devpush 0.0.0-stage → 1.0.0-beta.3

package/src/server/email/notification-template.tsx

@@ -0,0 +1,62 @@
+import { Button, Link, Section, Text } from '@react-email/components'
+import { EmailLayout } from './layout'
+import { emailTheme } from './theme'
+
+export function NotificationEmailTemplate({
+  title,
+  message,
+  to,
+  action,
+}: {
+  title: string
+  message: string
+  to: string
+  action?: { label: string; url: string }
+}) {
+  return (
+    <EmailLayout title={title} preview={title} to={to} allowIgnore={false}>
+      {message
+        .split('\n')
+        .filter(Boolean)
+        .map((paragraph, index) => (
+          <Text
+            key={index}
+            className="text-[16px] leading-[24px]"
+            style={{ color: emailTheme.foreground }}
+          >
+            {paragraph}
+          </Text>
+        ))}
+      {action ? (
+        <>
+          <Section className="my-[28px] text-center">
+            <Button
+              className="rounded-lg px-[18px] py-[10px] text-[14px] font-medium no-underline"
+              href={action.url}
+              style={{
+                backgroundColor: emailTheme.primary,
+                color: emailTheme.primaryForeground,
+              }}
+            >
+              {action.label}
+            </Button>
+          </Section>
+          <Text
+            className="text-[14px] leading-[24px]"
+            style={{ color: emailTheme.mutedForeground }}
+          >
+            If the button does not work, copy and paste this link into your
+            browser:{' '}
+            <Link
+              className="break-all underline"
+              href={action.url}
+              style={{ color: emailTheme.mutedLink }}
+            >
+              {action.url}
+            </Link>
+          </Text>
+        </>
+      ) : null}
+    </EmailLayout>
+  )
+}

package/src/server/email/otp-template.tsx

@@ -0,0 +1,48 @@
+import { Section, Text } from '@react-email/components'
+import { EmailLayout } from './layout'
+import { emailTheme } from './theme'
+
+type OtpEmailTemplateProps = {
+  otp: string
+  preview: string
+  to: string
+}
+
+export function OtpEmailTemplate({ otp, preview, to }: OtpEmailTemplateProps) {
+  return (
+    <EmailLayout title={'Sign in to devpush'} preview={preview} to={to}>
+      <Text
+        className="text-[16px] leading-[24px]"
+        style={{ color: emailTheme.foreground }}
+      >
+        Enter this temporary verification code to continue:
+      </Text>
+
+      <Section className="mt-[24px] mb-[24px] text-center">
+        <pre
+          className="inline-block rounded-lg border-0 text-[24px] font-medium"
+          style={{
+            backgroundColor: emailTheme.muted,
+            color: emailTheme.foreground,
+            fontFamily:
+              'ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace',
+            letterSpacing: '6px',
+            lineHeight: 1,
+            marginBottom: 0,
+            marginTop: 0,
+            padding: '12px 4px 12px 12px',
+          }}
+        >
+          {otp}
+        </pre>
+      </Section>
+
+      <Text
+        className="text-[16px] leading-[24px]"
+        style={{ color: emailTheme.foreground }}
+      >
+        This code will expire in 5 minutes.
+      </Text>
+    </EmailLayout>
+  )
+}

package/src/server/email/service.ts

@@ -0,0 +1,251 @@
+import { safeErrorDiagnostics } from '#devpush/server/http/error-diagnostics'
+import { config } from '#devpush/server/config'
+
+type EmailPayload = {
+  from?: string
+  html: string
+  subject: string
+  text: string
+  to: string
+}
+
+export async function sendEmail(
+  { from = config.EMAIL_FROM, html, subject, text, to }: EmailPayload,
+  idempotencyKey?: string,
+) {
+  if (!from) {
+    throw new Error('EMAIL_FROM is not configured.')
+  }
+
+  if (!config.RESEND_API_KEY) {
+    throw new Error('RESEND_API_KEY is not configured.')
+  }
+
+  try {
+    const response = await fetch('https://api.resend.com/emails', {
+      method: 'POST',
+      signal: AbortSignal.timeout(10_000),
+      headers: {
+        Authorization: `Bearer ${config.RESEND_API_KEY}`,
+        'Content-Type': 'application/json',
+        ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {}),
+      },
+      body: JSON.stringify({
+        from,
+        html,
+        subject,
+        text,
+        to,
+      }),
+    })
+    // Only provider acceptance matters here; never retain or surface its body.
+    await response.body?.cancel().catch(() => undefined)
+    if (!response.ok) {
+      console.warn('Email provider rejected delivery.', {
+        status: response.status,
+      })
+      throw new Error('Email provider rejected delivery.')
+    }
+  } catch (error) {
+    console.warn('Email delivery failed.', safeErrorDiagnostics(error))
+    throw new Error('Unable to deliver email.')
+  }
+}
+
+export async function sendOtpEmail(email: string, otp: string) {
+  const message = await buildOtpEmailMessage(email, otp)
+
+  await sendEmail({
+    to: email,
+    subject: message.subject,
+    html: message.html,
+    text: message.text,
+  })
+}
+
+export async function sendEmailChangeEmail({
+  currentEmail,
+  newEmail,
+  verifyUrl,
+}: {
+  currentEmail: string
+  newEmail: string
+  verifyUrl: string
+}) {
+  const message = await buildEmailChangeMessage({
+    currentEmail,
+    newEmail,
+    verifyUrl,
+  })
+
+  await sendEmail({
+    to: currentEmail,
+    subject: message.subject,
+    html: message.html,
+    text: message.text,
+  })
+}
+
+export async function buildEmailChangeMessage({
+  currentEmail,
+  newEmail,
+  verifyUrl,
+}: {
+  currentEmail: string
+  newEmail: string
+  verifyUrl: string
+}) {
+  return {
+    subject: 'Confirm your devpush email change',
+    html: await renderNotificationEmail({
+      title: 'Confirm your devpush email change',
+      to: currentEmail,
+      message: `Confirm that you want to use ${newEmail} for devpush.\nAfter confirmation, we will ask you to verify the new address.`,
+      action: { label: 'Confirm email change', url: verifyUrl },
+    }),
+    text: `Confirm that you want to use ${newEmail} for devpush.
+
+Confirm email change: ${verifyUrl}
+
+This request was made from ${currentEmail}. After confirmation, we will ask you to verify the new address.`,
+  }
+}
+
+export async function sendEmailVerificationEmail({
+  email,
+  verifyUrl,
+}: {
+  email: string
+  verifyUrl: string
+}) {
+  const message = await buildEmailVerificationMessage({ email, verifyUrl })
+
+  await sendEmail({
+    to: email,
+    subject: message.subject,
+    html: message.html,
+    text: message.text,
+  })
+}
+
+export async function buildEmailVerificationMessage({
+  email,
+  verifyUrl,
+}: {
+  email: string
+  verifyUrl: string
+}) {
+  return {
+    subject: 'Verify your devpush email address',
+    html: await renderNotificationEmail({
+      title: 'Verify your devpush email address',
+      to: email,
+      message: 'Verify your email address for devpush.',
+      action: { label: 'Verify email address', url: verifyUrl },
+    }),
+    text: `Verify your email address for devpush.
+
+Verify email address: ${verifyUrl}
+
+This email was intended for ${email}. If you think this is a mistake, you can safely ignore this email.`,
+  }
+}
+
+export async function buildOtpEmailMessage(email: string, otp: string) {
+  const [{ render }, { OtpEmailTemplate }] = await Promise.all([
+    import('@react-email/render'),
+    import('#devpush/server/email/otp-template'),
+  ])
+  const subject = `Your temporary code is ${otp}`
+  const html = await render(
+    OtpEmailTemplate({ otp, preview: subject, to: email }),
+  )
+
+  return {
+    subject,
+    html,
+    text: `Your temporary code is ${otp}
+
+Sign in to devpush
+
+Enter this temporary verification code to continue:
+
+${otp}
+
+This code will expire in 5 minutes.
+
+This email was intended for ${email}. If you think this is a mistake, you can safely ignore this email.`,
+  }
+}
+
+export async function renderNotificationEmail(input: {
+  title: string
+  message: string
+  to: string
+  action?: { label: string; url: string }
+}) {
+  const [{ render }, { NotificationEmailTemplate }] = await Promise.all([
+    import('@react-email/render'),
+    import('./notification-template'),
+  ])
+  return render(NotificationEmailTemplate(input))
+}
+
+export async function sendTeamInviteEmail({
+  email,
+  inviteUrl,
+  teamName,
+}: {
+  email: string
+  inviteUrl: string
+  teamName: string
+}) {
+  const message = await buildTeamInviteEmailMessage({
+    email,
+    inviteUrl,
+    teamName,
+  })
+
+  await sendEmail({
+    to: email,
+    subject: message.subject,
+    html: message.html,
+    text: message.text,
+  })
+}
+
+export async function buildTeamInviteEmailMessage({
+  email,
+  inviteUrl,
+  teamName,
+}: {
+  email: string
+  inviteUrl: string
+  teamName: string
+}) {
+  const [{ render }, { TeamInviteEmailTemplate }] = await Promise.all([
+    import('@react-email/render'),
+    import('#devpush/server/email/team-invite-template'),
+  ])
+  const subject = `Join ${teamName} on devpush`
+  const html = await render(
+    TeamInviteEmailTemplate({
+      inviteUrl,
+      preview: subject,
+      teamName,
+      to: email,
+    }),
+  )
+
+  return {
+    subject,
+    html,
+    text: `Join ${teamName} on devpush
+
+You have been invited to join ${teamName} on devpush.
+
+Accept invitation: ${inviteUrl}
+
+This email was intended for ${email}. If you think this is a mistake, you can safely ignore this email.`,
+  }
+}

package/src/server/email/team-invite-template.tsx

@@ -0,0 +1,59 @@
+import { Button, Link, Section, Text } from '@react-email/components'
+import { EmailLayout } from './layout'
+import { emailTheme } from './theme'
+
+type TeamInviteEmailTemplateProps = {
+  inviteUrl: string
+  preview: string
+  teamName: string
+  to: string
+}
+
+export function TeamInviteEmailTemplate({
+  inviteUrl,
+  preview,
+  teamName,
+  to,
+}: TeamInviteEmailTemplateProps) {
+  return (
+    <EmailLayout
+      title={`Join ${teamName} on devpush`}
+      preview={preview}
+      to={to}
+    >
+      <Text
+        className="text-[16px] leading-[24px]"
+        style={{ color: emailTheme.foreground }}
+      >
+        You have been invited to join {teamName} on devpush.
+      </Text>
+
+      <Section className="mt-[28px] mb-[28px] text-center">
+        <Button
+          className="rounded-lg px-[18px] py-[10px] text-center text-[14px] font-medium no-underline"
+          href={inviteUrl}
+          style={{
+            backgroundColor: emailTheme.primary,
+            color: emailTheme.primaryForeground,
+          }}
+        >
+          Accept invitation
+        </Button>
+      </Section>
+
+      <Text
+        className="text-[14px] leading-[24px]"
+        style={{ color: emailTheme.mutedForeground }}
+      >
+        If the button does not work, copy and paste this link into your browser:{' '}
+        <Link
+          className="break-all underline"
+          href={inviteUrl}
+          style={{ color: emailTheme.mutedLink }}
+        >
+          {inviteUrl}
+        </Link>
+      </Text>
+    </EmailLayout>
+  )
+}

package/src/server/email/theme.ts

@@ -0,0 +1,10 @@
+// Email-safe sRGB equivalents of the light Taupe tokens in styles/theme.css.
+export const emailTheme = {
+  background: '#ffffff',
+  foreground: '#0c0a09',
+  primary: '#1d1816',
+  primaryForeground: '#fbfaf9',
+  muted: '#f3f1f1',
+  mutedForeground: '#7c6d67',
+  mutedLink: '#7c6d67',
+} as const

package/src/server/github/http.ts

@@ -0,0 +1,14 @@
+import { readRequestText } from '#devpush/server/http/request-body'
+/** Fixed-provider requests must not hold auth, enrollment or scheduler work indefinitely. */
+export function fetchGitHub(url: string, init: RequestInit = {}) {
+  const timeout = AbortSignal.timeout(10_000)
+  return fetch(url, {
+    ...init,
+    signal: init.signal ? AbortSignal.any([init.signal, timeout]) : timeout,
+  })
+}
+
+/** GitHub pages/contents have known sizes; never buffer an unlimited provider body. */
+export async function readGitHubJson<T>(response: Response): Promise<T> {
+  return JSON.parse(await readRequestText(response, 4 * 1024 * 1024)) as T
+}

package/src/server/github/install-state.ts

@@ -0,0 +1,48 @@
+import { jwtVerify, SignJWT } from 'jose'
+
+import { config } from '#devpush/server/config'
+import { getSafeRedirectPath } from '#devpush/lib/internal-redirect'
+
+const audience = 'devpush:github-installation'
+const issuer = 'devpush'
+
+export async function createGitHubInstallState({
+  next,
+  userId,
+}: {
+  next: string
+  userId: string
+}) {
+  return new SignJWT({ next: getSafeRedirectPath(next), userId })
+    .setProtectedHeader({ alg: 'HS256' })
+    .setAudience(audience)
+    .setIssuer(issuer)
+    .setIssuedAt()
+    .setExpirationTime('15m')
+    .setJti(crypto.randomUUID())
+    .sign(secret())
+}
+
+export async function verifyGitHubInstallState({
+  state,
+  userId,
+}: {
+  state: string
+  userId: string
+}) {
+  const { payload } = await jwtVerify(state, secret(), {
+    algorithms: ['HS256'],
+    audience,
+    issuer,
+  })
+
+  if (payload.userId !== userId || typeof payload.next !== 'string') {
+    throw new Error('Invalid GitHub installation state.')
+  }
+
+  return getSafeRedirectPath(payload.next)
+}
+
+function secret() {
+  return new TextEncoder().encode(config.BETTER_AUTH_SECRET)
+}