jamdesk 1.1.203 → 1.1.205

package/vendored/lib/middleware-helpers.ts

@@ -206,6 +206,12 @@ export async function handleProjectResolution(
           projectSlug,
           hostAtDocs: customResolution.hostAtDocs,
           inactive,
+          // A forwarded custom domain IS a custom domain for the D9
+          // retained-domains gate — a customer proxying through their own
+          // Cloudflare Worker must keep serving like a direct CNAME hit,
+          // not fall back to the *.jamdesk.app placeholder (review
+          // finding #4).
+          viaCustomDomain: true,
           // Subpath follows the same source as hostAtDocs — the DOMAIN's own
           // config. A domain served at /help must not inherit the subdomain's
           // projectCfg prefix.
@@ -266,16 +272,15 @@ export async function handleProjectResolution(
     };
   }
 
-  // Piggyback inactive read on the custom-domain resolution path. Single
-  // extra Redis GET per request; the proxy reads .inactive to rewrite.
-  const inactive = await getProjectInactive(resolution.projectSlug);
-
-  log('info', 'Project resolved from custom domain', { hostname, projectSlug: resolution.projectSlug, inactive });
+  // D9: viaCustomDomain is always true on this path, and proxy.ts only
+  // reads .inactive gated on `!viaCustomDomain` — so the value would
+  // always be discarded. Skip the Redis GET entirely rather than pay for
+  // a lookup no caller can ever use (review finding #8).
+  log('info', 'Project resolved from custom domain', { hostname, projectSlug: resolution.projectSlug });
   return {
     projectSlug: resolution.projectSlug,
     hostAtDocs: resolution.hostAtDocs,
     domainStatus: resolution.domainStatus,
-    inactive,
     viaCustomDomain: true,
     docsSubpath: resolution.docsSubpath,
     previousDocsSubpath: resolution.previousDocsSubpath,
@@ -768,6 +773,22 @@ export function getDocsPrefixRouting(
   if (pathname === externalPrefix || pathname.startsWith(`${externalPrefix}/`)) {
     return { rewrite: toInternalPath(pathname, externalPrefix) };
   }
+  // `<prefix>.md` is the prefix ROOT's markdown export, not a dotted asset. It
+  // is the shape our own docs tell agents to use ("append .md to any page
+  // URL"), and it is the only `.md` on a custom-subpath tenant that was
+  // broken: `/fun/index.md`, `/fun/introduction.md` and `/fun` with
+  // `Accept: text/markdown` all worked, because each either sits under
+  // `<prefix>/` or carries no dot. `/fun.md` matched neither branch above,
+  // fell through the asset guard below untouched, and reached the markdown
+  // branch as pagePath `/fun` — which doesn't start with `/docs`, so the root
+  // sentinel strip never ran and the slug `fun` missed in R2.
+  //
+  // Internalise to the canonical `/docs.md`, the shape that branch already
+  // strips to the sentinel. Only `.md` is special-cased: `<prefix>.json` and
+  // friends stay assets, which is what the guard below is for.
+  if (pathname === `${externalPrefix}.md`) {
+    return { rewrite: `${DEFAULT_DOCS_SUBPATH}.md` };
+  }
   // Serve-both: internal-canonical /docs paths pass through untouched — a
   // customer worker still routing the old /docs prefix keeps working, and
   // request-time canonicals point at the current prefix (no dup content).

package/vendored/lib/nav-group-filter.ts

@@ -0,0 +1,81 @@
+import type { NavigationConfig } from './docs-types.js';
+
+/**
+ * Strip group-restricted pages the viewer cannot access out of a navigation
+ * config before it is serialized to the client.
+ *
+ * Why: the sidebar/tabs/header are client components that resolve navigation
+ * from the full docs.json config, so every page's RSC payload — public pages
+ * served to anonymous visitors included — would otherwise carry the titles and
+ * hrefs of group-restricted pages. The edge answers an out-of-group request
+ * with a 404 precisely so the page's existence is not confirmed; listing it in
+ * the nav would contradict that.
+ *
+ * Semantics mirror the edge gate (any-of): a page stays when the viewer holds
+ * at least one of its required groups. `groupsPaths` keys are root-relative
+ * slugs with a leading slash (collectGroupsPaths); nav entries may omit it.
+ * Returns the input object itself when nothing is restricted, so callers can
+ * pass it through without re-render churn; never mutates the input.
+ */
+export function filterNavigationForGroups(
+  navigation: NavigationConfig,
+  groupsPaths: Record<string, string[]> | undefined,
+  userGroups: readonly string[],
+): NavigationConfig {
+  if (!groupsPaths || Object.keys(groupsPaths).length === 0) return navigation;
+  const userSet = new Set(userGroups);
+  const isHidden = (page: string): boolean => {
+    const key = page.startsWith('/') ? page : `/${page}`;
+    const required = groupsPaths[key];
+    if (!Array.isArray(required) || required.length === 0) return false;
+    return !required.some((g) => userSet.has(g));
+  };
+  return walk(navigation, isHidden) as NavigationConfig;
+}
+
+// Generic structural walk: any `pages` array is filtered (string entries and
+// `{ page }` objects), and every other array/object is descended into so
+// tabs, anchors, languages, versions, dropdowns and nested groups are all
+// covered without enumerating the schema here. Containers (groups, tabs,
+// languages, versions, …) that held pages/groups and end up with none are
+// dropped too — a bare "Internal Admin" header discloses as much as the
+// page titles under it would have.
+const CONTAINER_KEYS = ['pages', 'groups'] as const;
+
+function walk(node: unknown, isHidden: (page: string) => boolean): unknown {
+  if (Array.isArray(node)) {
+    return node
+      .map((n) => walk(n, isHidden))
+      .filter((n) => !becameEmpty(n));
+  }
+  if (!node || typeof node !== 'object') return node;
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(node as Record<string, unknown>)) {
+    if (key === 'pages' && Array.isArray(value)) {
+      out[key] = (walk(
+        value.filter((entry) => {
+          if (typeof entry === 'string') return !isHidden(entry);
+          if (entry && typeof entry === 'object' && typeof (entry as { page?: unknown }).page === 'string') {
+            return !isHidden((entry as { page: string }).page);
+          }
+          return true;
+        }),
+        isHidden,
+      ) as unknown[]);
+    } else {
+      out[key] = walk(value, isHidden);
+    }
+  }
+  return out;
+}
+
+// True for an object that carries a `pages`/`groups` array and every such
+// array is now empty. Objects without any container key (page entries with
+// `{ page }`, anchors, plain hrefs) are never considered empty.
+function becameEmpty(node: unknown): boolean {
+  if (!node || typeof node !== 'object' || Array.isArray(node)) return false;
+  const rec = node as Record<string, unknown>;
+  const containers = CONTAINER_KEYS.filter((k) => Array.isArray(rec[k]));
+  if (containers.length === 0) return false;
+  return containers.every((k) => (rec[k] as unknown[]).length === 0);
+}

package/vendored/lib/public-paths-resolver.ts

@@ -1,6 +1,7 @@
 import type { DocsConfig } from './docs-types.js';
 import { matchPublicPath } from './glob-match.js';
 import { findFirstNavPage } from './find-first-nav-page.js';
+import { isKnownLanguageCode } from './language-utils.js';
 
 export { findFirstNavPage };
 
@@ -60,7 +61,17 @@ function collectPublicGroupPages(
  *   2. Navigation groups with `public: true` in docs.json
  *   3. `auth.password.public[]` globs in docs.json
  */
-export function resolvePublicPaths(input: Input): string[] {
+/**
+ * `groupsPaths` (jwt mode only): slugs to subtract — see the comment at the
+ * subtraction site. Omitted in password/specific/off mode, where the edge
+ * never enforces groups: subtracting there only turns a page the author
+ * marked `public: true` into a password-gated one, and hides that `groups`
+ * is being ignored. build.ts warns about that case instead.
+ */
+export function resolvePublicPaths(
+  input: Input,
+  groupsPaths?: Record<string, string[]>,
+): string[] {
   const set = new Set<string>();
 
   for (const p of input.pagesWithFrontmatter) {
@@ -82,9 +93,130 @@ export function resolvePublicPaths(input: Input): string[] {
     }
   }
 
+  // Gated on enabled: a disabled jwt block's public[] must not punch holes in
+  // a password-protected site (password globs stay unconditional above —
+  // 'specific' mode legitimately reads them while password.enabled is false).
+  const jwtCfg = input.docsConfig.auth?.jwt;
+  if (jwtCfg?.enabled === true && Array.isArray(jwtCfg.public)) {
+    for (const g of jwtCfg.public) {
+      if (typeof g === 'string' && g.startsWith('/')) set.add(g);
+    }
+  }
+
+  // groups beats public: a page carrying both markers stays restricted.
+  // NOTE: this deletes exact slugs only — a public GLOB overlapping a group
+  // page (public: ['/admin/*'] + groups on /admin/keys) survives here and is
+  // neutralized at the edge instead (Task 7: group check runs before the
+  // public-path bypass). Both layers are required.
+  if (groupsPaths) {
+    for (const slug of Object.keys(groupsPaths)) set.delete(slug);
+  }
+
   return Array.from(set);
 }
 
+// Exported so lib/jwt-session.ts applies the identical cap to token groups.
+export const MAX_GROUPS_PER_PAGE = 32;
+// Exported so lib/visibility.ts's hasGroupRestriction can apply the identical
+// per-entry validity check — without this, a page with only invalid group
+// entries (e.g. groups: [123] or a >64-char name) could be judged "restricted"
+// by the build-artifact filter while the runtime edge gate (which uses this
+// same MAX_GROUP_NAME_LEN via collectGroupsPaths below) judges it public,
+// silently gating pages that are actually reachable — or vice versa.
+export const MAX_GROUP_NAME_LEN = 64;
+
+/**
+ * Map of page slug → required groups, from frontmatter `groups: [...]`.
+ * Invalid entries are dropped (build warning happens in build.ts, not here —
+ * this module stays pure). Empty arrays are omitted: "groups: []" means
+ * "no restriction", not "nobody".
+ */
+export function collectGroupsPaths(input: Input): Record<string, string[]> {
+  const out: Record<string, string[]> = {};
+  // Slugs whose frontmatter explicitly declares a `groups` array — even one
+  // that ends up empty after filtering (e.g. `groups: []`, or every entry
+  // junk). Tracked separately from `out` so an explicit opt-out is protected
+  // from locale inheritance below, not just indistinguishable from "no key".
+  const ownGroups = new Set<string>();
+  for (const p of input.pagesWithFrontmatter) {
+    const raw = p.frontmatter.groups;
+    if (!Array.isArray(raw)) continue;
+    ownGroups.add(p.slug);
+    const groups = raw
+      .filter((g): g is string => typeof g === 'string' && g.length > 0 && g.length <= MAX_GROUP_NAME_LEN)
+      .slice(0, MAX_GROUPS_PER_PAGE);
+    if (groups.length > 0) out[p.slug] = groups;
+  }
+
+  // Locale inheritance: a translated page (/fr/admin) whose frontmatter lacks
+  // `groups` inherits the base page's restriction. Translations routinely drop
+  // frontmatter fields; without this, every localized variant of a restricted
+  // page silently fails OPEN to all authenticated users. Own groups always
+  // win — including an explicit `groups: []` opt-out, which must NOT be
+  // overwritten by inheritance just because it's absent from `out`.
+  //
+  // The locale set is the configured `navigation.languages` UNIONED with every
+  // on-disk top-level folder that is a known language code. The build globs
+  // and serves every locale directory regardless of docs.json (a language
+  // removed from the config, or a hand-translated tree, still renders), and
+  // the edge gate is an exact-key lookup — so a locale the config doesn't
+  // list would otherwise fail OPEN to every authenticated session.
+  const slugs = new Set(input.pagesWithFrontmatter.map((p) => p.slug));
+  const localeSet = new Set<string>(
+    (input.docsConfig.navigation?.languages ?? [])
+      .map((l) => (l as { language?: unknown }).language)
+      .filter((c): c is string => typeof c === 'string'),
+  );
+  for (const slug of slugs) {
+    // '/fr/guide' → ['', 'fr', 'guide']: a locale dir only counts when
+    // something lives under it (a top-level '/fr' page is just a page).
+    const [, first, ...rest] = slug.split('/');
+    if (first && rest.length > 0 && isKnownLanguageCode(first)) {
+      localeSet.add(first);
+    }
+  }
+  const locales = Array.from(localeSet);
+  if (locales.length > 0) {
+    for (const [base, groups] of Object.entries(out)) {
+      for (const locale of locales) {
+        const localized = `/${locale}${base}`;
+        if (slugs.has(localized) && !ownGroups.has(localized)) out[localized] = groups;
+      }
+    }
+  }
+
+  // Root-path aliases: the bare root renders the FIRST NAV PAGE in place — `/`
+  // (and hostAtDocs `/docs`) → findFirstNavPage(nav); a locale root `/fr` →
+  // that language block's first page (see render-doc-page.tsx resolveSlug/
+  // findFirstPage). The edge gate looks up `/` (or `/fr`) directly, so a
+  // group-restricted homepage would fail OPEN at the root without this alias —
+  // even though its own URL (/introduction) stays gated. Mirrors detectAuthMode's
+  // existing `/`↔firstPage public-path precedent. Only aliased when the resolved
+  // first page is actually restricted (its groups landed in `out`). Own entries
+  // win: never clobber an explicit `/`/`/fr` page key set above.
+  const nav = input.docsConfig.navigation as
+    | { languages?: Array<{ language?: unknown }> }
+    | undefined;
+  const aliasFirstPage = (rootKey: string, firstPage: string | null): void => {
+    if (firstPage && out[firstPage] && !ownGroups.has(rootKey)) {
+      out[rootKey] = out[firstPage];
+    }
+  };
+  aliasFirstPage('/', findFirstNavPage(input.docsConfig.navigation));
+  if (locales.length > 0) {
+    for (const locale of locales) {
+      const langBlock = nav?.languages?.find(
+        (l) => (l as { language?: unknown }).language === locale,
+      );
+      const localeFirst =
+        (langBlock && findFirstNavPage(langBlock)) ||
+        findFirstNavPage(input.docsConfig.navigation);
+      aliasFirstPage(`/${locale}`, localeFirst);
+    }
+  }
+  return out;
+}
+
 /**
  * Collect paths marked private via:
  *   1. MDX frontmatter `private: true`
@@ -133,31 +265,54 @@ export type AuthMode = 'off' | 'all' | 'specific';
 
 export interface AuthModeResult {
   mode: AuthMode;
+  authType: 'password' | 'jwt';
   publicPaths: string[];
   privatePaths: string[];
+  groupsPaths: Record<string, string[]>;
 }
 
 /**
  * Determine the effective auth mode from the docs config and page frontmatter.
  *
- * 1. `auth.password.enabled === true` → mode='all'
- * 2. Private markers exist (frontmatter or config) → mode='specific'
- * 3. Otherwise → mode='off'
+ * 1. `auth.password.enabled === true` → mode='all', authType='password'
+ * 2. `auth.jwt.enabled === true` → mode='all', authType='jwt' (only reached
+ *    when password is not enabled — validation blocks both being enabled at
+ *    once, but if a stale config ever reaches here, password wins
+ *    deterministically).
+ * 3. Private markers exist (frontmatter or config) → mode='specific'
+ * 4. Otherwise → mode='off'
  */
 export function detectAuthMode(input: Input): AuthModeResult {
-  const enabled = input.docsConfig.auth?.password?.enabled === true;
+  const passwordEnabled = input.docsConfig.auth?.password?.enabled === true;
+  const jwtEnabled = input.docsConfig.auth?.jwt?.enabled === true;
 
-  if (enabled) {
+  if (passwordEnabled) {
     return {
       mode: 'all',
+      authType: 'password',
       publicPaths: resolvePublicPaths(input),
       privatePaths: [],
+      groupsPaths: {},
+    };
+  }
+
+  if (jwtEnabled) {
+    // Computed once and threaded into the public-path resolution — it is the
+    // only mode where groups are enforced (and the only mode that subtracts
+    // group pages from the public set).
+    const groupsPaths = collectGroupsPaths(input);
+    return {
+      mode: 'all',
+      authType: 'jwt',
+      publicPaths: resolvePublicPaths(input, groupsPaths),
+      privatePaths: [],
+      groupsPaths,
     };
   }
 
   const privatePaths = collectPrivatePaths(input);
   if (privatePaths.length === 0) {
-    return { mode: 'off', publicPaths: [], privatePaths: [] };
+    return { mode: 'off', authType: 'password', publicPaths: [], privatePaths: [], groupsPaths: {} };
   }
 
   // Specific mode: invert the page list (all pages minus private) and
@@ -183,7 +338,9 @@ export function detectAuthMode(input: Input): AuthModeResult {
 
   return {
     mode: 'specific',
+    authType: 'password',
     publicPaths: Array.from(publicSet),
     privatePaths,
+    groupsPaths: {},
   };
 }

package/vendored/lib/r2-public-storage-guard.ts

@@ -5,6 +5,10 @@ interface AuthSecret {
   hash?: unknown;
 }
 
+interface JwtSecret {
+  publicKeyPem?: unknown;
+}
+
 interface AuthPublic {
   enabled?: unknown;
 }
@@ -17,8 +21,23 @@ function overrideEnabled(): boolean {
   return process.env.R2_ALLOW_GATED_PUBLIC_BUCKET?.trim() === 'true';
 }
 
-function isGated(secret: AuthSecret | null, pub: AuthPublic | null): boolean {
-  return typeof secret?.hash === 'string' && pub?.enabled === true;
+// Considers EITHER secret key — a JWT-gated project must also be treated
+// as gated here, or its content gets written to public/versioned R2 keys
+// (defeating the guard's purpose). Deliberately a SUPERSET of
+// isProjectGated's mode-bound truth table (which consults only the key for
+// the configured authType): a lingering hash on a jwt tenant with no jwt
+// key makes this guard write gated keys while the reader takes the public
+// path and falls back to the S3 SDK — a latency cost, never an exposure.
+// Fail-closed is the right bias for a write-side guard.
+function isGated(
+  secret: AuthSecret | null,
+  pub: AuthPublic | null,
+  jwtSecret: JwtSecret | null,
+): boolean {
+  return (
+    pub?.enabled === true &&
+    (typeof secret?.hash === 'string' || typeof jwtSecret?.publicKeyPem === 'string')
+  );
 }
 
 /**
@@ -83,16 +102,19 @@ export async function resolveR2WriteScheme(
   // public bucket unverified.
   let secret: AuthSecret | null = null;
   let pub: AuthPublic | null = null;
+  let jwtSecret: JwtSecret | null = null;
   let lastErr: unknown;
   let read = false;
   for (let attempt = 1; attempt <= retryAttempts; attempt++) {
     try {
-      const [secretResult, publicResult] = await Promise.all([
+      const [secretResult, publicResult, jwtSecretResult] = await Promise.all([
         client.get(`projectAuthSecret:${slug}`),
         client.get(`projectAuthPublic:${slug}`),
+        client.get(`projectJwtSecret:${slug}`),
       ]);
       secret = secretResult as AuthSecret | null;
       pub = publicResult as AuthPublic | null;
+      jwtSecret = jwtSecretResult as JwtSecret | null;
       read = true;
       break;
     } catch (err) {
@@ -109,5 +131,5 @@ export async function resolveR2WriteScheme(
     );
   }
 
-  return isGated(secret, pub) ? 'legacy-only' : 'versioned+legacy';
+  return isGated(secret, pub, jwtSecret) ? 'legacy-only' : 'versioned+legacy';
 }

package/vendored/lib/redis.ts

@@ -56,6 +56,14 @@ async function upstashCommand(
   return data?.result;
 }
 
+export interface ProjectAuthPublicValue {
+  enabled: boolean;
+  publicPaths: unknown[];
+  authType?: 'password' | 'jwt';
+  loginUrl?: string;
+  groupsPaths?: Record<string, string[]>;
+}
+
 /**
  * Public part of project auth: the docs.json enabled flag + the resolved list
  * of paths that bypass the password check (from frontmatter `public: true`,
@@ -64,10 +72,14 @@ async function upstashCommand(
  *
  * The `enabled` flag is the docs.json truth-table source. Middleware only
  * gates traffic when enabled=true AND a hash exists in projectAuthSecret.
+ *
+ * `authType`/`loginUrl`/`groupsPaths` are JWT-mode fields (Task 3). They are
+ * only serialized when present so password payloads keep the exact legacy
+ * shape byte-for-byte — old readers (and their tests) see no change.
  */
 export async function setProjectAuthPublic(
   slug: string,
-  value: { enabled: boolean; publicPaths: unknown[] },
+  value: ProjectAuthPublicValue,
   kvUrl?: string,
   kvToken?: string
 ): Promise<void> {
@@ -79,12 +91,18 @@ export async function setProjectAuthPublic(
   const publicPaths = value.publicPaths.filter(
     (p): p is string => typeof p === 'string',
   );
+  const payload: Record<string, unknown> = { enabled: value.enabled, publicPaths };
+  if (value.authType) payload.authType = value.authType;
+  if (value.loginUrl) payload.loginUrl = value.loginUrl;
+  if (value.groupsPaths && Object.keys(value.groupsPaths).length > 0) {
+    payload.groupsPaths = value.groupsPaths;
+  }
   await upstashCommand(
     kvUrl,
     kvToken,
     'SET',
     `projectAuthPublic:${slug}`,
-    JSON.stringify({ enabled: value.enabled, publicPaths }),
+    JSON.stringify(payload),
   );
 }