kempo 4.2.4 → 4.2.7

package/server/utils/fragments/getFragment.js

@@ -0,0 +1,36 @@
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+export default async ({ rootDir, file }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!file){
+    return [{ code: 400, msg: 'File path is required' }, null];
+  }
+
+  const safePath = file.replace(/\.\./g, '').replace(/^\//, '');
+  const fullPath = join(rootDir, safePath);
+
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Fragment not found' }, null];
+  }
+
+  const raw = await readFile(fullPath, 'utf-8');
+  const meta = parseFrontmatter(raw);
+  const frontmatterMatch = raw.match(/^<!--\s*\n([\s\S]*?)\n\s*-->/);
+  const markup = frontmatterMatch ? raw.slice(frontmatterMatch[0].length).trim() : raw.trim();
+
+  return [null, {
+    file: safePath,
+    name: safePath.replace(/\.fragment\.html$/, '').split('/').pop(),
+    owner: meta.owner || 'custom',
+    locked: meta.locked === 'true',
+    author: meta.author || '',
+    createdAt: meta.created || '',
+    updatedAt: meta.updated || '',
+    markup
+  }];
+};

package/server/utils/fragments/listFragments.js

@@ -0,0 +1,32 @@
+import { readFile } from 'fs/promises';
+import { relative } from 'path';
+import scanDir from '../fs/scanDir.js';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+export default async ({ rootDir }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+
+  const fragments = await scanDir(rootDir, rootDir, async (fullPath, entry, root) => {
+    const isDisabled = entry.name.endsWith('.fragment-disabled.html');
+    if(entry.isDirectory() || (!entry.name.endsWith('.fragment.html') && !isDisabled)) return null;
+    const content = await readFile(fullPath, 'utf-8');
+    const meta = parseFrontmatter(content);
+    const relPath = relative(root, fullPath).replace(/\\/g, '/');
+    return {
+      file: relPath,
+      name: meta.name || entry.name
+        .replace('.fragment-disabled.html', '')
+        .replace('.fragment.html', ''),
+      owner: meta.owner || 'custom',
+      locked: meta.locked === 'true',
+      disabled: isDisabled,
+      author: meta.author || '',
+      createdAt: meta.created || '',
+      updatedAt: meta.updated || ''
+    };
+  });
+
+  return [null, { fragments, total: fragments.length }];
+};

package/server/utils/fragments/moveFragment.js

@@ -0,0 +1,54 @@
+import { readFile, rename, mkdir, readdir, rmdir } from 'fs/promises';
+import { join, normalize, dirname, sep } from 'path';
+import { existsSync } from 'fs';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+const isTraversal = path => path.startsWith('..') || path.includes('..' + sep);
+
+export default async ({ rootDir, file, newFile }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!file) return [{ code: 400, msg: 'File path is required' }, null];
+  if(!newFile) return [{ code: 400, msg: 'New file path is required' }, null];
+
+  const normalizedFile = normalize(file);
+  const normalizedNewFile = normalize(newFile);
+
+  if(isTraversal(normalizedFile) || isTraversal(normalizedNewFile)){
+    return [{ code: 400, msg: 'Invalid file path' }, null];
+  }
+
+  const fullPath = join(rootDir, normalizedFile);
+  const fullNewPath = join(rootDir, normalizedNewFile);
+
+  let content;
+  try {
+    content = await readFile(fullPath, 'utf-8');
+  } catch {
+    return [{ code: 404, msg: 'Fragment not found' }, null];
+  }
+
+  const meta = parseFrontmatter(content);
+  if(meta.locked === 'true'){
+    return [{ code: 403, msg: 'Cannot move a locked fragment' }, null];
+  }
+  if(meta.owner && meta.owner !== 'custom'){
+    return [{ code: 403, msg: 'Cannot move system fragments' }, null];
+  }
+
+  if(existsSync(fullNewPath)){
+    return [{ code: 409, msg: 'A fragment already exists at the new location' }, null];
+  }
+
+  await mkdir(dirname(fullNewPath), { recursive: true });
+  await rename(fullPath, fullNewPath);
+
+  let dir = dirname(fullPath);
+  while(dir.startsWith(rootDir) && dir !== rootDir){
+    const entries = await readdir(dir);
+    if(entries.length > 0) break;
+    await rmdir(dir);
+    dir = dirname(dir);
+  }
+
+  return [null, { file: newFile }];
+};

package/server/utils/fragments/updateFragment.js

@@ -0,0 +1,58 @@
+import { readFile, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+
+export default async ({ rootDir, file, author, markup }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!file){
+    return [{ code: 400, msg: 'File path is required' }, null];
+  }
+
+  const safePath = file.replace(/\.\./g, '').replace(/^\//, '');
+  const fullPath = join(rootDir, safePath);
+
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Fragment not found' }, null];
+  }
+
+  const raw = await readFile(fullPath, 'utf-8');
+
+  const lockedMatch = raw.match(/^<!--[\s\S]*?locked:\s*true[\s\S]*?-->/);
+  if(lockedMatch) return [{ code: 403, msg: 'This fragment is locked and cannot be edited' }, null];
+
+  const frontmatterMatch = raw.match(/^<!--\s*\n([\s\S]*?)\n\s*-->/);
+  const existingMeta = {};
+  if(frontmatterMatch){
+    for(const line of frontmatterMatch[1].split('\n')){
+      const idx = line.indexOf(':');
+      if(idx === -1) continue;
+      const key = line.slice(0, idx).trim();
+      const value = line.slice(idx + 1).trim();
+      if(key) existingMeta[key] = value;
+    }
+  }
+
+  const now = new Date().toISOString();
+  const newMeta = {
+    ...existingMeta,
+    updated: now
+  };
+  delete newMeta.name;
+  if(author !== undefined) newMeta.author = author;
+
+  const frontmatter = '<!--\n' +
+    Object.entries(newMeta).map(([k, v]) => `  ${k}: ${v}`).join('\n') +
+    '\n-->';
+
+  const resolvedMarkup = markup !== undefined
+    ? markup
+    : (frontmatterMatch ? raw.slice(frontmatterMatch[0].length).trim() : raw.trim());
+
+  const newContent = `${frontmatter}\n${resolvedMarkup}\n`;
+
+  await writeFile(fullPath, newContent, 'utf-8');
+
+  return [null, { file: safePath, updatedAt: now }];
+};

package/server/utils/fs/parseFrontmatter.js

@@ -0,0 +1,13 @@
+export default content => {
+  const match = content.match(/^<!--\s*\n([\s\S]*?)\n\s*-->/);
+  if(!match) return {};
+  const meta = {};
+  for(const line of match[1].split('\n')){
+    const idx = line.indexOf(':');
+    if(idx === -1) continue;
+    const key = line.slice(0, idx).trim();
+    const value = line.slice(idx + 1).trim();
+    if(key) meta[key] = value;
+  }
+  return meta;
+};

package/server/utils/fs/scanDir.js

@@ -0,0 +1,26 @@
+import { readdir } from 'fs/promises';
+import { join } from 'path';
+
+const scanDir = async (dir, rootDir, visitor) => {
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+
+  const results = [];
+  for(const entry of entries){
+    if(entry.name.startsWith('.') || entry.name === 'node_modules') continue;
+    const fullPath = join(dir, entry.name);
+    const item = await visitor(fullPath, entry, rootDir);
+    if(item != null) results.push(...[].concat(item));
+    if(entry.isDirectory()){
+      const sub = await scanDir(fullPath, rootDir, visitor);
+      results.push(...sub);
+    }
+  }
+  return results;
+};
+
+export default scanDir;

package/server/utils/global-content/createGlobalContent.js

@@ -0,0 +1,58 @@
+import { readFile, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import crypto from 'crypto';
+import { GLOBAL_FILE, parseEntries } from './helpers.js';
+
+const serializeEntries = entries => entries.map(e => {
+  const attrs = [
+    `id="${e.id}"`,
+    `name="${e.name}"`,
+    `owner="${e.owner}"`,
+    `author="${e.author}"`,
+    `created="${e.createdAt}"`,
+    `updated="${e.updatedAt}"`,
+    `locked="${e.locked}"`,
+    `location="${e.location}"`,
+    `priority="${e.priority}"`
+  ].join(' ');
+  return `<content ${attrs}>\n${e.markup}\n</content>`;
+}).join('\n');
+
+export default async ({ rootDir, name, location, priority, author }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!name){
+    return [{ code: 400, msg: 'Name is required' }, null];
+  }
+  if(!location){
+    return [{ code: 400, msg: 'Location is required' }, null];
+  }
+
+  const filePath = join(rootDir, GLOBAL_FILE);
+  let entries = [];
+  if(existsSync(filePath)){
+    const raw = await readFile(filePath, 'utf-8');
+    entries = parseEntries(raw);
+  }
+
+  const now = new Date().toISOString();
+  const entry = {
+    id: crypto.randomUUID(),
+    name,
+    owner: 'custom',
+    author: author || '',
+    locked: false,
+    location,
+    priority: parseInt(priority || '0', 10),
+    createdAt: now,
+    updatedAt: now,
+    markup: ''
+  };
+
+  entries.push(entry);
+  await writeFile(filePath, serializeEntries(entries) + '\n', 'utf-8');
+
+  return [null, entry];
+};

package/server/utils/global-content/deleteGlobalContent.js

@@ -0,0 +1,52 @@
+import { readFile, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import { GLOBAL_FILE, parseEntries } from './helpers.js';
+
+const serializeEntries = entries => entries.map(e => {
+  const attrs = [
+    `id="${e.id}"`,
+    `name="${e.name}"`,
+    `owner="${e.owner}"`,
+    `author="${e.author}"`,
+    `created="${e.createdAt}"`,
+    `updated="${e.updatedAt}"`,
+    `locked="${e.locked}"`,
+    `location="${e.location}"`,
+    `priority="${e.priority}"`
+  ].join(' ');
+  return `<content ${attrs}>\n${e.markup}\n</content>`;
+}).join('\n');
+
+export default async ({ rootDir, ids }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!ids?.length){
+    return [{ code: 400, msg: 'No IDs specified' }, null];
+  }
+
+  const filePath = join(rootDir, GLOBAL_FILE);
+  if(!existsSync(filePath)){
+    return [{ code: 404, msg: 'Global content file not found' }, null];
+  }
+
+  const raw = await readFile(filePath, 'utf-8');
+  const entries = parseEntries(raw);
+  const idSet = new Set(ids);
+
+  for(const entry of entries){
+    if(!idSet.has(entry.id)) continue;
+    if(entry.locked){
+      return [{ code: 403, msg: `Cannot delete locked global content: ${entry.name}` }, null];
+    }
+    if(entry.owner && entry.owner !== 'custom'){
+      return [{ code: 403, msg: `Cannot delete global content: ${entry.name}` }, null];
+    }
+  }
+
+  const remaining = entries.filter(e => !idSet.has(e.id));
+  await writeFile(filePath, remaining.length ? serializeEntries(remaining) + '\n' : '', 'utf-8');
+
+  return [null, { deleted: ids.length }];
+};

package/server/utils/global-content/disableGlobalContent.js

@@ -0,0 +1,57 @@
+import { readFile, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import { GLOBAL_FILE, GLOBAL_DISABLED_FILE, parseEntries } from './helpers.js';
+
+const serializeEntries = entries => entries.map(e => {
+  const attrs = [
+    `id="${e.id}"`,
+    `name="${e.name}"`,
+    `owner="${e.owner}"`,
+    `author="${e.author}"`,
+    `created="${e.createdAt}"`,
+    `updated="${e.updatedAt}"`,
+    `locked="${e.locked}"`,
+    `location="${e.location}"`,
+    `priority="${e.priority}"`
+  ].join(' ');
+  return `<content ${attrs}>\n${e.markup}\n</content>`;
+}).join('\n');
+
+export default async ({ rootDir, id }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!id){
+    return [{ code: 400, msg: 'Global content ID is required' }, null];
+  }
+
+  const activePath = join(rootDir, GLOBAL_FILE);
+  if(!existsSync(activePath)){
+    return [{ code: 404, msg: 'Global content not found' }, null];
+  }
+
+  const raw = await readFile(activePath, 'utf-8');
+  const entries = parseEntries(raw);
+  const idx = entries.findIndex(e => e.id === id);
+
+  if(idx === -1){
+    return [{ code: 404, msg: 'Global content not found' }, null];
+  }
+
+  if(entries[idx].locked){
+    return [{ code: 403, msg: 'Cannot disable locked global content' }, null];
+  }
+
+  const entry = entries[idx];
+  const remaining = entries.filter((_, i) => i !== idx);
+  await writeFile(activePath, serializeEntries(remaining) + (remaining.length ? '\n' : ''), 'utf-8');
+
+  const disabledPath = join(rootDir, GLOBAL_DISABLED_FILE);
+  const disabledRaw = existsSync(disabledPath) ? await readFile(disabledPath, 'utf-8') : '';
+  const disabledEntries = parseEntries(disabledRaw);
+  disabledEntries.push(entry);
+  await writeFile(disabledPath, serializeEntries(disabledEntries) + '\n', 'utf-8');
+
+  return [null, { id }];
+};

package/server/utils/global-content/enableGlobalContent.js

@@ -0,0 +1,53 @@
+import { readFile, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import { GLOBAL_FILE, GLOBAL_DISABLED_FILE, parseEntries } from './helpers.js';
+
+const serializeEntries = entries => entries.map(e => {
+  const attrs = [
+    `id="${e.id}"`,
+    `name="${e.name}"`,
+    `owner="${e.owner}"`,
+    `author="${e.author}"`,
+    `created="${e.createdAt}"`,
+    `updated="${e.updatedAt}"`,
+    `locked="${e.locked}"`,
+    `location="${e.location}"`,
+    `priority="${e.priority}"`
+  ].join(' ');
+  return `<content ${attrs}>\n${e.markup}\n</content>`;
+}).join('\n');
+
+export default async ({ rootDir, id }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!id){
+    return [{ code: 400, msg: 'Global content ID is required' }, null];
+  }
+
+  const disabledPath = join(rootDir, GLOBAL_DISABLED_FILE);
+  if(!existsSync(disabledPath)){
+    return [{ code: 404, msg: 'Global content not found' }, null];
+  }
+
+  const raw = await readFile(disabledPath, 'utf-8');
+  const entries = parseEntries(raw);
+  const idx = entries.findIndex(e => e.id === id);
+
+  if(idx === -1){
+    return [{ code: 404, msg: 'Global content not found' }, null];
+  }
+
+  const entry = entries[idx];
+  const remaining = entries.filter((_, i) => i !== idx);
+  await writeFile(disabledPath, serializeEntries(remaining) + (remaining.length ? '\n' : ''), 'utf-8');
+
+  const activePath = join(rootDir, GLOBAL_FILE);
+  const activeRaw = existsSync(activePath) ? await readFile(activePath, 'utf-8') : '';
+  const activeEntries = parseEntries(activeRaw);
+  activeEntries.push(entry);
+  await writeFile(activePath, serializeEntries(activeEntries) + '\n', 'utf-8');
+
+  return [null, { id }];
+};

package/server/utils/global-content/getGlobalContent.js

@@ -0,0 +1,28 @@
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import { GLOBAL_FILE, parseEntries } from './helpers.js';
+
+export default async ({ rootDir, id }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!id){
+    return [{ code: 400, msg: 'Global content ID is required' }, null];
+  }
+
+  const filePath = join(rootDir, GLOBAL_FILE);
+  if(!existsSync(filePath)){
+    return [{ code: 404, msg: 'Global content not found' }, null];
+  }
+
+  const raw = await readFile(filePath, 'utf-8');
+  const entries = parseEntries(raw);
+  const entry = entries.find(e => e.id === id);
+
+  if(!entry){
+    return [{ code: 404, msg: 'Global content not found' }, null];
+  }
+
+  return [null, entry];
+};

package/server/utils/global-content/helpers.js

@@ -0,0 +1,33 @@
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+
+const GLOBAL_FILE = 'kempo-global.global.html';
+const GLOBAL_DISABLED_FILE = 'kempo-global.global-disabled.html';
+
+const parseEntries = raw => {
+  const entries = [];
+  const regex = /<content\s([^>]*)>([\s\S]*?)<\/content>/g;
+  let match;
+  while((match = regex.exec(raw)) !== null){
+    const attrs = {};
+    const attrRegex = /(\w[\w-]*)="([^"]*)"/g;
+    let a;
+    while((a = attrRegex.exec(match[1])) !== null) attrs[a[1]] = a[2];
+    entries.push({
+      id: attrs.id || '',
+      name: attrs.name || '',
+      owner: attrs.owner || 'custom',
+      author: attrs.author || '',
+      locked: attrs.locked === 'true',
+      location: attrs.location || 'default',
+      priority: parseInt(attrs.priority || '0', 10),
+      createdAt: attrs.created || '',
+      updatedAt: attrs.updated || '',
+      markup: match[2].trim()
+    });
+  }
+  return entries;
+};
+
+export { GLOBAL_FILE, GLOBAL_DISABLED_FILE, parseEntries };

package/server/utils/global-content/listGlobalContent.js

@@ -0,0 +1,24 @@
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import { GLOBAL_FILE, GLOBAL_DISABLED_FILE, parseEntries } from './helpers.js';
+
+export default async ({ rootDir }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+
+  const activePath = join(rootDir, GLOBAL_FILE);
+  const disabledPath = join(rootDir, GLOBAL_DISABLED_FILE);
+
+  const activeEntries = existsSync(activePath)
+    ? parseEntries(await readFile(activePath, 'utf-8')).map(e => ({ ...e, disabled: false }))
+    : [];
+
+  const disabledEntries = existsSync(disabledPath)
+    ? parseEntries(await readFile(disabledPath, 'utf-8')).map(e => ({ ...e, disabled: true }))
+    : [];
+
+  const entries = [...activeEntries, ...disabledEntries];
+  return [null, { entries, total: entries.length }];
+};

package/server/utils/global-content/updateGlobalContent.js

@@ -0,0 +1,56 @@
+import { readFile, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import { GLOBAL_FILE, parseEntries } from './helpers.js';
+
+const serializeEntries = entries => entries.map(e => {
+  const attrs = [
+    `id="${e.id}"`,
+    `name="${e.name}"`,
+    `owner="${e.owner}"`,
+    `author="${e.author}"`,
+    `created="${e.createdAt}"`,
+    `updated="${e.updatedAt}"`,
+    `locked="${e.locked}"`,
+    `location="${e.location}"`,
+    `priority="${e.priority}"`
+  ].join(' ');
+  return `<content ${attrs}>\n${e.markup}\n</content>`;
+}).join('\n');
+
+export default async ({ rootDir, id, name, location, priority, markup }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!id){
+    return [{ code: 400, msg: 'Global content ID is required' }, null];
+  }
+
+  const filePath = join(rootDir, GLOBAL_FILE);
+  if(!existsSync(filePath)){
+    return [{ code: 404, msg: 'Global content not found' }, null];
+  }
+
+  const raw = await readFile(filePath, 'utf-8');
+  const entries = parseEntries(raw);
+  const idx = entries.findIndex(e => e.id === id);
+
+  if(idx === -1){
+    return [{ code: 404, msg: 'Global content not found' }, null];
+  }
+
+  if(entries[idx].locked){
+    return [{ code: 403, msg: 'This global content is locked and cannot be edited' }, null];
+  }
+
+  const now = new Date().toISOString();
+  if(name !== undefined) entries[idx].name = name;
+  if(location !== undefined) entries[idx].location = location;
+  if(priority !== undefined) entries[idx].priority = parseInt(priority, 10);
+  if(markup !== undefined) entries[idx].markup = markup;
+  entries[idx].updatedAt = now;
+
+  await writeFile(filePath, serializeEntries(entries) + '\n', 'utf-8');
+
+  return [null, { id, updatedAt: now }];
+};

package/server/utils/groups/addUserToGroup.js

@@ -0,0 +1,46 @@
+import crypto from 'crypto';
+import db from '../../db/index.js';
+import { userGroup } from '../../db/schema.js';
+import { eq, and } from 'drizzle-orm';
+
+export default async (userId, groupName) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+  
+  if(!groupName){
+    return [{ code: 400, msg: 'Group name is required' }, null];
+  }
+  
+  try {
+    const [existing] = await db
+      .select()
+      .from(userGroup)
+      .where(and(
+        eq(userGroup.userId, userId),
+        eq(userGroup.groupName, groupName)
+      ))
+      .limit(1);
+
+    if(existing){
+      return [null, existing];
+    }
+
+    const [result] = await db
+      .insert(userGroup)
+      .values({
+        id: crypto.randomBytes(16).toString('base64url'),
+        userId,
+        groupName,
+        createdAt: new Date()
+      })
+      .returning();
+
+    return [null, result];
+  } catch(error){
+    if(error.code === '23505'){
+      return [{ code: 409, msg: 'User is already in this group' }, null];
+    }
+    return [{ code: 500, msg: 'Failed to add user to group' }, null];
+  }
+};

package/server/utils/groups/createGroup.js

@@ -0,0 +1,32 @@
+import db from '../../db/index.js';
+import { group } from '../../db/schema.js';
+
+export default async ({ name, description, owner }) => {
+  if(!name){
+    return [{ code: 400, msg: 'Group name is required' }, null];
+  }
+
+  if(!owner){
+    return [{ code: 400, msg: 'Group owner is required' }, null];
+  }
+
+  try {
+    const [result] = await db
+      .insert(group)
+      .values({
+        name,
+        description,
+        owner,
+        createdAt: new Date(),
+        updatedAt: new Date()
+      })
+      .returning();
+    
+    return [null, result];
+  } catch(error){
+    if(error.code === '23505'){
+      return [{ code: 409, msg: 'Group name already exists' }, null];
+    }
+    return [{ code: 500, msg: 'Failed to create group' }, null];
+  }
+};