emdash-multisite 0.0.0-stage → 0.7.0

package/src/scheduled.ts

@@ -0,0 +1,107 @@
+/**
+ * Cron fan-out. EmDash's scheduled handler publishes due scheduled content and
+ * runs plugin cron for ONE site: whichever is ambient, which in a cron trigger
+ * (no request, no hostname) is the primary. Wrap it so every ready site gets
+ * its turn:
+ *
+ *   import handler, { createScheduledHandler, PluginBridge } from "@emdash-cms/cloudflare/worker";
+ *   import { perSiteScheduled } from "emdash-multisite/scheduled";
+ *   export default { ...handler, scheduled: perSiteScheduled(createScheduledHandler()) };
+ *
+ * ponytail: sites run one after another inside a single trigger, so a tick takes
+ * roughly (sites x per-site sweep). Fine for hundreds of mostly idle sites; the
+ * upgrade path is a Queue with one message per site, fed by this same loop.
+ */
+import { runAsSite } from "./dialect.ts";
+import { sitesConfig } from "./config.ts";
+import { reconcile } from "./orgs.ts";
+import { backupSite, readLastBackups } from "./backup.ts";
+import { mediaBucket } from "./media-bucket.ts";
+import { syncRecentPasswords } from "./passwords.ts";
+import { purgeSite } from "./purge.ts";
+import { readAllStates, readAllStatuses, warm } from "./registry.ts";
+import { DEFAULT_DELETE_GRACE_DAYS, backupDue, isPurgeDue, mayStartAnother } from "./rules.ts";
+import { scopeState } from "./scope.ts";
+
+type Scheduled = (controller: unknown, env: unknown, ctx: { waitUntil(p: Promise<unknown>): void }) => unknown;
+
+/**
+ * Sites that should run: the primary, then every site whose provisioning finished
+ * and that is neither suspended nor deleted. Skipping the latter two matters: waking
+ * a site's runtime runs its migrations, which would re-create the tables of a site
+ * that is being purged.
+ */
+export async function sitesToSweep(): Promise<string[]> {
+	await warm();
+	const inactive = await readAllStates();
+	const ready = [...(await readAllStatuses())].filter(([slug, s]) => s.status === "ready" && !inactive.has(slug)).map(([slug]) => slug);
+	return [scopeState().primary, ...ready.sort()];
+}
+
+export function perSiteScheduled<T extends Scheduled>(base: T): T {
+	const wrapped: Scheduled = (controller, env, ctx) => {
+		ctx.waitUntil(
+			(async () => {
+				// A cron run can start in a fresh isolate that has served no request, so the database wrapper does not exist yet.
+				// Without this every task below failed with "database not initialised yet" (purge, backup, password sync, reconcile).
+				try {
+					await warm();
+				} catch (error) {
+					console.error("[multisite] could not open the database for the cron run:", error);
+				}
+				// Destroy at most one site whose delete grace period is over (a purge is many DROPs).
+				try {
+					const grace = sitesConfig()?.deleteGraceDays ?? DEFAULT_DELETE_GRACE_DAYS;
+					const due = [...(await readAllStates())].find(([, st]) => isPurgeDue(st, grace, Date.now()));
+					if (due) await runAsSite(scopeState().primary, () => purgeSite(due[0]));
+				} catch (error) {
+					console.error("[multisite] purge failed:", error);
+				}
+				// Back up at most one ready site that has no backup from the last day. Skipped without R2.
+				try {
+					const last = await readLastBackups();
+					const inactive = await readAllStates();
+					const due = [...(await readAllStatuses())]
+						.find(([slug, st]) => st.status === "ready" && !inactive.has(slug) && backupDue(last.get(slug), Date.now()));
+					if (due && (await mediaBucket())) await runAsSite(scopeState().primary, () => backupSite(due[0]));
+				} catch (error) {
+					console.error("[multisite] backup failed:", error);
+				}
+				// Safety net for password changes whose immediate sync was cut off.
+				try {
+					await runAsSite(scopeState().primary, () => syncRecentPasswords(10 * 60_000));
+				} catch (error) {
+					console.error("[multisite] password sync failed:", error);
+				}
+				// Finish one site whose provisioning died and that nobody is watching.
+				try {
+					const cfg = sitesConfig();
+					if (cfg) {
+						// Several stuck sites per tick (template clones take seconds), not one: a bad deploy can strand dozens.
+						const t0 = Date.now();
+						for (let done = 0; mayStartAnother(done, Date.now() - t0); done++) {
+							if (!(await runAsSite(scopeState().primary, () => reconcile(cfg))).length) break;
+						}
+					}
+				} catch (error) {
+					console.error("[multisite] reconcile failed:", error);
+				}
+				for (const site of await sitesToSweep()) {
+					// The base handler hands its work to ctx.waitUntil; collect it so each
+					// site finishes before the next starts, and one failing site does not
+					// stop the rest.
+					const pending: Promise<unknown>[] = [];
+					try {
+						await runAsSite(site, async () => {
+							await base(controller, env, { ...ctx, waitUntil: (p) => void pending.push(p) });
+						});
+					} catch (error) {
+						console.error(`[multisite] scheduled sweep for "${site}" failed:`, error);
+					}
+					await Promise.allSettled(pending);
+				}
+			})(),
+		);
+	};
+	return wrapped as T;
+}

package/src/scope.ts

@@ -0,0 +1,178 @@
+import { currentSite } from "./dialect.ts";
+
+/**
+ * Per-site holders for core's process-wide caches.
+ *
+ * Core keeps many caches as ONE object captured at module load. The build-time
+ * patch (see vite.ts) replaces each such object with `siteScoped(key, init)`:
+ * a Proxy that forwards every operation to a separate real object per site.
+ */
+
+const STATE = Symbol.for("emdash-multisite:state");
+const REQUEST_CONTEXT = Symbol.for("emdash:request-context");
+const SLOT_MEMO = Symbol.for("emdash-multisite:slot-proxies");
+
+interface ScopeState {
+	primary: string;
+	/** the one shared inner dialect (set when the database descriptor initialises) */
+	inner?: import("kysely").Dialect;
+	/** resolves the site of the work happening right now */
+	activeSite: () => string;
+	/** per-site Kysely handle -> site id (core stores that handle in its request context) */
+	siteOfDb: WeakMap<object, string>;
+	holders: Map<string, object>;
+	/** site -> (globalThis symbol slot -> value), for caches read from globalThis on every use */
+	slots: Map<string, Map<symbol, unknown>>;
+}
+
+// On globalThis so duplicated bundle chunks share one registry.
+export function scopeState(): ScopeState {
+	const g = globalThis as Record<symbol, unknown>;
+	return (g[STATE] ??= {
+		primary: "main",
+		activeSite: () => activeSite(),
+		siteOfDb: new WeakMap(),
+		holders: new Map(),
+		slots: new Map(),
+	}) as ScopeState;
+}
+
+/** Site the current work belongs to: request's db handle, else runAsSite, else primary. */
+export function activeSite(): string {
+	const st = scopeState();
+	const als = (globalThis as Record<symbol, unknown>)[REQUEST_CONTEXT] as
+		| { getStore(): { db?: object } | undefined }
+		| undefined;
+	const db = als?.getStore()?.db;
+	return (db && st.siteOfDb.get(db)) ?? currentSite() ?? st.primary;
+}
+
+/** The nested single-flight cache (its own fields; 1.2.x this WAS the whole memo). */
+interface SingleFlight {
+	version: number;
+	hasValue: boolean;
+	value: unknown;
+	valueVersion: number;
+	lock: { ownerStartedAt: unknown };
+}
+/**
+ * emdash 1.3.x wraps the single-flight cache in a stale-while-revalidate holder:
+ * `{ snapshot, expiresAt, generation, revalidatingUntil, refresh: SingleFlight }`.
+ * Fields optional so this also covers the 1.2.x bare-SingleFlight shape.
+ */
+interface SettingsMemo extends Partial<SingleFlight> {
+	snapshot?: unknown;
+	expiresAt?: number;
+	generation?: number;
+	revalidatingUntil?: number;
+	refresh?: SingleFlight;
+}
+const lastForget = new Map<string, number>();
+/**
+ * Drop the active site's memo of its site settings (title, tagline, logo, SEO defaults). Core keeps that memo for the whole
+ * isolate lifetime with no TTL, and only the isolate that handled a settings write drops its copy. A render that fills the edge
+ * cache right after a purge would otherwise store the OLD title for the whole cache TTL. Same steps as core's
+ * `invalidateSingleFlightCache`. At most once per 2 s per site, so a burst of fills after a purge shares one re-read (the
+ * trailing purge covers an edit that lands inside that window).
+ */
+export function forgetSiteSettings(now = Date.now()): void {
+	const site = activeSite();
+	if (now - (lastForget.get(site) ?? 0) < 2000) return;
+	if (lastForget.size > 2000) lastForget.clear();
+	lastForget.set(site, now);
+	const memo = scopeState().holders.get("emdash:site-settings:swr") as SettingsMemo | undefined;
+	if (!memo) return;
+	// 1.3.x stale-while-revalidate wrapper: drop the stored snapshot + force a refresh.
+	if ("snapshot" in memo || "generation" in memo) {
+		memo.snapshot = null;
+		memo.expiresAt = 0;
+		memo.revalidatingUntil = 0;
+		if (typeof memo.generation === "number") memo.generation++;
+	}
+	// The inner single-flight cache: nested under `.refresh` in 1.3.x, the memo
+	// itself in 1.2.x. Clear whichever carries the single-flight fields.
+	const sf: Partial<SingleFlight> = memo.refresh ?? memo;
+	if (typeof sf.version === "number") sf.version++;
+	sf.hasValue = false;
+	sf.value = null;
+	sf.valueVersion = -1;
+	if (sf.lock) sf.lock.ownerStartedAt = null;
+}
+
+export function siteScoped<T extends object>(key: string, init: () => T): T {
+	const st = scopeState();
+	const existing = st.holders.get(key);
+	if (existing) return existing as T;
+
+	const perSite = new Map<string, T>();
+	const real = (): T => {
+		const site = activeSite();
+		let v = perSite.get(site);
+		if (!v) {
+			v = init();
+			perSite.set(site, v);
+		}
+		return v;
+	};
+	// ponytail: methods are re-bound on every read, so function identity is not
+	// stable across reads. Core only calls them; revisit if something compares them.
+	const proxy = new Proxy({} as T, {
+		get(_t, p) {
+			const r = real();
+			const v = Reflect.get(r, p, r);
+			return typeof v === "function" ? v.bind(r) : v;
+		},
+		set: (_t, p, v) => Reflect.set(real(), p, v),
+		has: (_t, p) => Reflect.has(real(), p),
+		deleteProperty: (_t, p) => Reflect.deleteProperty(real(), p),
+		ownKeys: () => Reflect.ownKeys(real()),
+		getOwnPropertyDescriptor(_t, p) {
+			const d = Reflect.getOwnPropertyDescriptor(real(), p);
+			if (d) d.configurable = true;
+			return d;
+		},
+		defineProperty: (_t, p, d) => Reflect.defineProperty(real(), p, d),
+		getPrototypeOf: () => Reflect.getPrototypeOf(real()),
+	});
+	st.holders.set(key, proxy);
+	return proxy;
+}
+
+/**
+ * Stand-in for `globalThis` in code that reads a cache from a `Symbol.for` slot
+ * on every use (`store[KEY] ?? create`). Reads and writes of the listed keys go
+ * to the active site's own slot; everything else passes through to the real
+ * globalThis.
+ */
+export function siteGlobal(keys: readonly string[]): Record<symbol, unknown> {
+	const memo = (globalThis as Record<symbol, unknown>)[SLOT_MEMO] as Map<string, Record<symbol, unknown>> | undefined;
+	const id = keys.join("|");
+	const hit = memo?.get(id);
+	if (hit) return hit;
+	const scoped = new Set<symbol>(keys.map((k) => Symbol.for(k)));
+	const slot = (): Map<symbol, unknown> => {
+		const st = scopeState();
+		const site = activeSite();
+		let m = st.slots.get(site);
+		if (!m) st.slots.set(site, (m = new Map()));
+		return m;
+	};
+	const real = globalThis as unknown as Record<symbol, unknown>;
+	const proxy = new Proxy(real, {
+		get: (t, p) => (scoped.has(p as symbol) ? slot().get(p as symbol) : Reflect.get(t, p, t)),
+		set(t, p, v) {
+			if (scoped.has(p as symbol)) slot().set(p as symbol, v);
+			else Reflect.set(t, p, v, t);
+			return true;
+		},
+		has: (t, p) => (scoped.has(p as symbol) ? slot().has(p as symbol) : Reflect.has(t, p)),
+		deleteProperty: (t, p) => (scoped.has(p as symbol) ? slot().delete(p as symbol) : Reflect.deleteProperty(t, p)),
+	});
+	// Some declarations sit inside functions, so hand back one proxy per key list.
+	const table = ((real as Record<symbol, unknown>)[SLOT_MEMO] ??= new Map<string, Record<symbol, unknown>>()) as Map<
+		string,
+		Record<symbol, unknown>
+	>;
+	table.set(id, proxy);
+	return proxy;
+}

package/src/sites.ts

@@ -0,0 +1,97 @@
+import { isSiteId } from "./rewrite.ts";
+import { THEME_ID, isLocalPath, type Limits, type Themes } from "./rules.ts";
+
+/** Serializable (lives in the build-time database descriptor). */
+export interface SitesConfig {
+	/** Site that keeps the original unprefixed tables. */
+	primary: string;
+	/** Exact hostname -> site id (custom domains). */
+	hosts?: Record<string, string>;
+	/** Base domain: `acme.example.com` -> site `acme`. */
+	wildcard?: string;
+	/** Caps on site creation. Defaults to 3 sites per user, no platform cap. */
+	limits?: Limits;
+	/**
+	 * Make the site's sign-up state available to themes as `Astro.locals.multisite` (`{ signup, account }`), for the
+	 * host's `AuthLinks` component that draws Sign in / Sign up / My account / Admin inside the theme header
+	 * (see `authLinksFor`). Customer sites offer Sign in / Sign up only while their public sign-up is on. Default off.
+	 */
+	authLinks?: boolean;
+	/** Extra email domains refused at sign-up, on top of the built-in disposable-mail list. */
+	blockedEmailDomains?: string[];
+	/**
+	 * Themes a new site can pick, each with its seed. Omit for a single theme
+	 * (the host's bundled seed).
+	 * ponytail: seeds are embedded in the build-time config, which bloats it by
+	 * the size of the seeds (tens of KB each). Upgrade path: a virtual module
+	 * generated from a themes/ directory.
+	 */
+	themes?: Themes;
+	/**
+	 * The host shows "My sites" as a tab in Better Auth UI's account page
+	 * (`/account/sites`, see `emdash-multisite/auth-ui`). `/sites` then redirects
+	 * there and users land on it after signing in.
+	 */
+	accountTab?: boolean;
+	/** Public address of the app (account, my sites), e.g. `https://app.example.com`. Used for links back from a site's admin. */
+	appUrl?: string;
+	/** Days a deleted site stays restorable before its data is purged. Default 14. */
+	deleteGraceDays?: number;
+	/** Where users land after signing in or up on the control plane. Defaults to `/sites`. */
+	postLoginPath?: string;
+	/** Theme preselected in the wizard and used when none is requested. Defaults to the first theme. */
+	defaultTheme?: string;
+}
+
+export function assertSitesConfig(c: SitesConfig): void {
+	if (!isSiteId(c.primary)) throw new Error(`[multisite] invalid primary site id: ${c.primary}`);
+	if (c.postLoginPath !== undefined && !isLocalPath(c.postLoginPath)) {
+		throw new Error(`[multisite] postLoginPath must be a path on this site: ${c.postLoginPath}`);
+	}
+	for (const id of Object.keys(c.themes ?? {})) {
+		if (!THEME_ID.test(id)) throw new Error(`[multisite] invalid theme id: ${id}`);
+	}
+	if (c.defaultTheme && !Object.hasOwn(c.themes ?? {}, c.defaultTheme)) {
+		throw new Error(`[multisite] defaultTheme "${c.defaultTheme}" is not in themes`);
+	}
+	if (c.appUrl !== undefined && !/^https?:\/\/[^/\s]+$/.test(c.appUrl)) throw new Error("[multisite] appUrl must be an origin like https://app.example.com (no path)");
+	if (c.deleteGraceDays !== undefined && (!Number.isInteger(c.deleteGraceDays) || c.deleteGraceDays < 0)) {
+		throw new Error("[multisite] deleteGraceDays must be a non-negative integer");
+	}
+	if (c.limits?.concurrentProvisions !== undefined && c.limits.concurrentProvisions < 1) throw new Error("[multisite] limits.concurrentProvisions must be at least 1");
+	for (const [k, v] of Object.entries(c.limits ?? {})) {
+		if (v !== undefined && (!Number.isInteger(v) || v < 0)) throw new Error(`[multisite] limits.${k} must be a non-negative integer`);
+	}
+	if (c.blockedEmailDomains && !c.blockedEmailDomains.every((d) => typeof d === "string" && /^[a-z0-9.-]+\.[a-z]{2,}$/i.test(d))) {
+		throw new Error("[multisite] blockedEmailDomains must be domain names like example.com");
+	}
+	for (const [host, id] of Object.entries(c.hosts ?? {})) {
+		if (!isSiteId(id)) throw new Error(`[multisite] invalid site id for ${host}: ${id}`);
+	}
+}
+
+/**
+ * Hostname -> site id. Unknown hosts (localhost, workers.dev previews) fall
+ * back to the primary site, which is what a single-site install does anyway.
+ */
+export function resolveSite(hostname: string, c: SitesConfig): string {
+	const host = hostname.toLowerCase().replace(/:\d+$/, "");
+	const exact = c.hosts?.[host];
+	if (exact) return exact;
+	if (c.wildcard && host.endsWith(`.${c.wildcard}`)) {
+		const label = host.slice(0, -(c.wildcard.length + 1));
+		if (isSiteId(label)) return label;
+	}
+	return c.primary;
+}
+
+/**
+ * Public address of a site, or `null` when no hostname is configured for it.
+ * An exact `hosts` entry wins (it is what the Worker actually routes), then the
+ * wildcard base domain.
+ */
+export function siteUrl(slug: string, c: SitesConfig): string | null {
+	const host = Object.entries(c.hosts ?? {}).find(([, id]) => id === slug)?.[0];
+	if (host) return `https://${host}`;
+	return c.wildcard ? `https://${slug}.${c.wildcard}` : null;
+}

package/src/slots.ts

@@ -0,0 +1,38 @@
+/**
+ * A platform-wide cap on how many sites are provisioned at the same time. One D1 database does one write at a time and a site
+ * clone writes ~370 objects, so a burst of sign-ups made every other site slow (measured: page reads p95 0.6 s to 3.2 s while 12
+ * sites were created at once). A slot is a control-plane `options` row holding its expiry; one INSERT ... SELECT takes a slot only
+ * while fewer than `max` unexpired rows exist, and D1 runs statements one at a time, so the cap is exact. A crashed holder frees
+ * its slot when the row expires.
+ * ponytail: expired rows of crashed holders stay until their site is provisioned again (they are ignored, not counted).
+ */
+import { sql } from "kysely";
+import { runAsSite } from "./dialect.ts";
+import { controlDb } from "./registry.ts";
+import { SLOT_PREFIX, SLOT_TTL_MS } from "./rules.ts";
+import { scopeState } from "./scope.ts";
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+/** Take a slot for `slug`, waiting up to `waitMs`. False when none came free in time. */
+export async function acquireSlot(slug: string, max: number, waitMs: number): Promise<boolean> {
+	const db = controlDb();
+	const deadline = Date.now() + waitMs;
+	for (;;) {
+		const now = Date.now();
+		const r = await runAsSite(scopeState().primary, () =>
+			sql`INSERT INTO options (name, value)
+				SELECT ${SLOT_PREFIX + slug}, ${String(now + SLOT_TTL_MS)}
+				WHERE (SELECT COUNT(*) FROM options WHERE name LIKE ${`${SLOT_PREFIX}%`} AND CAST(value AS INTEGER) > ${now}) < ${max}
+				ON CONFLICT(name) DO UPDATE SET value = excluded.value`.execute(db),
+		);
+		if (Number(r.numAffectedRows ?? 0) > 0) return true;
+		if (Date.now() >= deadline) return false;
+		await sleep(500);
+	}
+}
+
+export async function releaseSlot(slug: string): Promise<void> {
+	const db = controlDb();
+	await runAsSite(scopeState().primary, () => sql`DELETE FROM options WHERE name = ${SLOT_PREFIX + slug}`.execute(db));
+}

package/src/storage.ts

@@ -0,0 +1,57 @@
+/**
+ * Runtime storage entrypoint: one shared R2 bucket, one key prefix per site.
+ *
+ * Core caches ONE storage instance for the whole Worker, so the site is read on
+ * every call (from `runAsSite`, set by the middleware), not when the instance is
+ * built. Keys stored in a site's `media` table stay unprefixed; the prefix is
+ * added here and removed from listings, so a site can only ever name its own
+ * objects, whatever key a request carries.
+ *
+ * Host config:
+ *   storage: { ...r2({ binding: "MEDIA" }), entrypoint: "emdash-multisite/storage" }
+ */
+import { sql } from "kysely";
+import { createStorage as createR2 } from "@emdash-cms/cloudflare/storage/r2";
+import { EmDashStorageError, type Storage } from "emdash";
+import { currentSite } from "./dialect.ts";
+import { sitesConfig } from "./config.ts";
+import { controlDb } from "./registry.ts";
+import { mediaKey, unmediaKey } from "./rules.ts";
+import { scopeState } from "./scope.ts";
+
+const site = (): string => currentSite() ?? scopeState().primary;
+
+/** Throws when the active site is at or over `limits.mediaBytesPerSite`. */
+async function assertQuota(): Promise<void> {
+	const cap = sitesConfig()?.limits?.mediaBytesPerSite;
+	if (cap === undefined) return;
+	const r = await sql<{ used: number | null }>`SELECT SUM(size) AS used FROM media`.execute(controlDb());
+	// ponytail: checked before the upload, so one file can overshoot the cap. Upgrade path: pass the size in.
+	if ((r.rows[0]?.used ?? 0) >= cap) throw new EmDashStorageError("Media storage limit reached for this site", "QUOTA_EXCEEDED");
+}
+
+export function createStorage(config: Record<string, unknown>): Storage {
+	const inner = createR2(config);
+	const publicUrl = typeof config.publicUrl === "string";
+	const getPublicUrl = (key: string) => inner.getPublicUrl(publicUrl ? mediaKey(site(), key) : key);
+	return {
+		async upload(o) {
+			await assertQuota();
+			const r = await inner.upload({ ...o, key: mediaKey(site(), o.key) });
+			return { ...r, key: o.key, url: getPublicUrl(o.key) };
+		},
+		// ponytail: `o` (byte range) exists in current core only; `any` keeps older typings compiling.
+		download: (key: string, o?: any) => (inner.download as any)(mediaKey(site(), key), o),
+		delete: (key) => inner.delete(mediaKey(site(), key)),
+		exists: (key) => inner.exists(mediaKey(site(), key)),
+		async list(o: { prefix?: string; limit?: number; cursor?: string } = {}) {
+			const s = site();
+			const r = await inner.list({ ...o, prefix: mediaKey(s, o.prefix ?? "") });
+			return { ...r, files: r.files.flatMap((f) => { const k = unmediaKey(s, f.key); return k === null ? [] : [{ ...f, key: k }]; }) };
+		},
+		getSignedUploadUrl: (o) => inner.getSignedUploadUrl(o),
+		// Served through the host (`/_emdash/api/media/file/<key>`), which the site's own request already scopes.
+		// A configured CDN `publicUrl` has no such scoping, so its URLs carry the prefix.
+		getPublicUrl,
+	};
+}