excalidrop 0.2.6 → 0.2.8

package/worker/src/relay.js

@@ -0,0 +1,130 @@
+// One instance per repo. Verifies the caller's GitHub token per request (cached
+// ~60s by hash); holds viewer sockets + pending rpc ≤30s. Nothing is persisted.
+
+const AUTH_CACHE_MS = 60_000;
+const AUTH_CACHE_PULL_MS = 600_000;
+const RPC_TIMEOUT_MS = 30_000;
+const MAX_BODY_BYTES = 10 * 1024 * 1024;
+const authCache = new Map();
+
+function hashToken(t) {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < t.length; i++) { h ^= t.charCodeAt(i); h = Math.imul(h, 0x01000193); }
+  return (h >>> 0).toString(36);
+}
+
+const rate = new Map();
+function rateOk(key, limit, windowMs) {
+  const now = Date.now();
+  const cur = rate.get(key);
+  if (!cur || now > cur.reset) { rate.set(key, { count: 1, reset: now + windowMs }); return true; }
+  cur.count += 1;
+  return cur.count <= limit;
+}
+
+async function verifyRepoAccess(token, repo, needPush) {
+  const key = `${hashToken(token)}:${repo}`;
+  const cached = authCache.get(key);
+  if (cached) {
+    const ttl = cached.push ? AUTH_CACHE_MS : AUTH_CACHE_PULL_MS;
+    if (Date.now() - cached.at < ttl) {
+      if (needPush && !cached.push) return { ok: false, status: 403 };
+      if (!cached.pull) return { ok: false, status: 403 };
+      return { ok: true, login: cached.login };
+    }
+  }
+  const headers = { Authorization: `Bearer ${token}`, Accept: 'application/vnd.github+json', 'User-Agent': 'excalidrop-relay' };
+  const r = await fetch(`https://api.github.com/repos/${repo}`, { headers }).catch(() => null);
+  if (!r || r.status === 404) return { ok: false, status: 404 };
+  if (r.status === 401) return { ok: false, status: 403 };
+  if (!r.ok) return { ok: false, status: 403 };
+  const j = await r.json().catch(() => ({}));
+  const pull = !!(j.permissions?.pull ?? true);
+  const push = !!j.permissions?.push;
+  if (!pull || (needPush && !push)) return { ok: false, status: 403 };
+  const me = await fetch('https://api.github.com/user', { headers }).then((x) => x.json()).catch(() => ({}));
+  authCache.set(key, { at: Date.now(), login: me.login || '?', pull, push });
+  return { ok: true, login: me.login || '?' };
+}
+
+export class RelayRoom {
+  constructor(state, env) {
+    this.state = state;
+    this.env = env;
+    this.viewers = new Set();
+    this.pending = new Map(); // reqId -> { resolve, timer }
+  }
+
+  async fetch(req) {
+    const url = new URL(req.url);
+    const repo = url.searchParams.get('repo') || '';
+    if (!/^[a-z0-9_.-]+\/[a-z0-9_.-]+$/i.test(repo)) {
+      return new Response(JSON.stringify({ error: 'bad repo' }), { status: 400 });
+    }
+    const ip = req.headers.get('cf-connecting-ip') || 'unknown';
+
+    if (req.headers.get('Upgrade') === 'websocket') {
+      if (!rateOk(`ws:${ip}`, 20, 60_000)) return new Response('rate limited', { status: 429 });
+      const pair = new WebSocketPair();
+      const [client, server] = Object.values(pair);
+      this.handleViewer(server, repo);
+      return new Response(null, { status: 101, webSocket: client });
+    }
+
+    const noStore = { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' };
+    if (req.method === 'POST') {
+      const token = (req.headers.get('Authorization') || '').replace(/^Bearer\s+/i, '');
+      if (!token) return new Response(JSON.stringify({ error: 'missing bearer' }), { status: 401, headers: noStore });
+      if (!rateOk(`rpc:${hashToken(token)}`, 30, 60_000) || !rateOk(`rpcip:${ip}`, 60, 60_000)) {
+        return new Response(JSON.stringify({ error: 'rate limited' }), { status: 429, headers: noStore });
+      }
+      const len = Number(req.headers.get('content-length') || 0);
+      if (len > MAX_BODY_BYTES) return new Response(JSON.stringify({ error: 'too large' }), { status: 413, headers: noStore });
+      let body;
+      try { body = await req.json(); } catch { return new Response(JSON.stringify({ error: 'bad json' }), { status: 400, headers: noStore }); }
+      const method = body.method || url.pathname.split('/').pop();
+      const needPush = method !== 'screenshot' && method !== 'viewport' && method !== 'export' && method !== 'describe';
+      const v = await verifyRepoAccess(token, repo, needPush);
+      const noStore = { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' };
+      if (!v.ok) return new Response(JSON.stringify({ error: v.status === 404 ? 'repo not found' : 'no access to this repo with this token' }), { status: v.status, headers: noStore });
+      if (this.viewers.size === 0) return new Response(JSON.stringify({ error: 'no viewer connected — open the canvas URL in a browser first' }), { status: 503, headers: noStore });
+      const reqId = body.reqId || `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+      const msg = JSON.stringify({ type: 'relay_rpc', reqId, method, args: body.args || {} });
+      const result = await new Promise((resolve) => {
+        const timer = setTimeout(() => { this.pending.delete(reqId); resolve({ error: 'viewer timed out' }); }, RPC_TIMEOUT_MS);
+        this.pending.set(reqId, { resolve, timer });
+        for (const ws of this.viewers) { try { ws.send(msg); } catch { /* drop */ } }
+      });
+      if (result?.error) return new Response(JSON.stringify(result), { status: 504, headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' } });
+      return new Response(JSON.stringify(result), { headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' } });
+    }
+
+    return new Response(JSON.stringify({ repo, viewers: this.viewers.size }), { headers: { 'Content-Type': 'application/json' } });
+  }
+
+  handleViewer(ws, repo) {
+    ws.accept();
+    let authed = false;
+    ws.addEventListener('message', async (ev) => {
+      let msg;
+      try { msg = JSON.parse(ev.data); } catch { return; }
+      if (msg?.type === 'ping') { try { ws.send(JSON.stringify({ type: 'pong' })); } catch {} return; }
+      if (!authed) {
+        const v = msg?.token ? await verifyRepoAccess(msg.token, repo, false) : { ok: false };
+        if (!v.ok) { try { ws.send(JSON.stringify({ error: 'auth failed' })); } catch {} ws.close(4403, 'auth'); return; }
+        authed = true;
+        this.viewers.add(ws);
+        try { ws.send(JSON.stringify({ type: 'relay_ready', repo })); } catch {}
+        return;
+      }
+      if (msg?.reqId && this.pending.has(msg.reqId)) {
+        const p = this.pending.get(msg.reqId);
+        this.pending.delete(msg.reqId);
+        clearTimeout(p.timer);
+        p.resolve(msg.ok === false ? { error: msg.error || 'viewer error' } : (msg.data ?? msg.result ?? { ok: true }));
+      }
+    });
+    ws.addEventListener('close', () => { this.viewers.delete(ws); });
+    ws.addEventListener('error', () => { this.viewers.delete(ws); });
+  }
+}

package/worker/wrangler.toml

@@ -0,0 +1,20 @@
+name = "excalidrop"
+main = "src/index.js"
+compatibility_date = "2024-01-01"
+
+# OAuth App client id (public). The secret goes via:
+#   wrangler secret put GITHUB_CLIENT_SECRET
+[vars]
+GITHUB_CLIENT_ID = "Iv23liuS2fx3QOEIoDmx"
+# Comma-separated allowed canvas origins: exact ("https://wtf403.github.io")
+# or "*.github.io"-style suffixes so one deployment serves every publisher.
+# Add "*.pages.dev" + your custom domain when hosting private viewers on Cloudflare.
+ALLOWED_REDIRECT_ORIGINS = "*.github.io,*.pages.dev"
+
+[[durable_objects.bindings]]
+name = "RELAY"
+class_name = "RelayRoom"
+
+[[migrations]]
+tag = "v1"
+new_sqlite_classes = ["RelayRoom"]

package/dist/frontend/assets/channel-FdQr2Y2u.js

@@ -1 +0,0 @@
-import{U as a,E as n}from"./index-DPE4WCka.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/dist/frontend/assets/clone-Bww_2hMC.js

@@ -1 +0,0 @@
-import{b as r}from"./union-BOPJv_NW.js";var e=4;function a(o){return r(o,e)}export{a as c};

package/dist/frontend/assets/flowDiagram-v2-96b9c2cf-BrPX1C0T.js

@@ -1 +0,0 @@
-import{f as o,p as e}from"./flowDb-956e92f1-BT3sVrS_.js";import{f as a,a as t}from"./styles-c10674c1-CsoDZQ7K.js";import{t as i}from"./index-DMNFnJz0.js";import"./index-DPE4WCka.js";import"./graph-DZoF-TB0.js";import"./layout-DNILJXpj.js";import"./index-3862675e-DkeMPq9X.js";import"./union-BOPJv_NW.js";import"./clone-Bww_2hMC.js";import"./zipObject-BXMcibol.js";import"./edges-e0da2a9e-pqeZxZR9.js";import"./createText-2e5e7dd3-hFM4xCnY.js";import"./index-DGmpr33w.js";import"./line-DHiJikCQ.js";import"./array-BKyUJesY.js";import"./path-CbwjOpE9.js";import"./channel-FdQr2Y2u.js";import"./selectAll-DOPd5EPW.js";const x={parser:e,db:o,renderer:t,styles:a,init:r=>{r.flowchart||(r.flowchart={}),r.flowchart.arrowMarkerAbsolute=r.arrowMarkerAbsolute,i({flowchart:{arrowMarkerAbsolute:r.arrowMarkerAbsolute}}),t.setConf(r.flowchart),o.clear(),o.setGen("gen-2")}};export{x as diagram};

package/dist/frontend/assets/flowDiagram-v2-ffc7f31a-DcmJmCpH.js

@@ -1 +0,0 @@
-import{f as o,p as e}from"./flowDb-7c981674-hAdbykWR.js";import{f as a,a as t}from"./styles-2ab5d517-CD2K6uvC.js";import{K as i}from"./index-DPE4WCka.js";import"./graph-DPklf_4J.js";import"./layout-BC6d-Wwh.js";import"./index-6079d271-GJeDwDgK.js";import"./union-BOPJv_NW.js";import"./clone-Bww_2hMC.js";import"./zipObject-BXMcibol.js";import"./edges-332bd1c7-CV1_ozEk.js";import"./createText-d213de94-BcC2siap.js";import"./index-DGmpr33w.js";import"./line-DHiJikCQ.js";import"./array-BKyUJesY.js";import"./path-CbwjOpE9.js";import"./channel-FdQr2Y2u.js";import"./selectAll-DOPd5EPW.js";const C={parser:e,db:o,renderer:t,styles:a,init:r=>{r.flowchart||(r.flowchart={}),r.flowchart.arrowMarkerAbsolute=r.arrowMarkerAbsolute,i({flowchart:{arrowMarkerAbsolute:r.arrowMarkerAbsolute}}),t.setConf(r.flowchart),o.clear(),o.setGen("gen-2")}};export{C as diagram};