feedkeeper 0.0.0-stage → 0.23.0

package/server/dist/api/v1/serialize.js

@@ -0,0 +1,48 @@
+import { contentMetadata } from "../../feeds/articleContent.js";
+import { db } from "../../db/index.js";
+import { serializeSubscription } from "../../sync/changeLog.js";
+/** A subscription as the list shows it: the synced fields plus counts and polling health. */
+export function serializeSubscriptionDetail(subscription) {
+    return {
+        ...serializeSubscription(subscription),
+        folderName: subscription.folder_name,
+        unreadCount: subscription.unread_count,
+        lastPolledAt: subscription.last_polled_at,
+        lastSuccessAt: subscription.last_success_at,
+        lastError: subscription.last_error,
+        consecutiveErrors: subscription.consecutive_errors,
+    };
+}
+export function readingPositions(userId, itemIds) {
+    if (itemIds.length === 0)
+        return new Map();
+    const rows = db
+        .prepare(`SELECT item_id, position FROM item_progress WHERE user_id = ? AND item_id IN (${itemIds.map(() => "?").join(",")})`)
+        .all(userId, ...itemIds);
+    return new Map(rows.map((row) => [row.item_id, row.position]));
+}
+export function serializeItem(row, progress, withContent, hasNote = false) {
+    return {
+        id: row.id,
+        subscriptionId: row.feed_id,
+        subscriptionTitle: row.feed_title,
+        title: row.title,
+        url: row.link,
+        publishedAt: row.published_at,
+        addedAt: row.created_at,
+        snippet: row.content_snippet,
+        imageUrl: row.image_url,
+        hasFullText: Boolean(row.full_content_html),
+        content: contentMetadata(row),
+        ...(withContent ? { contentHtml: row.content_html, fullTextHtml: row.full_content_html } : {}),
+        state: {
+            read: Boolean(row.read),
+            saved: Boolean(row.bookmarked),
+            savedAt: row.bookmarked_at ?? null,
+            archivedAt: row.archived_at ?? null,
+            progress: progress.get(row.id) ?? null,
+            hasNote,
+        },
+    };
+}
+//# sourceMappingURL=serialize.js.map

package/server/dist/app.js

@@ -0,0 +1,100 @@
+import { dirname, join, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { existsSync } from "node:fs";
+import express from "express";
+import helmet from "helmet";
+import cors from "cors";
+import cookieSession from "cookie-session";
+import rateLimit from "express-rate-limit";
+import { config } from "./config.js";
+import { runMigrations } from "./db/index.js";
+import { apiRouter } from "./api/index.js";
+import { mcpRouter } from "./mcp/http.js";
+import { startPollingScheduler } from "./feeds/poller.js";
+import { startCleanupScheduler } from "./feeds/cleanup.js";
+import { repairEncodedText } from "./feeds/repository.js";
+import { pruneArchive, scheduleMissingArchives } from "./feeds/archive.js";
+import { startEditionScheduler } from "./native/editions.js";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+export const DEFAULT_WEB_DIST = join(__dirname, "../../web/dist");
+export function startCoreSchedulers() {
+    runMigrations();
+    const repairedItems = repairEncodedText();
+    if (repairedItems > 0)
+        console.log(`[db] decoded HTML entities in ${repairedItems} stored items`);
+    pruneArchive();
+    const pendingArchives = scheduleMissingArchives();
+    if (pendingArchives > 0)
+        console.log(`[archive] archiving ${pendingArchives} saved articles in the background`);
+    startPollingScheduler();
+    startCleanupScheduler();
+    startEditionScheduler();
+}
+export function createApp(options = {}) {
+    const app = express();
+    if (config.trustProxy) {
+        app.set("trust proxy", 1);
+    }
+    app.use(helmet({
+        contentSecurityPolicy: {
+            directives: {
+                ...helmet.contentSecurityPolicy.getDefaultDirectives(),
+                "script-src": ["'self'"],
+                "img-src": ["'self'", "data:", "https:", "http:"],
+            },
+        },
+    }));
+    // Send X-Robots-Tag to ensure all HTTP endpoints disallow indexing even outside HTML
+    app.use((_req, res, next) => {
+        res.setHeader("X-Robots-Tag", "noindex, nofollow");
+        next();
+    });
+    app.use(cors({
+        origin: config.publicUrl,
+        credentials: true,
+    }));
+    app.use(express.json({ limit: "1mb" }));
+    app.use(express.text({ type: ["application/xml", "text/xml", "text/plain"], limit: "5mb" }));
+    app.use(cookieSession({
+        name: "feedkeeper.sid",
+        secret: config.sessionSecret,
+        maxAge: 30 * 24 * 60 * 60 * 1000,
+        httpOnly: true,
+        sameSite: "lax",
+        secure: config.publicUrl.startsWith("https://"),
+    }));
+    // Generic API rate limit as defense in depth on top of the stricter
+    // per-route limiter on /api/auth/login.
+    app.use("/api", rateLimit({
+        windowMs: 60 * 1000,
+        limit: 120,
+        standardHeaders: true,
+        legacyHeaders: false,
+        // Lists load many article images and feed icons at once; those routes have their own, higher limit.
+        skip: (req) => /^\/(v1\/)?(items\/\d+\/image|feeds\/\d+\/icon|subscriptions\/\d+\/icon|archive\/images\/\d+)$/.test(req.path),
+    }));
+    app.use("/api", apiRouter);
+    app.use("/mcp", mcpRouter);
+    if (options.configure) {
+        options.configure(app);
+    }
+    const webDist = options.webDist === undefined ? DEFAULT_WEB_DIST : options.webDist;
+    if (webDist && existsSync(webDist)) {
+        app.use(express.static(webDist, {
+            setHeaders(res, filePath) {
+                // Hashed build files never change; the service worker must always be re-checked.
+                if (filePath.includes(`${sep}assets${sep}`))
+                    res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+                if (filePath.endsWith(`${sep}sw.js`))
+                    res.setHeader("Cache-Control", "no-cache");
+            },
+        }));
+        app.get(/(.*)/, (req, res, next) => {
+            if (req.path.startsWith("/api") || req.path.startsWith("/mcp") || req.path.startsWith("/cloud"))
+                return next();
+            res.sendFile(join(webDist, "index.html"));
+        });
+    }
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/server/dist/auth/avatar.js

@@ -0,0 +1,13 @@
+export const AVATAR_MAX_BYTES = 512 * 1024;
+/** Identify an uploaded image by its signature instead of trusting the declared type. */
+export function detectAvatarType(data) {
+    if (data.length >= 3 && data[0] === 0xff && data[1] === 0xd8 && data[2] === 0xff)
+        return "image/jpeg";
+    if (data.length >= 8 && [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a].every((byte, index) => data[index] === byte))
+        return "image/png";
+    const ascii = (start, end) => String.fromCharCode(...data.subarray(start, end));
+    if (data.length >= 12 && ascii(0, 4) === "RIFF" && ascii(8, 12) === "WEBP")
+        return "image/webp";
+    return null;
+}
+//# sourceMappingURL=avatar.js.map

package/server/dist/auth/capabilities.js

@@ -0,0 +1,53 @@
+class DefaultCapabilitiesProvider {
+    getCapabilitiesForUser(_userId) {
+        return {
+            type: "selfhosted",
+            features: {
+                mcp: true,
+                sync: true,
+                notes: true,
+                editions: true,
+                fulltext: true,
+                "search.fts": true,
+                inbox: true,
+            },
+            manageUrl: null,
+        };
+    }
+}
+let activeCapabilitiesProvider = new DefaultCapabilitiesProvider();
+export function setCapabilitiesProvider(provider) {
+    activeCapabilitiesProvider = provider;
+}
+export function getCapabilitiesProvider() {
+    return activeCapabilitiesProvider;
+}
+export function getUserCapabilities(userId) {
+    return activeCapabilitiesProvider.getCapabilitiesForUser(userId);
+}
+/** The advertised feature map is also the authority for enforcement. Missing keys deny access. */
+export function hasUserCapability(userId, capability) {
+    return getUserCapabilities(userId).features[capability] === true;
+}
+export function capabilityDenial(userId, capability) {
+    return {
+        error: "capability_not_available",
+        capability,
+        manageUrl: getUserCapabilities(userId).manageUrl ?? null,
+    };
+}
+export function requireCapability(capability) {
+    return (req, res, next) => {
+        const userId = req.user?.id;
+        if (!userId) {
+            res.status(401).json({ error: "not_authenticated" });
+            return;
+        }
+        if (!hasUserCapability(userId, capability)) {
+            res.status(403).json(capabilityDenial(userId, capability));
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=capabilities.js.map

package/server/dist/auth/middleware.js

@@ -0,0 +1,77 @@
+import { resolveToken } from "./tokens.js";
+import { findUserById, toPublicUser } from "./users.js";
+import { sessionIsSecure } from "./security.js";
+import { RESOURCE_METADATA_URL } from "../oauth/constants.js";
+// Web UI auth: cookie session set at login.
+export function requireSession(req, res, next) {
+    const userId = req.session?.userId;
+    if (!userId || !sessionIsSecure(req, userId)) {
+        res.status(401).json({ error: "not_authenticated" });
+        return;
+    }
+    const user = findUserById(userId);
+    if (!user) {
+        res.status(401).json({ error: "not_authenticated" });
+        return;
+    }
+    req.user = toPublicUser(user);
+    next();
+}
+function bearerToken(req) {
+    const header = req.headers.authorization;
+    return header?.startsWith("Bearer ") ? header.slice("Bearer ".length) : undefined;
+}
+// MCP auth: Bearer personal access token or OAuth access token (not a paired device), scopes the request to its owner.
+export function requireBearerToken(req, res, next) {
+    authenticateBearer(["api", "oauth"], RESOURCE_METADATA_URL)(req, res, next);
+}
+// Native app API: a paired device token or a hand-made token; the web UI may call it with its session.
+export function requireSessionOrDevice(req, res, next) {
+    if (bearerToken(req))
+        authenticateBearer(["api", "device"])(req, res, next);
+    else
+        requireSession(req, res, next);
+}
+/** `resourceMetadata` adds the RFC 9728 challenge that tells OAuth clients where to sign in. */
+export function authenticateBearer(kinds, resourceMetadata) {
+    return (req, res, next) => {
+        bearerAuth(req, res, next, kinds, resourceMetadata);
+    };
+}
+function bearerAuth(req, res, next, kinds, resourceMetadata) {
+    const reject = (error) => {
+        if (resourceMetadata) {
+            const detail = error === "invalid_token" ? `error="invalid_token", ` : "";
+            res.setHeader("WWW-Authenticate", `Bearer ${detail}resource_metadata="${resourceMetadata}"`);
+        }
+        res.status(401).json({ error });
+    };
+    const token = bearerToken(req);
+    if (!token) {
+        reject("missing_token");
+        return;
+    }
+    const resolved = resolveToken(token);
+    if (!resolved || !kinds.includes(resolved.kind)) {
+        reject("invalid_token");
+        return;
+    }
+    const user = findUserById(resolved.userId);
+    if (!user) {
+        reject("invalid_token");
+        return;
+    }
+    req.user = toPublicUser(user);
+    req.tokenScope = resolved.scope;
+    req.tokenId = resolved.tokenId;
+    req.tokenKind = resolved.kind;
+    next();
+}
+export function requireAdmin(req, res, next) {
+    if (req.user?.role !== "admin") {
+        res.status(403).json({ error: "forbidden" });
+        return;
+    }
+    next();
+}
+//# sourceMappingURL=middleware.js.map

package/server/dist/auth/pairing.js

@@ -0,0 +1,36 @@
+import { createHash, randomBytes } from "node:crypto";
+import { db } from "../db/index.js";
+import { createPersonalAccessToken } from "./tokens.js";
+const CODE_TTL_MS = 10 * 60 * 1000;
+// Without 0, O, 1, I and L, so a code can be read out or typed by hand.
+const ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
+const CODE_LENGTH = 12;
+function normalize(code) {
+    return code.toUpperCase().replace(/[^A-Z0-9]/g, "");
+}
+function hashCode(code) {
+    return createHash("sha256").update(normalize(code)).digest("hex");
+}
+/** A fresh single-use code for the user (about 60 bits); it replaces any code they still had. */
+export function createPairingCode(userId) {
+    const bytes = randomBytes(CODE_LENGTH);
+    const raw = Array.from(bytes, (byte) => ALPHABET[byte % ALPHABET.length]).join("");
+    const code = raw.match(/.{4}/g).join("-");
+    const expiresAt = new Date(Date.now() + CODE_TTL_MS).toISOString();
+    db.prepare(`INSERT INTO pairing_codes (user_id, code_hash, expires_at) VALUES (?, ?, ?)
+     ON CONFLICT(user_id) DO UPDATE SET code_hash = excluded.code_hash, expires_at = excluded.expires_at, created_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`).run(userId, hashCode(code), expiresAt);
+    return { code, expiresAt };
+}
+/** Exchange a valid code for a device token. A code works once; expired and unknown codes give null. */
+export function redeemPairingCode(code, device) {
+    return db.transaction(() => {
+        db.prepare("DELETE FROM pairing_codes WHERE expires_at <= ?").run(new Date().toISOString());
+        const row = db.prepare("SELECT user_id FROM pairing_codes WHERE code_hash = ?").get(hashCode(code));
+        if (!row)
+            return null;
+        db.prepare("DELETE FROM pairing_codes WHERE user_id = ?").run(row.user_id);
+        const { id, token } = createPersonalAccessToken(row.user_id, device.name, "write", { platform: device.platform, appVersion: device.appVersion });
+        return { userId: row.user_id, deviceId: id, token };
+    })();
+}
+//# sourceMappingURL=pairing.js.map

package/server/dist/auth/password.js

@@ -0,0 +1,9 @@
+import bcrypt from "bcryptjs";
+const SALT_ROUNDS = process.env.NODE_ENV === "test" ? 4 : 12;
+export function hashPassword(plain) {
+    return bcrypt.hashSync(plain, SALT_ROUNDS);
+}
+export function verifyPassword(plain, hash) {
+    return bcrypt.compareSync(plain, hash);
+}
+//# sourceMappingURL=password.js.map

package/server/dist/auth/plan.js

@@ -0,0 +1,58 @@
+const DEFAULT_SELFHOSTED_FEATURES = [
+    "sync",
+    "notes",
+    "edition",
+    "edition.automatic",
+    "edition.revisions",
+    "native-preferences",
+    "search.fts",
+    "mcp.remote",
+    "feed-icons",
+    "folder-icons",
+    "fulltext",
+];
+class DefaultPlanProvider {
+    getPlanForUser(_userId) {
+        return {
+            tier: "selfhosted",
+            status: "active",
+            features: DEFAULT_SELFHOSTED_FEATURES,
+            manageUrl: null,
+        };
+    }
+    hasFeature(_userId, _feature) {
+        // In self-hosted mode, all features are permitted
+        return true;
+    }
+}
+let activePlanProvider = new DefaultPlanProvider();
+export function setPlanProvider(provider) {
+    activePlanProvider = provider;
+}
+export function getPlanProvider() {
+    return activePlanProvider;
+}
+export function getUserPlan(userId) {
+    return activePlanProvider.getPlanForUser(userId);
+}
+export function requirePlanFeature(feature) {
+    return (req, res, next) => {
+        const userId = req.user?.id;
+        if (!userId) {
+            res.status(401).json({ error: "not_authenticated" });
+            return;
+        }
+        if (!activePlanProvider.hasFeature(userId, feature)) {
+            const plan = activePlanProvider.getPlanForUser(userId);
+            res.status(403).json({
+                error: "feature_not_included",
+                feature,
+                tier: plan.tier,
+                manageUrl: plan.manageUrl ?? null,
+            });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=plan.js.map

package/server/dist/auth/security.js

@@ -0,0 +1,117 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { TOTP, Secret } from "otpauth";
+import { db } from "../db/index.js";
+import { config } from "../config.js";
+export const opaque = () => randomBytes(32).toString("base64url");
+const hash = (text) => createHash("sha256").update(text).digest("hex");
+const encryptionKey = () => createHash("sha256").update(`feedkeeper-totp:${config.sessionSecret}`).digest();
+export function seal(text) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", encryptionKey(), iv);
+    const ciphertext = Buffer.concat([cipher.update(text, "utf8"), cipher.final()]);
+    return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString("base64url");
+}
+function unseal(text) {
+    const data = Buffer.from(text, "base64url");
+    const decipher = createDecipheriv("aes-256-gcm", encryptionKey(), data.subarray(0, 12));
+    decipher.setAuthTag(data.subarray(12, 28));
+    return Buffer.concat([decipher.update(data.subarray(28)), decipher.final()]).toString("utf8");
+}
+export function securityAccount(userId) {
+    db.prepare("INSERT OR IGNORE INTO account_security (user_id, user_handle) VALUES (?, ?)").run(userId, opaque());
+    return db.prepare("SELECT * FROM account_security WHERE user_id = ?").get(userId);
+}
+export function securityVersion(userId) {
+    return db.prepare("SELECT version FROM account_security WHERE user_id = ?").get(userId)?.version ?? 0;
+}
+export function sessionIsSecure(req, userId) {
+    return (req.session?.securityVersion ?? 0) === securityVersion(userId);
+}
+export function hasTotp(userId) { return Boolean(securityAccount(userId).totp_secret); }
+export function securityBinding(req, channel) {
+    if (channel === "native-login")
+        return channel;
+    if (req.headers.authorization)
+        return hash(`${channel}:${req.headers.authorization}`);
+    req.session ??= {};
+    req.session.securityBinding ??= opaque();
+    return hash(`${channel}:${req.session.securityBinding}`);
+}
+export function issueSecurityChallenge(purpose, userId, binding, payload, ttl = 5 * 60_000) {
+    db.prepare("DELETE FROM security_challenges WHERE expires_at <= ?").run(Date.now());
+    const id = opaque();
+    db.prepare("INSERT INTO security_challenges (id_hash, purpose, user_id, binding, version, payload, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?)")
+        .run(hash(id), purpose, userId, binding, userId ? securityVersion(userId) : 0, JSON.stringify(payload), Date.now() + ttl);
+    return id;
+}
+/** Count attempts before checking the factor, including requests that end in an error. */
+export function readSecurityChallenge(id, purpose, binding, consume = false) {
+    if (typeof id !== "string" || !/^[\w-]{43}$/.test(id))
+        return null;
+    return db.transaction(() => {
+        const row = db.prepare("SELECT * FROM security_challenges WHERE id_hash = ?").get(hash(id));
+        if (!row || row.purpose !== purpose || row.binding !== binding || row.expires_at <= Date.now() || row.attempts >= 15 || (row.user_id && row.version !== securityVersion(row.user_id)))
+            return null;
+        if (consume)
+            db.prepare("DELETE FROM security_challenges WHERE id_hash = ?").run(hash(id));
+        else
+            db.prepare("UPDATE security_challenges SET attempts = attempts + 1 WHERE id_hash = ?").run(hash(id));
+        return row;
+    })();
+}
+export function discardSecurityChallenge(id) { db.prepare("DELETE FROM security_challenges WHERE id_hash = ?").run(hash(id)); }
+export function totpFor(secret, label = "FeedKeeper") {
+    return new TOTP({ issuer: "FeedKeeper", label, algorithm: "SHA1", digits: 6, period: 30, secret: secret ? Secret.fromBase32(secret) : new Secret({ size: 20 }) });
+}
+export function verifySecondFactor(userId, code) {
+    if (typeof code !== "string" || code.length > 80)
+        return false;
+    return db.transaction(() => {
+        const account = securityAccount(userId);
+        if (!account.totp_secret)
+            return false;
+        if (/^\d{6}$/.test(code)) {
+            let delta;
+            try {
+                delta = totpFor(unseal(account.totp_secret)).validate({ token: code, window: 1 });
+            }
+            catch {
+                return false;
+            }
+            if (delta === null)
+                return false;
+            const step = Math.floor(Date.now() / 30_000) + delta;
+            return db.prepare("UPDATE account_security SET totp_last_step = ? WHERE user_id = ? AND totp_last_step < ?").run(step, userId, step).changes === 1;
+        }
+        const normalized = code.toUpperCase().replace(/[ -]/g, "");
+        if (!/^[A-F0-9]{24}$/.test(normalized))
+            return false;
+        return db.prepare("DELETE FROM recovery_codes WHERE user_id = ? AND code_hash = ?").run(userId, hash(normalized)).changes === 1;
+    })();
+}
+export function newRecoveryCodes(userId) {
+    db.prepare("DELETE FROM recovery_codes WHERE user_id = ?").run(userId);
+    const codes = Array.from({ length: 10 }, () => randomBytes(12).toString("hex").toUpperCase());
+    for (const code of codes)
+        db.prepare("INSERT INTO recovery_codes (user_id, code_hash) VALUES (?, ?)").run(userId, hash(code));
+    return codes.map(code => code.match(/.{6}/g).join("-"));
+}
+/** Enabling MFA invalidates older password-only sessions, tokens, pairing codes and pending logins. */
+export function revokeSecuritySessions(userId) {
+    db.prepare("UPDATE account_security SET version = version + 1 WHERE user_id = ?").run(userId);
+    db.prepare("DELETE FROM personal_access_tokens WHERE user_id = ?").run(userId);
+    db.prepare("DELETE FROM pairing_codes WHERE user_id = ?").run(userId);
+    db.prepare("DELETE FROM security_challenges WHERE user_id = ?").run(userId);
+    db.prepare("DELETE FROM oauth_grants WHERE user_id = ?").run(userId);
+    db.prepare("DELETE FROM oauth_codes WHERE user_id = ?").run(userId);
+}
+export function beginMfa(req, userId, channel, context) {
+    if (!hasTotp(userId))
+        return null;
+    const challengeId = issueSecurityChallenge("mfa", userId, securityBinding(req, `${channel}-login`), context);
+    if (channel === "web") {
+        req.session.pendingMfa = challengeId;
+    }
+    return { error: "mfa_required", challengeId, methods: ["totp", "recovery"], expiresAt: new Date(Date.now() + 5 * 60_000).toISOString() };
+}
+//# sourceMappingURL=security.js.map