jamdesk 1.1.167 → 1.1.169

package/vendored/lib/middleware-helpers.ts

@@ -15,11 +15,12 @@ import {
   isSubdomain,
 } from './project-resolver';
 import { redis } from './redis';
-import { getDomainMapping, getDomainStatus, getProjectInactive } from './cached-redis';
-import { getForwardedHosts, isJamdeskDomain } from './domain-helpers';
+import { getDomainConfig, getDomainMapping, getDomainStatus, getProjectInactive } from './cached-redis';
+import { getForwardedHosts, isJamdeskDomain, normalizeForwardedHost, parseRedisConfig } from './domain-helpers';
 import { getRedirects, matchRedirect, mergeQueryStrings, isInvalidDestination } from './redirect-matcher';
 import { ASSET_PREFIX } from './docs-types';
 import { extractLanguageFromPath } from './language-utils';
+import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 
 /**
@@ -77,6 +78,13 @@ export interface ProjectResolutionResult {
    * URL indexing — the upstream subdomain is not the public face).
    */
   customDomain?: string;
+  // NOTE: there is deliberately no `customDomainOnly` here. The gate
+  // (`customDomainOnlyBlock`) re-derives it from `getProjectConfig(slug)` on
+  // purpose — one of its call sites has only a slug parsed out of the URL, and
+  // a gate that trusts a caller-supplied resolution is a gate that diverges
+  // from the one the other call site enforces. Do not add the field back "to
+  // save a Redis read": the read is TtlCached, and the field would be an
+  // invitation to trust it.
 }
 
 /**
@@ -880,3 +888,258 @@ export function getAssetsApiPath(pathname: string): string {
     .replace(/^public\//, '');
   return `/api/assets/${assetPath}`;
 }
+
+/**
+ * Domain-side validation for the canonical override.
+ *
+ * `resolution.customDomain` is a projectCfg-side MIRROR: registerDomain
+ * writes it PRE-verification, and clearCustomDomainOnRemove's best-effort
+ * Redis delete can fail — so the mirror alone can be premature (domain
+ * never activated) or stale (domain removed). The DOMAIN-side records
+ * (`domain:<host>`, `domainStatus:<host>`, `domainCfg:<host>`) are written
+ * only at activation and deleted on removal, so they are the source of
+ * truth:
+ *   - the mapping must point back at this project, and
+ *   - domainStatus must be 'active' (or 'cached', mirroring how
+ *     handleProjectResolution treats domainStatus).
+ *
+ * Returns null when validation fails — stale/premature mirror, or a
+ * transient Redis error (never break the request over a canonical tag).
+ * On success returns the domain's OWN serving mode from domainCfg
+ * (hostAtDocs defaults true when the field is absent, mirroring
+ * resolveCustomDomain), or `{ hostAtDocs: undefined }` when the domainCfg
+ * record is missing entirely (legacy domains) so the caller preserves the
+ * projectCfg-derived URL shape.
+ *
+ * Hot-path note: all three reads go through the TtlCache-fronted
+ * cached-redis helpers (60s positive TTL, single-flight), batched into one
+ * parallel round-trip — at most one Redis fetch per domain per instance
+ * per TTL window.
+ *
+ * Lives here (not proxy.ts) because `customDomainOnlyBlock` below needs it
+ * too — a helper used from two modules belongs in the shared one.
+ * `proxy.ts` re-exports it so existing imports keep resolving.
+ */
+export async function validateCanonicalDomain(
+  customDomain: string,
+  projectSlug: string | null,
+): Promise<{ hostAtDocs: boolean | undefined } | null> {
+  try {
+    const [mapping, status, cfgRaw] = await Promise.all([
+      getDomainMapping(customDomain),
+      getDomainStatus(customDomain),
+      getDomainConfig(customDomain),
+    ]);
+    if (!projectSlug || mapping !== projectSlug) {
+      log('warn', '[canonical-domain-stale]', { customDomain, projectSlug, mapping });
+      return null;
+    }
+    if (status !== 'active' && status !== 'cached') {
+      log('warn', '[canonical-domain-inactive]', { customDomain, projectSlug, status });
+      return null;
+    }
+    const cfg = parseRedisConfig(cfgRaw);
+    if (!cfg) return { hostAtDocs: undefined };
+    return { hostAtDocs: cfg.hostAtDocs !== false };
+  } catch (e) {
+    log('warn', '[canonical-domain-check-failed]', { customDomain, error: (e as Error).message });
+    return null;
+  }
+}
+
+// ─────────────────────────────────────────────────────────────────────────
+// "Custom domain only" mode
+//
+// When a project turns this on, a direct hit on <slug>.jamdesk.app 404s unless
+// the request looks like it came through the customer's reverse proxy.
+//
+// This is VISIBILITY control, not ACCESS control: the marker below is a
+// public, documented constant that anyone can append. It keeps crawlers,
+// slug-guessers and idle clicks off the bare subdomain. Customers who need
+// real access control use password protection — which the code below must
+// never, ever bypass.
+// ─────────────────────────────────────────────────────────────────────────
+
+/**
+ * The public query marker a reverse proxy appends when it cannot set a request
+ * header. Vercel `rewrites` — the shape the dashboard hands out, and the shape
+ * most Next.js customers use — can carry a query param in the destination but
+ * CANNOT set an upstream header. This exists for them.
+ *
+ * Namespaced on purpose: a bare `proxy` would collide with a customer's own
+ * query params. DOCUMENTED AND PUBLIC — changing this string breaks every
+ * deployed customer rewrite.
+ */
+export const PROXY_MARKER_PARAM = 'jd_proxy';
+
+/**
+ * Read the marker and strip it from the URL in one shot, at a single
+ * chokepoint, before anything downstream reads the query string.
+ *
+ * Stripping matters because `request.nextUrl` feeds redirect Locations
+ * (trailing-slash, hostAtDocs) and the auth gate's `redirectFrom`. Left in, the
+ * marker bounces back to the browser on the customer's own domain, their proxy
+ * re-appends it, and it accumulates. It is not a secret — this is hygiene.
+ *
+ * CAVEAT: this mutates `request.nextUrl`, which NextResponse.next() does not
+ * propagate as a URL rewrite. Middleware-internal consumers see the stripped
+ * URL; the rendered page's own `searchParams` may still contain the marker.
+ * See the Test Strategy's manual-verification list.
+ *
+ * A present-but-wrong value (`?jd_proxy=yes`) is NOT proxied, but is still
+ * stripped.
+ */
+export function consumeProxyMarker(request: NextRequest): boolean {
+  const raw = request.nextUrl.searchParams.get(PROXY_MARKER_PARAM);
+  if (raw === null) return false;
+  request.nextUrl.searchParams.delete(PROXY_MARKER_PARAM);
+  return raw === '1';
+}
+
+/**
+ * Extensions that carry no documentation content and are fetched cross-origin
+ * from <slug>.jamdesk.app by things that cannot attach a marker: the
+ * dashboard's site-preview <img>, and the editor preview's <base href> image
+ * loads (a root-relative `/images/x.png` ignores any query on the base href, so
+ * there is no marker to give it).
+ *
+ * `.pdf` is DELIBERATELY ABSENT. isAssetRequest() includes it, but a PDF in a
+ * customer's repo is documentation content — exempting it would leave a
+ * content-shaped hole in the gate. Do not reuse isAssetRequest() here.
+ * Derived from ASSET_EXTENSIONS so a future asset type can't silently be in
+ * one list and not the other — only the .pdf carve-out may differ.
+ */
+const PRESENTATION_EXTENSIONS = ASSET_EXTENSIONS.filter((ext) => ext !== '.pdf');
+
+export function isPresentationAsset(pathname: string): boolean {
+  // Lowercase first: /_jd/images/HERO.JPG is served today (isAssetRequest matches
+  // by prefix, not extension), so the gate must not 404 it.
+  const p = pathname.toLowerCase();
+  return PRESENTATION_EXTENSIONS.some((ext) => p.endsWith(ext));
+}
+
+/**
+ * Should this request be 404'd because the project serves from its custom
+ * domain only? Returns the response to send, or null to continue.
+ *
+ * Called from THREE places in proxy.ts, because the middleware early-exits
+ * before its main body for the content-bearing internal API routes:
+ *
+ *   1. the internal-API block — /api/{chat,mcp,r2}/{slug}, which skip
+ *      shouldRunMiddleware and carry raw MDX, MCP, and RAG chat. A gate that
+ *      misses these does nothing at all. (/api/docs-search is intentionally
+ *      NOT covered here — it's an API-key-authenticated REST endpoint, not a
+ *      cookie-gated one; see the internalAuthMatch comment in proxy.ts.)
+ *   2. the /api/assets branch — same early-exit, but the slug comes from the
+ *      HOST, not the path (the route otherwise trusts a client-supplied
+ *      x-project-slug). Presentation assets self-exempt below; `.pdf` does
+ *      not, which is the whole point of that branch.
+ *   3. the main body — every page and content artifact.
+ *
+ * The helper is async and self-contained ON PURPOSE: it re-derives the custom
+ * domain from Redis rather than trusting a caller-supplied resolution. The
+ * call sites have very different context (one has only a slug parsed out of the
+ * URL), and a helper that trusts its caller is a helper that diverges. The
+ * reads are TtlCached. This is also why ProjectResolutionResult carries no
+ * customDomainOnly field — see the note there.
+ *
+ * FAIL OPEN: blocks only when validateCanonicalDomain() confirms, live from
+ * Redis, that the custom domain maps back to this slug and is active/cached.
+ * Broken DNS, a removed domain, or a Redis outage all fail that check and the
+ * subdomain keeps serving. A customer can never lock themselves out.
+ */
+// Body for the custom-domain-only 404 when a human lands on the bare
+// subdomain. Deliberately Jamdesk-branded, never tenant-branded — the
+// project's name or logo here would leak exactly the association the
+// feature exists to hide. Palette mirrors marketing/app/globals.css.
+const CUSTOM_DOMAIN_ONLY_404_HTML = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex, nofollow">
+<title>Page not found</title>
+<style>
+  :root { --bg:#faf8f5; --text:#1b3139; --muted:#5a6f77; --accent:#ff3621; --accent-hover:#eb1600; }
+  @media (prefers-color-scheme: dark) {
+    :root { --bg:#141b1e; --text:#e8eef1; --muted:#8fa8b3; }
+  }
+  * { margin:0; padding:0; box-sizing:border-box; }
+  body { min-height:100vh; display:flex; align-items:center; justify-content:center; background:var(--bg); color:var(--text); font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif; text-align:center; padding:24px; }
+  main { max-width:26rem; }
+  .mark { font-size:1.1rem; font-weight:700; letter-spacing:-0.01em; margin-bottom:2.5rem; }
+  h1 { font-size:1.5rem; font-weight:600; letter-spacing:-0.02em; margin-bottom:0.75rem; }
+  p { color:var(--muted); line-height:1.6; margin-bottom:2rem; }
+  a.home { display:inline-block; background:var(--accent); color:#fff; text-decoration:none; font-weight:600; font-size:0.95rem; padding:0.65rem 1.4rem; border-radius:8px; }
+  a.home:hover { background:var(--accent-hover); }
+</style>
+</head>
+<body>
+<main>
+  <div class="mark">Jamdesk</div>
+  <h1>Page not found</h1>
+  <p>There&rsquo;s nothing at this address.</p>
+  <a class="home" href="https://www.jamdesk.com">Go to jamdesk.com</a>
+</main>
+</body>
+</html>
+`;
+
+export async function customDomainOnlyBlock(args: {
+  request: NextRequest;
+  slug: string;
+  pathname: string;
+  hasProxyMarker: boolean;
+}): Promise<NextResponse | null> {
+  const { request, slug, pathname, hasProxyMarker } = args;
+
+  // Platform kill switch — a per-project Redis write is not an incident
+  // response. Tolerant of any truthy value except '0'/'false' (operators
+  // shouldn't have to remember a magic string mid-incident) and trimmed
+  // (Vercel env values can pick up trailing newlines — see CLAUDE.md
+  // ISR_MODE incident). Mirrors isCacheDisabled() in lib/cached-redis.ts;
+  // inlined rather than imported to avoid dragging that module's AWS SDK
+  // deps into the edge bundle.
+  const disabled = process.env.JD_CUSTOM_DOMAIN_ONLY_DISABLED?.trim().toLowerCase();
+  if (disabled && disabled !== '0' && disabled !== 'false') return null;
+
+  if (hasProxyMarker) return null;
+  if (isPresentationAsset(pathname)) return null;
+
+  // Not a bare-subdomain hit: the request arrived on the custom domain itself.
+  const hostname = request.headers.get('host') || '';
+  if (!isJamdeskDomain(hostname)) return null;
+
+  // Proxied by an edge that can set headers (CF worker, nginx, Apache, Caddy,
+  // HAProxy). Exactly as strong as the public marker — the header is spoofable
+  // and is NOT an auth boundary. Do not "harden" this; see the plan.
+  // Normalized the same way every other consumer in this file reads this
+  // header (lowercase, port stripped, first-of-comma-chain) — a raw read
+  // would let `acme.jamdesk.app:443`/`ACME.JAMDESK.APP` fail isJamdeskDomain
+  // and open the gate.
+  const forwardedHost = normalizeForwardedHost(request.headers.get('x-jamdesk-forwarded-host'));
+  if (forwardedHost && !isJamdeskDomain(forwardedHost)) return null;
+
+  const cfg = await getProjectConfig(slug);
+  if (cfg.customDomainOnly !== true) return null;
+  if (!cfg.customDomain) return null;
+
+  const domain = await validateCanonicalDomain(cfg.customDomain, slug);
+  if (!domain) return null; // FAIL OPEN
+
+  // log() emits single-line JSON, satisfying the monorepo edge-logging rule.
+  log('info', '[custom-domain-only]', { slug, pathname, host: hostname });
+
+  // Humans get the branded page; API consumers of this same gate (MCP,
+  // chat, /api/assets) keep the terse text body so nothing has to parse
+  // HTML. Status and the noindex/no-store headers are identical either way.
+  const wantsHtml = (request.headers.get('accept') || '').includes('text/html');
+  return new NextResponse(wantsHtml ? CUSTOM_DOMAIN_ONLY_404_HTML : 'Not Found', {
+    status: 404,
+    headers: {
+      'X-Robots-Tag': 'noindex, nofollow',
+      'Cache-Control': 'no-store',
+      ...(wantsHtml ? { 'Content-Type': 'text/html; charset=utf-8' } : {}),
+    },
+  });
+}

package/vendored/lib/project-resolver.ts

@@ -107,6 +107,14 @@ export async function resolveCustomDomain(hostname: string): Promise<DomainResol
 export interface ProjectCfg {
   hostAtDocs: boolean;
   customDomain?: string;
+  /**
+   * "Custom domain only" — when true, a direct hit on <slug>.jamdesk.app is
+   * 404'd unless it looks proxied. Visibility control, NOT access control: the
+   * ?jd_proxy=1 marker that satisfies it is a public constant. Only ever
+   * enforced when the project's custom domain passes live Redis validation, so
+   * a broken domain fails OPEN.
+   */
+  customDomainOnly?: boolean;
 }
 
 /**
@@ -134,6 +142,7 @@ export async function getProjectConfig(projectSlug: string): Promise<ProjectCfg>
     return {
       hostAtDocs: cfg?.hostAtDocs === true,
       customDomain: typeof cfg?.customDomain === 'string' ? cfg.customDomain : undefined,
+      customDomainOnly: cfg?.customDomainOnly === true,
     };
   } catch {
     return { hostAtDocs: false };
@@ -160,6 +169,7 @@ export async function getProjectConfigStrict(projectSlug: string): Promise<Proje
   return {
     hostAtDocs: cfg?.hostAtDocs === true,
     customDomain: typeof cfg?.customDomain === 'string' ? cfg.customDomain : undefined,
+    customDomainOnly: cfg?.customDomainOnly === true,
   };
 }
 

package/vendored/lib/screenshot-capture.ts

@@ -148,7 +148,13 @@ export async function captureHomepageScreenshot(options: CaptureOptions): Promis
   const { slug, buildId, siteUrl, hostAtDocs, firstPagePath, r2Client, r2Bucket } = options;
 
   // For hostAtDocs sites, homepage is at /docs/{firstPagePath}; otherwise /{firstPagePath}
-  const homepageUrl = hostAtDocs ? `${siteUrl}/docs/${firstPagePath}` : `${siteUrl}/${firstPagePath}`;
+  //
+  // The bare subdomain 404s for projects in custom-domain-only mode, so the
+  // capture must look proxied. Subresources (CSS/JS/fonts/images) carry no
+  // marker but are exempt or middleware-skipped — see the subresource test in
+  // __tests__/proxy-custom-domain-only.test.ts.
+  const homepagePath = hostAtDocs ? `/docs/${firstPagePath}` : `/${firstPagePath}`;
+  const homepageUrl = `${siteUrl}${homepagePath}?jd_proxy=1`;
 
   let browser: Browser | null = null;
   let timeoutId: NodeJS.Timeout | null = null;