft.id,
+    browserCapability: draft.browserCapability,
+  });
+  expect(await createImageModule(options).read(uploaded.id)).toBeUndefined();
+  await expect(
+    createImageModule({
+      ...options,
+      participant: { subject: "bob", displayName: "Bob" },
+    }).attachPost({
+      ids: [uploaded.id],
+      id: draft.id,
+      browserCapability: draft.browserCapability,
+    }),
+  ).rejects.toThrow("unavailable");
+  const publicFeedback = createFeedbackModule({
+    initialItems: [{ ...draft, published: true, status: "Planned" }],
+  });
+  const publicImages = createImageModule({
+    ...options,
+    feedback: publicFeedback,
+  });
+  expect(
+    (await publicImages.forPost(draft.slug)).map((image) => image.id),
+  ).toEqual([uploaded.id]);
+  expect(await publicImages.read(uploaded.id)).toBeDefined();
+  const review = await owner.reviewUrl(
+    uploaded.id,
+    "https://feedback.example.com",
+  );
+  expect(
+    await createImageModule(options).read(
+      uploaded.id,
+      new URL(review).searchParams.get("review")!,
+    ),
+  ).toBeDefined();
+  expect(
+    await createImageModule(options).read(uploaded.id, "forged"),
+  ).toBeUndefined();
+  await feedback.withdrawDraftPost({
+    id: draft.id,
+    browserCapability: draft.browserCapability,
+  });
+  expect(await owner.read(uploaded.id)).toBeUndefined();
+  expect(
+    await createImageModule(options).read(
+      uploaded.id,
+      new URL(review).searchParams.get("review")!,
+    ),
+  ).toBeUndefined();
+});
+
+it("rejects attachment overflow without partial binding and cleans up a rolled-back image Post", async () => {
+  const options = await setup();
+  const owner = createImageModule({ ...options, participant });
+  const ids = [];
+  for (let i = 0; i < 5; i++)
+    ids.push((await owner.upload(png, "image/png")).id);
+  const draft = await options.feedback.submitPost({
+    title: "Images",
+    description: "Description",
+    type: "Feature Request",
+  });
+  await owner.attachPost({
+    ids: ids.slice(0, 3),
+    id: draft.id,
+    browserCapability: draft.browserCapability,
+  });
+  await expect(
+    owner.attachPost({
+      ids: ids.slice(3),
+      id: draft.id,
+      browserCapability: draft.browserCapability,
+    }),
+  ).rejects.toThrow("unavailable");
+  expect(await owner.forPost(draft.slug)).toHaveLength(3);
+  const { createImageFeedbackModule } = await import("./image-feedback");
+  const { createNotionImageReviewWriter } =
+    await import("./notion-image-review");
+  const writer = createNotionImageReviewWriter({
+    token: "private-notion-key",
+    reviewUrl: (id) => owner.reviewUrl(id, "https://feedback.example.com"),
+    request: async () => new Response("unavailable", { status: 500 }),
+  });
+  const feedback = createImageFeedbackModule(options.feedback, owner, writer);
+  await expect(
+    feedback.submitPost({
+      title: "Failed review",
+      description: "Description",
+      type: "Feature Request",
+      imageIds: [ids[3]!],
+    }),
+  ).rejects.toThrow("review links");
+  expect(await owner.read(ids[3]!)).toBeUndefined();
+  expect(await owner.cleanup()).toBe(1);
+  expect(await owner.read(ids[3]!)).toBeUndefined();
+});
+
+it("removes public and creator access to images when their Comment is deleted", async () => {
+  const options = await setup();
+  const { createConnectedFeedbackModule } =
+    await import("./connected-feedback");
+  const { createImageFeedbackModule } = await import("./image-feedback");
+  const base = createFeedbackModule({
+    initialItems: [
+      {
+        id: "p",
+        slug: "public",
+        title: "Public",
+        description: "Description",
+        type: "Feature Request",
+        status: "Planned",
+        published: true,
+        createdAt: new Date(1000),
+        updatedAt: new Date(1000),
+      },
+    ],
+  });
+  const connected = createConnectedFeedbackModule(
+    base,
+    createConnectedStore(options.database),
+    participant,
+  );
+  const owner = createImageModule({
+    ...options,
+    feedback: connected,
+    participant,
+  });
+  const image = await owner.upload(png, "image/png");
+  const feedback = createImageFeedbackModule(connected, owner);
+  const comment = await feedback.createComment({
+    slug: "public",
+    body: "Screenshot attached",
+    displayName: "Spoofed",
+    imageIds: [image.id],
+  });
+  expect(comment.images?.[0]?.id).toBe(image.id);
+  expect(
+    (await feedback.listCommentThreads({ slug: "public" })).items[0]
+      ?.comments[0]?.images?.[0]?.id,
+  ).toBe(image.id);
+  expect(
+    await createImageModule({ ...options, feedback: connected }).read(image.id),
+  ).toBeDefined();
+  await feedback.deleteComment({ commentId: comment.id });
+  expect(await owner.read(image.id)).toBeUndefined();
+  expect(
+    await createImageModule({ ...options, feedback: connected }).read(image.id),
+  ).toBeUndefined();
+});