emdash-multisite 0.0.0-stage → 0.8.0

package/src/handoff.ts

@@ -0,0 +1,58 @@
+/**
+ * Signed one-time handoff from the control plane to a tenant site.
+ *
+ * Cookies are per host, so a user signed in on the control plane is a stranger
+ * on `acme.example.com`. "Open admin" therefore goes through a short-lived link
+ * the control plane signs for (user, site); the tenant checks it and starts the
+ * user's session there. Pure crypto only, so it runs under plain Node for the
+ * self-check; storage of the secret and of used nonces lives in registry.ts.
+ */
+const enc = new TextEncoder();
+
+export interface HandoffClaims {
+	/** The user's id (the same id on the control plane and in the tenant copy). */
+	uid: string;
+	/** The tenant site the link is for. */
+	site: string;
+	/** Expiry, ms since epoch. */
+	exp: number;
+	/** Random id, accepted once. */
+	nonce: string;
+}
+
+/** A signed link lives this long. It only has to survive one redirect. */
+export const HANDOFF_TTL_MS = 60_000;
+
+const b64url = (bytes: Uint8Array): string => btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+const fromB64url = (s: string): Uint8Array<ArrayBuffer> => Uint8Array.from(atob(s.replaceAll("-", "+").replaceAll("_", "/")), (c) => c.charCodeAt(0));
+
+async function hmac(secret: string): Promise<CryptoKey> {
+	return crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+}
+
+export async function signHandoff(secret: string, claims: Omit<HandoffClaims, "nonce" | "exp">, now = Date.now()): Promise<string> {
+	const full: HandoffClaims = { ...claims, exp: now + HANDOFF_TTL_MS, nonce: b64url(crypto.getRandomValues(new Uint8Array(16))) };
+	const body = b64url(enc.encode(JSON.stringify(full)));
+	const sig = new Uint8Array(await crypto.subtle.sign("HMAC", await hmac(secret), enc.encode(body)));
+	return `${body}.${b64url(sig)}`;
+}
+
+/** The claims if the token is genuine, unexpired and for `site`; otherwise null. */
+export async function verifyHandoff(secret: string, token: string, site: string, now = Date.now()): Promise<HandoffClaims | null> {
+	const [body, sig, extra] = token.split(".");
+	if (!body || !sig || extra !== undefined) return null;
+	try {
+		const ok = await crypto.subtle.verify("HMAC", await hmac(secret), fromB64url(sig), enc.encode(body));
+		if (!ok) return null;
+		const claims = JSON.parse(new TextDecoder().decode(fromB64url(body))) as Partial<HandoffClaims>;
+		if (typeof claims.uid !== "string" || typeof claims.nonce !== "string" || typeof claims.exp !== "number") return null;
+		if (claims.site !== site || claims.exp < now) return null;
+		return claims as HandoffClaims;
+	} catch {
+		return null;
+	}
+}
+
+/** Where a handoff may land: an admin path on the tenant only, never another host. */
+export const safeNext = (v: string | null): string =>
+	v && /^\/_emdash\/[\w\-./?=&%]*$/.test(v) && !v.includes("//") && !v.includes("..") ? v : "/_emdash/admin";

package/src/index.ts

@@ -0,0 +1,35 @@
+import type { DatabaseDescriptor } from "emdash/db";
+import { assertSitesConfig, type SitesConfig } from "./sites.ts";
+
+export { runAsSite } from "./dialect.ts";
+export { multisitePlugin } from "./plugin.ts";
+export { resolveSite, type SitesConfig } from "./sites.ts";
+
+/** Inner adapter entrypoint -> our wrapping entrypoint. */
+const WRAPPERS: Record<string, string> = {
+	"emdash/db/sqlite": "emdash-multisite/db/sqlite",
+	"@emdash-cms/cloudflare/db/d1": "emdash-multisite/db/d1",
+};
+
+/**
+ * Wrap a database descriptor so one database serves many sites.
+ *
+ * ```ts
+ * emdash({ database: withSites(d1({ binding: "DB" }), { primary: "main", wildcard: "example.com" }) })
+ * ```
+ */
+export function withSites(inner: DatabaseDescriptor, sites: SitesConfig): DatabaseDescriptor {
+	assertSitesConfig(sites);
+	const entrypoint = WRAPPERS[inner.entrypoint];
+	if (!entrypoint) {
+		throw new Error(`[multisite] unsupported database adapter: ${inner.entrypoint}`);
+	}
+	return {
+		entrypoint,
+		config: { inner: inner.config, sites },
+		type: inner.type,
+		supportsRequestScope: true,
+		// Omitted on purpose: `migrations` (deploy-time runner and coalescing and
+		// the collection-deletion guard address one site's tables only).
+	};
+}

package/src/log.ts

@@ -0,0 +1,6 @@
+/**
+ * One JSON line per notable event, so Workers Logs (set `"observability": { "enabled": true }` in wrangler.jsonc)
+ * can filter and count them: `event = "site.ready"`, `event = "signup.rate_limited"`, ...
+ * Never log secrets, passwords, tokens or full email addresses.
+ */
+export const log = (event: string, fields: Record<string, unknown> = {}): void => console.log(JSON.stringify({ app: "multisite", event, ...fields }));

package/src/media-bucket.ts

@@ -0,0 +1,44 @@
+/**
+ * The media R2 bucket as a raw binding, for work outside a request's storage wrapper:
+ * deleting a site's files on purge, and keeping site backups. Shared code, so it reaches the
+ * binding through `platformEnv()` (no static `cloudflare:workers` import).
+ */
+// @ts-ignore - virtual module provided by EmDash's integration
+import emdashConfig from "virtual:emdash/config";
+import { platformEnv } from "./platform-env.ts";
+import { backupPrefix, mediaKey } from "./rules.ts";
+
+export interface Bucket {
+	list(o: object): Promise<{ objects: { key: string }[]; truncated: boolean; cursor?: string }>;
+	delete(keys: string | string[]): Promise<void>;
+	put(key: string, value: string): Promise<unknown>;
+	get(key: string): Promise<{ text(): Promise<string> } | null>;
+}
+
+/** The bucket named by the host's `storage` config, or undefined (no R2, or not on Workers). */
+export async function mediaBucket(): Promise<Bucket | undefined> {
+	const binding = (emdashConfig as { storage?: { config?: { binding?: string } } }).storage?.config?.binding;
+	return binding ? ((await platformEnv())?.[binding] as Bucket | undefined) : undefined;
+}
+
+/** Delete every object under a prefix. Returns how many were removed. */
+async function deletePrefix(bucket: Bucket, prefix: string): Promise<number> {
+	let n = 0, cursor: string | undefined;
+	do {
+		const page = await bucket.list({ prefix, cursor, limit: 1000 });
+		if (page.objects.length) await bucket.delete(page.objects.map((o) => o.key));
+		n += page.objects.length;
+		cursor = page.truncated ? page.cursor : undefined;
+	} while (cursor);
+	return n;
+}
+
+/**
+ * Delete a site's uploaded files and its backups (used on purge: a deleted customer's data must not
+ * outlive the grace period). Returns the number removed; 0 when no R2 storage is configured.
+ */
+export async function purgeSiteMedia(slug: string): Promise<number> {
+	const bucket = await mediaBucket();
+	if (!bucket) return 0;
+	return (await deletePrefix(bucket, mediaKey(slug, ""))) + (await deletePrefix(bucket, backupPrefix(slug)));
+}