feedkeeper 0.23.0 → 0.24.1

package/web/dist/index.html

@@ -30,7 +30,7 @@
     <meta name="twitter:image" content="/logo.svg" />
     <!-- Inline so the splash paints before any script or stylesheet loads -->
     <style>html{background:#f8fafc}html[data-theme=dark]{background:#0b0f17}@media (prefers-color-scheme:dark){html:not([data-theme=light]){background:#0b0f17}}#splash{z-index:100;background:inherit;justify-content:center;align-items:center;transition:opacity .3s;display:flex;position:fixed;inset:0}#splash img{width:62px;height:62px;animation:.4s both splash-in}#splash.splash-hidden{opacity:0;pointer-events:none}@keyframes splash-in{0%{opacity:0;transform:scale(.92)}}@media (prefers-reduced-motion:reduce){#splash,#splash img{transition:none;animation:none}}</style>
-    <script type="module" crossorigin src="/assets/index-xx6TyOwB.js"></script>
+    <script type="module" crossorigin src="/assets/index-BjhXf9OJ.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-B4e2oqbo.css">
   </head>
   <body>

package/web/dist/sw.js

@@ -1,6 +1,6 @@
 // FeedKeeper service worker. Built into dist/sw.js, where the placeholder below is
 // replaced with a hash of the build's file names so every release gets its own app cache.
-const BUILD_ID = "93f2f6a49c67";
+const BUILD_ID = "3c5196c9a4ba";
 const STATIC_CACHE = `fk-static-${BUILD_ID}`;
 const API_CACHE = "fk-api";
 const SHELL = "/index.html";
@@ -15,7 +15,8 @@ const MAX_CACHED_IMAGES = 3000;
 // (tokens, users, settings, mutations) always goes to the server.
 const READABLE_API = [/^\/api\/onboarding\/status$/, /^\/api\/config$/, /^\/api\/auth\/me$/, /^\/api\/feeds$/, /^\/api\/folders$/, /^\/api\/items$/, /^\/api\/filters\/muted$/];
 const FEED_ICON = /^\/api\/feeds\/\d+\/icon$/;
-const IMMUTABLE_API = [/^\/api\/archive\/images\/\d+$/, /^\/api\/items\/\d+\/image$/, /^\/api\/auth\/me\/avatar$/];
+const MUTABLE_IMAGE = /^\/api\/items\/\d+\/image$/;
+const IMMUTABLE_API = [/^\/api\/archive\/images\/\d+$/, /^\/api\/auth\/me\/avatar$/];
 // Files next to index.html (theme script, manifest, icons) are the only other thing served from the cache. Any other
 // path answers per request and per signed-in user, so a stored copy could show one account another's data.
 const STATIC_FILE = /^\/[^/]+\.(?:js|css|svg|png|ico|webmanifest|txt|woff2?)$/;
@@ -56,6 +57,8 @@ self.addEventListener("fetch", (event) => {
     if (url.searchParams.has("offline")) return;
     if (FEED_ICON.test(url.pathname)) {
       event.respondWith(staleWhileRevalidate(API_CACHE, request));
+    } else if (MUTABLE_IMAGE.test(url.pathname)) {
+      event.respondWith(mutableImage(request));
     } else if (IMMUTABLE_API.some((pattern) => pattern.test(url.pathname))) {
       event.respondWith(cacheFirst(API_CACHE, request, MAX_CACHED_IMAGES));
     } else if (READABLE_API.some((pattern) => pattern.test(url.pathname))) {
@@ -114,6 +117,31 @@ async function cacheFirst(cacheName, request, limit = 0) {
   return response;
 }
 
+async function mutableImage(request) {
+  const cache = await caches.open(API_CACHE);
+  const cached = await cache.match(request, MATCH);
+  const date = cached && Date.parse(cached.headers.get("date") ?? "");
+  const maxAge = Number(cached?.headers.get("cache-control")?.match(/max-age=(\d+)/)?.[1] ?? 0);
+  // Old immutable proxy responses must also expire at the new six-hour boundary.
+  if (cached && !cached.headers.get("cache-control")?.includes("no-store") && Date.now() - date < Math.min(maxAge, 21600) * 1000) return cached;
+  try {
+    const headers = new Headers(request.headers);
+    if (cached?.headers.get("etag")) headers.set("If-None-Match", cached.headers.get("etag"));
+    let response = await withTimeout(fetch(new Request(request, { headers, cache: "no-cache" })), NETWORK_TIMEOUT_MS);
+    if (response.status === 304 && cached) {
+      const refreshed = new Headers(cached.headers);
+      for (const name of ["date", "etag", "cache-control"]) if (response.headers.has(name)) refreshed.set(name, response.headers.get(name));
+      refreshed.set("date", response.headers.get("date") ?? new Date().toUTCString());
+      response = new Response(await cached.arrayBuffer(), { status: 200, headers: refreshed });
+    }
+    if (response.ok) {
+      if (response.headers.get("cache-control")?.includes("no-store")) await cache.delete(request);
+      else { await cache.put(request, response.clone()); await trim(cache, key => /\/api\/(archive\/images\/|items\/\d+\/image)/.test(key.url), MAX_CACHED_IMAGES); }
+    }
+    return response; // An online denial must never fall back to the previous account's bytes.
+  } catch { return cached ?? Response.error(); }
+}
+
 async function networkFirst(cacheName, request, limit) {
   const cache = await caches.open(cacheName);
   try {

package/server/dist/app.js

@@ -1,100 +0,0 @@
-import { dirname, join, sep } from "node:path";
-import { fileURLToPath } from "node:url";
-import { existsSync } from "node:fs";
-import express from "express";
-import helmet from "helmet";
-import cors from "cors";
-import cookieSession from "cookie-session";
-import rateLimit from "express-rate-limit";
-import { config } from "./config.js";
-import { runMigrations } from "./db/index.js";
-import { apiRouter } from "./api/index.js";
-import { mcpRouter } from "./mcp/http.js";
-import { startPollingScheduler } from "./feeds/poller.js";
-import { startCleanupScheduler } from "./feeds/cleanup.js";
-import { repairEncodedText } from "./feeds/repository.js";
-import { pruneArchive, scheduleMissingArchives } from "./feeds/archive.js";
-import { startEditionScheduler } from "./native/editions.js";
-const __dirname = dirname(fileURLToPath(import.meta.url));
-export const DEFAULT_WEB_DIST = join(__dirname, "../../web/dist");
-export function startCoreSchedulers() {
-    runMigrations();
-    const repairedItems = repairEncodedText();
-    if (repairedItems > 0)
-        console.log(`[db] decoded HTML entities in ${repairedItems} stored items`);
-    pruneArchive();
-    const pendingArchives = scheduleMissingArchives();
-    if (pendingArchives > 0)
-        console.log(`[archive] archiving ${pendingArchives} saved articles in the background`);
-    startPollingScheduler();
-    startCleanupScheduler();
-    startEditionScheduler();
-}
-export function createApp(options = {}) {
-    const app = express();
-    if (config.trustProxy) {
-        app.set("trust proxy", 1);
-    }
-    app.use(helmet({
-        contentSecurityPolicy: {
-            directives: {
-                ...helmet.contentSecurityPolicy.getDefaultDirectives(),
-                "script-src": ["'self'"],
-                "img-src": ["'self'", "data:", "https:", "http:"],
-            },
-        },
-    }));
-    // Send X-Robots-Tag to ensure all HTTP endpoints disallow indexing even outside HTML
-    app.use((_req, res, next) => {
-        res.setHeader("X-Robots-Tag", "noindex, nofollow");
-        next();
-    });
-    app.use(cors({
-        origin: config.publicUrl,
-        credentials: true,
-    }));
-    app.use(express.json({ limit: "1mb" }));
-    app.use(express.text({ type: ["application/xml", "text/xml", "text/plain"], limit: "5mb" }));
-    app.use(cookieSession({
-        name: "feedkeeper.sid",
-        secret: config.sessionSecret,
-        maxAge: 30 * 24 * 60 * 60 * 1000,
-        httpOnly: true,
-        sameSite: "lax",
-        secure: config.publicUrl.startsWith("https://"),
-    }));
-    // Generic API rate limit as defense in depth on top of the stricter
-    // per-route limiter on /api/auth/login.
-    app.use("/api", rateLimit({
-        windowMs: 60 * 1000,
-        limit: 120,
-        standardHeaders: true,
-        legacyHeaders: false,
-        // Lists load many article images and feed icons at once; those routes have their own, higher limit.
-        skip: (req) => /^\/(v1\/)?(items\/\d+\/image|feeds\/\d+\/icon|subscriptions\/\d+\/icon|archive\/images\/\d+)$/.test(req.path),
-    }));
-    app.use("/api", apiRouter);
-    app.use("/mcp", mcpRouter);
-    if (options.configure) {
-        options.configure(app);
-    }
-    const webDist = options.webDist === undefined ? DEFAULT_WEB_DIST : options.webDist;
-    if (webDist && existsSync(webDist)) {
-        app.use(express.static(webDist, {
-            setHeaders(res, filePath) {
-                // Hashed build files never change; the service worker must always be re-checked.
-                if (filePath.includes(`${sep}assets${sep}`))
-                    res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
-                if (filePath.endsWith(`${sep}sw.js`))
-                    res.setHeader("Cache-Control", "no-cache");
-            },
-        }));
-        app.get(/(.*)/, (req, res, next) => {
-            if (req.path.startsWith("/api") || req.path.startsWith("/mcp") || req.path.startsWith("/cloud"))
-                return next();
-            res.sendFile(join(webDist, "index.html"));
-        });
-    }
-    return app;
-}
-//# sourceMappingURL=app.js.map

package/server/dist/auth/plan.js

@@ -1,58 +0,0 @@
-const DEFAULT_SELFHOSTED_FEATURES = [
-    "sync",
-    "notes",
-    "edition",
-    "edition.automatic",
-    "edition.revisions",
-    "native-preferences",
-    "search.fts",
-    "mcp.remote",
-    "feed-icons",
-    "folder-icons",
-    "fulltext",
-];
-class DefaultPlanProvider {
-    getPlanForUser(_userId) {
-        return {
-            tier: "selfhosted",
-            status: "active",
-            features: DEFAULT_SELFHOSTED_FEATURES,
-            manageUrl: null,
-        };
-    }
-    hasFeature(_userId, _feature) {
-        // In self-hosted mode, all features are permitted
-        return true;
-    }
-}
-let activePlanProvider = new DefaultPlanProvider();
-export function setPlanProvider(provider) {
-    activePlanProvider = provider;
-}
-export function getPlanProvider() {
-    return activePlanProvider;
-}
-export function getUserPlan(userId) {
-    return activePlanProvider.getPlanForUser(userId);
-}
-export function requirePlanFeature(feature) {
-    return (req, res, next) => {
-        const userId = req.user?.id;
-        if (!userId) {
-            res.status(401).json({ error: "not_authenticated" });
-            return;
-        }
-        if (!activePlanProvider.hasFeature(userId, feature)) {
-            const plan = activePlanProvider.getPlanForUser(userId);
-            res.status(403).json({
-                error: "feature_not_included",
-                feature,
-                tier: plan.tier,
-                manageUrl: plan.manageUrl ?? null,
-            });
-            return;
-        }
-        next();
-    };
-}
-//# sourceMappingURL=plan.js.map

package/server/dist/index.js

@@ -1,15 +0,0 @@
-export { createApp, startCoreSchedulers, DEFAULT_WEB_DIST } from "./app.js";
-export * from "./auth/capabilities.js";
-export * from "./auth/tokens.js";
-export * from "./auth/middleware.js";
-export * from "./auth/users.js";
-export * from "./config.js";
-export * from "./db/index.js";
-export { apiRouter } from "./api/index.js";
-export { mcpRouter } from "./mcp/http.js";
-export { startPollingScheduler } from "./feeds/poller.js";
-export { startCleanupScheduler } from "./feeds/cleanup.js";
-export { repairEncodedText } from "./feeds/repository.js";
-export { pruneArchive, scheduleMissingArchives } from "./feeds/archive.js";
-export { startEditionScheduler } from "./native/editions.js";
-//# sourceMappingURL=index.js.map