create-feedbax 0.2.0 → 0.2.2

package/template/src/configured-feedback.test.ts

@@ -0,0 +1,82 @@
+import { afterEach, expect, it } from "vitest";
+import { Miniflare } from "miniflare";
+import { readFile, readdir } from "node:fs/promises";
+import { resolve } from "node:path";
+import { createContentFeedbackModule } from "./configured-feedback";
+import type { FeedbaxConfig } from "@feedbax/config";
+
+let runtime: Miniflare | undefined;
+afterEach(async () => {
+  await runtime?.dispose();
+});
+it("runs a GitHub-only portal without Notion or verified identity and requires D1", async () => {
+  const config: FeedbaxConfig = {
+    provider: "github",
+    product: {
+      name: "Acme",
+      description: "Feedback",
+      logo: "/logo.svg",
+      siteUrl: "https://portal.example",
+    },
+    theme: { preset: "lyra-neutral" },
+    github: {
+      installationId: "portal-acme",
+      serviceUrl: "https://service.example",
+      repository: { id: 123, owner: "acme", name: "feedback" },
+      botUserId: 456,
+    },
+    features: { voting: true, comments: true, changelog: false },
+    submissions: {
+      moderation: "required",
+      maxTitleLength: 160,
+      maxDescriptionLength: 5000,
+    },
+    turnstile: { enabled: false },
+  };
+  expect(() => createContentFeedbackModule(config, {})).toThrow("FEEDBAX_DB");
+  runtime = new Miniflare({
+    modules: true,
+    script: "export default { fetch() { return new Response('ok') } }",
+    d1Databases: ["DB"],
+    compatibilityDate: "2026-07-30",
+  });
+  const database = await runtime.getD1Database("DB");
+  const directory = resolve(import.meta.dirname, "../migrations");
+  for (const file of (await readdir(directory)).sort())
+    await database.exec(
+      (await readFile(resolve(directory, file), "utf8"))
+        .replace(/--[^\n]*/g, "")
+        .replace(/\s+/g, " "),
+    );
+  const urls: string[] = [];
+  const feedback = createContentFeedbackModule(
+    config,
+    { FEEDBAX_DB: database, GITHUB_SERVICE_SECRET: "p".repeat(40) },
+    async (input, init) => {
+      const request =
+        input instanceof Request ? input : new Request(input, init);
+      urls.push(request.url);
+      if (request.url === "https://service.example/v1/token") {
+        expect(request.headers.get("X-Feedbax-Installation")).toBe(
+          "portal-acme",
+        );
+        expect(request.headers.get("X-Feedbax-Signature")).toMatch(
+          /^[a-f0-9]{64}$/,
+        );
+        return Response.json({
+          token: "scoped-access",
+          expiresAt: new Date(Date.now() + 3600_000).toISOString(),
+          repositoryId: 123,
+          botUserId: 456,
+        });
+      }
+      expect(request.headers.get("Authorization")).toBe("Bearer scoped-access");
+      if (request.url === "https://api.github.com/repos/acme/feedback")
+        return Response.json({ id: 123 });
+      return Response.json([]);
+    },
+  );
+  expect(await feedback.listPublicPosts()).toMatchObject({ items: [] });
+  expect(urls.some((url) => url.includes("notion"))).toBe(false);
+  expect(urls).toContain("https://service.example/v1/token");
+});

package/template/src/configured-feedback.ts

@@ -0,0 +1,61 @@
+import { assertRuntimeBindings, type FeedbaxConfig } from "@feedbax/config";
+import {
+  createGitHubFeedbackModule,
+  createGitHubServiceAccess,
+  createNotionFeedbackModule,
+  type ConnectedDatabase,
+  type VerifiedParticipant,
+  createPostOwnership,
+} from "@feedbax/feedback";
+
+export function createContentFeedbackModule(
+  config: FeedbaxConfig,
+  environment: {
+    FEEDBAX_DB?: ConnectedDatabase;
+    NOTION_TOKEN?: string;
+    GITHUB_SERVICE_SECRET?: string;
+    getGitHubServiceSecret?: () => Promise<string>;
+  },
+  request: typeof fetch = fetch,
+  participant?: VerifiedParticipant,
+) {
+  assertRuntimeBindings(config, environment);
+  const features = {
+    votingEnabled: config.features.voting,
+    commentsEnabled: config.features.comments,
+    ...(config.connected && participant && environment.FEEDBAX_DB
+      ? { ownership: createPostOwnership(environment.FEEDBAX_DB, participant) }
+      : {}),
+  };
+  if (config.provider === "github") {
+    if (
+      !environment.getGitHubServiceSecret &&
+      (!environment.GITHUB_SERVICE_SECRET ||
+        environment.GITHUB_SERVICE_SECRET.length < 32)
+    )
+      throw new Error(
+        "GitHub requires GITHUB_SERVICE_SECRET. Pair this portal with the GitHub App service.",
+      );
+    return createGitHubFeedbackModule({
+      ...features,
+      ...config.github,
+      database: environment.FEEDBAX_DB!,
+      request,
+      getToken: createGitHubServiceAccess({
+        config: config.github,
+        secret: environment.GITHUB_SERVICE_SECRET,
+        getSecret: environment.getGitHubServiceSecret,
+        request,
+      }),
+    });
+  }
+  if (!environment.NOTION_TOKEN)
+    throw new Error("Notion requires NOTION_TOKEN.");
+  return createNotionFeedbackModule({
+    ...features,
+    token: environment.NOTION_TOKEN,
+    dataSourceId: config.notion.dataSourceId,
+    propertyIds: config.notion.properties,
+    request,
+  });
+}

package/template/src/connected-identity.test.ts

@@ -0,0 +1,148 @@
+import { expect, it } from "vitest";
+import { createConnectedIdentityHandler } from "./connected-identity";
+
+it("starts sign-in with a secure browser challenge and never accepts a return URL", async () => {
+  const handler = createConnectedIdentityHandler({
+    siteUrl: "https://feedback.example",
+    loginUrl: "https://app.example/feedback-login",
+    issuer: "https://app.example",
+    secret: "identity-test-secret-at-least-32-characters",
+    store: undefined!,
+  });
+  const response = await handler(
+    new Request(
+      "https://feedback.example/internal/identity/start?returnTo=https://evil.example",
+    ),
+  );
+  expect(response.status).toBe(303);
+  const target = new URL(response.headers.get("location")!);
+  expect(target.origin).toBe("https://app.example");
+  expect(target.searchParams.get("state")?.length).toBeGreaterThan(30);
+  expect(target.searchParams.get("callback")).toBe(
+    "https://feedback.example/internal/identity/callback",
+  );
+  expect(response.headers.get("set-cookie")).toContain(
+    "HttpOnly; Secure; SameSite=None",
+  );
+  expect(response.headers.get("cache-control")).toBe("no-store");
+});
+
+it("exchanges a browser-bound handoff once, keeps identity private, and revokes sessions on logout", async () => {
+  const { Miniflare } = await import("miniflare");
+  const { readFile } = await import("node:fs/promises");
+  const { existsSync } = await import("node:fs");
+  const { createConnectedStore, signIdentityHandoff } =
+    await import("@feedbax/feedback");
+  const runtime = new Miniflare({
+    modules: true,
+    script: "export default {fetch(){return new Response('ok')}}",
+    compatibilityDate: "2026-07-30",
+    d1Databases: ["DB"],
+  });
+  try {
+    const db = await runtime.getD1Database("DB");
+    await db.exec(
+      (await readFile(
+        existsSync("apps/portal/migrations/0001_connected.sql")
+          ? "apps/portal/migrations/0001_connected.sql"
+          : "migrations/0001_connected.sql",
+        "utf8",
+      )) +
+        "\n" +
+        (await readFile(
+          existsSync("apps/portal/migrations/0002_participation.sql")
+            ? "apps/portal/migrations/0002_participation.sql"
+            : "migrations/0002_participation.sql",
+          "utf8",
+        )),
+    );
+    const secret = "identity-test-secret-at-least-32-characters";
+    const handler = createConnectedIdentityHandler({
+      siteUrl: "https://feedback.example",
+      loginUrl: "https://app.example/login",
+      issuer: "https://app.example",
+      secret,
+      store: createConnectedStore(db),
+      now: () => 1000000,
+    });
+    const started = await handler(
+      new Request("https://feedback.example/internal/identity/start"),
+    );
+    const challenge = started.headers.get("set-cookie")!.split(";")[0]!;
+    const state = new URL(started.headers.get("location")!).searchParams.get(
+      "state",
+    )!;
+    const token = signIdentityHandoff(
+      {
+        subject: "private-subject",
+        displayName: "Alice",
+        audience: "https://feedback.example",
+        issuer: "https://app.example",
+        state,
+        nonce: "nonce",
+        issuedAt: 1000,
+        expiresAt: 1100,
+      },
+      secret,
+    );
+    const callback = (cookie: string, origin = "https://app.example") =>
+      new Request("https://feedback.example/internal/identity/callback", {
+        method: "POST",
+        headers: {
+          Origin: origin,
+          Cookie: cookie,
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: new URLSearchParams({ token }),
+      });
+    expect((await handler(callback(""))).status).toBe(401);
+    expect(
+      (await handler(callback(challenge, "https://evil.example"))).status,
+    ).toBe(403);
+    const signedIn = await handler(callback(challenge));
+    expect(signedIn.status).toBe(303);
+    expect((await handler(callback(challenge))).status).toBe(401);
+    const session = signedIn.headers
+      .getSetCookie()
+      .find((c) => c.startsWith("__Host-feedbax-session="))!
+      .split(";")[0]!;
+    const sessionRequest = () =>
+      new Request("https://feedback.example/internal/identity/session", {
+        headers: { Cookie: session },
+      });
+    const response = await handler(sessionRequest());
+    expect(response.headers.get("cache-control")).toBe("no-store");
+    const identity = (await response.json()) as {
+      participant: { displayName: string; sessionKey: string };
+    };
+    expect(identity.participant.displayName).toBe("Alice");
+    expect(identity.participant.sessionKey).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    expect(JSON.stringify(identity)).not.toContain("private-subject");
+    expect(JSON.stringify(identity)).not.toContain(session.split("=")[1]);
+    expect(
+      (
+        await handler(
+          new Request("https://feedback.example/internal/identity/logout", {
+            method: "POST",
+            headers: { Cookie: session, Origin: "https://evil.example" },
+          }),
+        )
+      ).status,
+    ).toBe(403);
+    expect(
+      (
+        await handler(
+          new Request("https://feedback.example/internal/identity/logout", {
+            method: "POST",
+            headers: { Cookie: session, Origin: "https://feedback.example" },
+          }),
+        )
+      ).status,
+    ).toBe(200);
+    expect(await (await handler(sessionRequest())).json()).toEqual({
+      participant: null,
+    });
+  } finally {
+    await runtime.dispose();
+  }
+});

package/template/src/connected-identity.ts

@@ -0,0 +1,127 @@
+import { createHash, randomBytes } from "node:crypto";
+import { verifyIdentityHandoff, type ConnectedStore } from "@feedbax/feedback";
+
+const challengeCookie = "__Host-feedbax-handoff";
+const sessionCookie = "__Host-feedbax-session";
+export const sessionHash = (token: string) =>
+  createHash("sha256").update(token).digest("hex");
+export function readSessionToken(request: Request) {
+  return cookie(request, sessionCookie);
+}
+export function sameOrigin(request: Request, siteUrl: string) {
+  return request.headers.get("origin") === new URL(siteUrl).origin;
+}
+export function createConnectedIdentityHandler(options: {
+  siteUrl: string;
+  loginUrl: string;
+  issuer: string;
+  secret: string;
+  store: ConnectedStore;
+  now?: () => number;
+}) {
+  const origin = new URL(options.siteUrl).origin;
+  return async (request: Request): Promise<Response> => {
+    const path = new URL(request.url).pathname;
+    const headers = new Headers({
+      "Cache-Control": "no-store",
+      "Referrer-Policy": "no-referrer",
+    });
+    const json = (value: unknown, status = 200) =>
+      Response.json(value, { status, headers });
+    try {
+      if (path === "/internal/identity/start" && request.method === "GET") {
+        const state = randomBytes(32).toString("base64url");
+        const target = new URL(options.loginUrl);
+        target.searchParams.set("state", state);
+        target.searchParams.set(
+          "callback",
+          `${origin}/internal/identity/callback`,
+        );
+        headers.set(
+          "Set-Cookie",
+          `${challengeCookie}=${state}; Path=/; Max-Age=300; HttpOnly; Secure; SameSite=None`,
+        );
+        headers.set("Location", target.toString());
+        return new Response(null, { status: 303, headers });
+      }
+      if (path === "/internal/identity/callback" && request.method === "POST") {
+        if (request.headers.get("origin") !== new URL(options.loginUrl).origin)
+          return json({ error: "Sign-in origin is invalid." }, 403);
+        const body = await request.text();
+        if (body.length > 12000)
+          return json({ error: "Sign-in request is too large." }, 413);
+        const form = new URLSearchParams(body);
+        const now = options.now?.() ?? Date.now();
+        const identity = verifyIdentityHandoff(
+          form.get("token") ?? "",
+          options.secret,
+          {
+            audience: origin,
+            issuer: options.issuer,
+            state: cookie(request, challengeCookie) ?? "",
+            now: Math.floor(now / 1000),
+          },
+        );
+        const token = randomBytes(32).toString("base64url");
+        await options.store.acceptIdentity({
+          ...identity,
+          subject: JSON.stringify([identity.issuer, identity.subject]),
+          nonce: identity.nonce,
+          challenge: identity.state,
+          sessionHash: sessionHash(token),
+          expiresAt: now + 7 * 86400000,
+        });
+        headers.append(
+          "Set-Cookie",
+          `${sessionCookie}=${token}; Path=/; Max-Age=604800; HttpOnly; Secure; SameSite=Lax`,
+        );
+        headers.append(
+          "Set-Cookie",
+          `${challengeCookie}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=None`,
+        );
+        headers.set("Location", origin);
+        return new Response(null, { status: 303, headers });
+      }
+      if (path === "/internal/identity/session" && request.method === "GET") {
+        const token = readSessionToken(request);
+        const participant = token
+          ? await options.store.session(sessionHash(token), options.now?.())
+          : undefined;
+        return json({
+          participant: participant
+            ? {
+                displayName: participant.displayName,
+                sessionKey: createHash("sha256")
+                  .update(`feedbax-ui-session-v1:${token}`)
+                  .digest("base64url"),
+              }
+            : null,
+        });
+      }
+      if (path === "/internal/identity/logout" && request.method === "POST") {
+        if (!sameOrigin(request, origin))
+          return json({ error: "Request origin is invalid." }, 403);
+        const token = readSessionToken(request);
+        if (token) await options.store.logout(sessionHash(token));
+        headers.set(
+          "Set-Cookie",
+          `${sessionCookie}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax`,
+        );
+        return json({ signedOut: true });
+      }
+      return json({ error: "Not found." }, 404);
+    } catch {
+      return json(
+        { error: "Sign-in could not be completed. Start sign-in again." },
+        401,
+      );
+    }
+  };
+}
+function cookie(request: Request, name: string): string | undefined {
+  const pairs = (request.headers.get("cookie") ?? "")
+    .split(";")
+    .map((v) => v.trim())
+    .filter((v) => v.startsWith(`${name}=`));
+  return pairs.length === 1 ? pairs[0]!.slice(name.length + 1) : undefined;
+}

package/template/src/connected-participation.test.tsx

@@ -0,0 +1,67 @@
+// @vitest-environment jsdom
+import { afterEach, expect, it, vi } from "vitest";
+import {
+  cleanup,
+  fireEvent,
+  render,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { ConnectedIdentityProvider } from "./components/connected-identity-provider";
+import { VoteToggle } from "./vote-toggle";
+vi.mock("./feedbax", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("./feedbax")>();
+  return {
+    default: {
+      ...actual.default,
+      connected: {
+        issuer: "https://app.example",
+        loginUrl: "https://app.example/login",
+      },
+    },
+  };
+});
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+  localStorage.clear();
+  sessionStorage.clear();
+});
+it("restores a signed-in Participant's Vote from the server instead of device storage", async () => {
+  const request = vi.fn<typeof fetch>().mockImplementation(async (input) => {
+    const url = String(input);
+    if (url === "/internal/identity/session")
+      return Response.json({ participant: { displayName: "Alice" } });
+    if (url.startsWith("/internal/connected/votes?"))
+      return Response.json({ voted: true, voteCount: 4 });
+    return Response.json({ slug: "post", voteCount: 3, voted: false });
+  });
+  vi.stubGlobal("fetch", request);
+  render(
+    <ConnectedIdentityProvider>
+      <VoteToggle
+        post={{
+          slug: "post",
+          title: "Post",
+          description: "Description",
+          type: "Feature Request",
+          status: "Planned",
+          createdAt: new Date(),
+          updatedAt: new Date(),
+          voteCount: 4,
+        }}
+      />
+    </ConnectedIdentityProvider>,
+  );
+  const button = await screen.findByRole("button", {
+    name: "Remove Vote, 4 Votes",
+  });
+  expect(button.getAttribute("aria-pressed")).toBe("true");
+  fireEvent.click(button);
+  await waitFor(() =>
+    expect(
+      screen.getByRole("button", { name: "Add Vote, 3 Votes" }),
+    ).toBeTruthy(),
+  );
+  expect(localStorage.length).toBe(0);
+});