minutework 0.1.39 → 0.1.41

package/assets/templates/vuilder-shell/src/lib/http/same-origin.ts

@@ -0,0 +1,18 @@
+export function hasTrustedBrowserOrigin(request: Request) {
+  const requestOrigin = new URL(request.url).origin;
+  const origin = request.headers.get("origin");
+  if (origin) {
+    return origin === requestOrigin;
+  }
+
+  const referer = request.headers.get("referer");
+  if (referer) {
+    try {
+      return new URL(referer).origin === requestOrigin;
+    } catch {
+      return false;
+    }
+  }
+
+  return request.headers.get("sec-fetch-site") === "same-origin";
+}

package/assets/templates/vuilder-shell/src/lib/platform/client.server.test.ts

@@ -0,0 +1,201 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import {
+  exchangeVuilderShellSessionHandoffCode,
+  loadCurrentSession,
+  loadCurrentWorkspaceShellSession,
+  loadWorkspaceShellSession,
+  revokeVuilderShellSession,
+} from "@/lib/platform/client.server";
+
+function shellContext(overrides: Record<string, unknown> = {}) {
+  return {
+    allowed_entry_visibilities: ["client_safe", "member_only", "system"],
+    affordances: {
+      workspace_shell_open: true,
+    },
+    capabilities: {
+      channels: {
+        view: true,
+      },
+      threads: {
+        post: true,
+        view: true,
+      },
+    },
+    principal_kind: "tenant_member",
+    property_key: "",
+    role_slug: "member",
+    role_slugs: ["member"],
+    shadow_identity_ref: "",
+    stored_permissions: ["shell.channels.view", "shell.threads.view"],
+    tenant_id: "tenant-1",
+    thread_id: "",
+    user: {
+      avatar_url: "",
+      display_name: "Fleet Owner",
+      email: "owner@example.com",
+      id: "user-1",
+      username: "owner@example.com",
+    },
+    workspace_name: "Fleet Alpha",
+    workspace_slug: "fleet-alpha",
+    ...overrides,
+  };
+}
+
+describe("vuilder-shell platform client", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("loads shell context with the bounded shell-token header only", async () => {
+    const fetchMock = vi.fn<typeof fetch>(async () => {
+      return new Response(JSON.stringify(shellContext()), {
+        headers: { "content-type": "application/json" },
+        status: 200,
+      });
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await loadWorkspaceShellSession(
+      { shellSessionToken: "shell-token-1" },
+      "fleet-alpha",
+    );
+
+    expect(result.data.session.authenticated).toBe(true);
+    expect(result.data.membership?.workspace_slug).toBe("fleet-alpha");
+    expect(result.data.workspaceCanView).toBe(true);
+    expect(result.data.workspaceCanOpen).toBe(true);
+    const firstCall = fetchMock.mock.calls[0] as
+      | [RequestInfo | URL, RequestInit?]
+      | undefined;
+    expect(firstCall).toBeDefined();
+    const headers = firstCall?.[1]?.headers as Headers;
+    expect(headers.get("X-Vuilder-Shell-Session")).toBe("shell-token-1");
+    expect(headers.get("Cookie")).toBeNull();
+    expect(headers.get("X-CSRFToken")).toBeNull();
+  });
+
+  it("does not call platform when no shell token is present", async () => {
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await loadCurrentSession({ shellSessionToken: null });
+
+    expect(result.data).toEqual({ authenticated: false });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("exchanges handoff code without raw platform credentials", async () => {
+    const fetchMock = vi.fn<typeof fetch>(async () => {
+      return new Response(
+        JSON.stringify({
+          expires_at: "2026-06-09T00:00:00Z",
+          shell_context: shellContext(),
+          shell_session_token: "shell-token-1",
+        }),
+        {
+          headers: { "content-type": "application/json" },
+          status: 200,
+        },
+      );
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await exchangeVuilderShellSessionHandoffCode("code-1", "state-1");
+
+    expect(result.data.shell_session_token).toBe("shell-token-1");
+    const firstCall = fetchMock.mock.calls[0] as
+      | [RequestInfo | URL, RequestInit?]
+      | undefined;
+    expect(firstCall).toBeDefined();
+    const headers = firstCall?.[1]?.headers as Headers;
+    expect(headers.get("Cookie")).toBeNull();
+    expect(headers.get("X-CSRFToken")).toBeNull();
+    expect(headers.get("X-Vuilder-Shell-Session")).toBeNull();
+    expect(firstCall?.[1]?.body).toBe(
+      JSON.stringify({
+        shell_session_handoff_code: "code-1",
+        shell_state: "state-1",
+      }),
+    );
+  });
+
+  it("revokes a shell session through the bounded shell-token header", async () => {
+    const fetchMock = vi.fn<typeof fetch>(async () => {
+      return new Response(null, { status: 204 });
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    await revokeVuilderShellSession({ shellSessionToken: "shell-token-1" });
+
+    const firstCall = fetchMock.mock.calls[0] as
+      | [RequestInfo | URL, RequestInit?]
+      | undefined;
+    expect(firstCall).toBeDefined();
+    const headers = firstCall?.[1]?.headers as Headers;
+    expect(firstCall?.[1]?.method).toBe("POST");
+    expect(headers.get("X-Vuilder-Shell-Session")).toBe("shell-token-1");
+    expect(headers.get("Cookie")).toBeNull();
+    expect(headers.get("X-CSRFToken")).toBeNull();
+  });
+
+  it("keeps authenticated context but fails workspace view when capabilities are missing", async () => {
+    const fetchMock = vi.fn(async () => {
+      return new Response(
+        JSON.stringify(
+          shellContext({
+            capabilities: {
+              channels: { view: true },
+              threads: { post: false, view: false },
+            },
+          }),
+        ),
+        {
+          headers: { "content-type": "application/json" },
+          status: 200,
+        },
+      );
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await loadWorkspaceShellSession(
+      { shellSessionToken: "shell-token-1" },
+      "fleet-alpha",
+    );
+
+    expect(result.data.session.authenticated).toBe(true);
+    expect(result.data.membership?.workspace_slug).toBe("fleet-alpha");
+    expect(result.data.workspaceCanView).toBe(false);
+    expect(result.data.workspaceCanOpen).toBe(false);
+  });
+
+  it("loads the current shell workspace and preserves pending-open status", async () => {
+    const fetchMock = vi.fn(async () => {
+      return new Response(
+        JSON.stringify(
+          shellContext({
+            affordances: {
+              workspace_shell_open: false,
+            },
+          }),
+        ),
+        {
+          headers: { "content-type": "application/json" },
+          status: 200,
+        },
+      );
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await loadCurrentWorkspaceShellSession({
+      shellSessionToken: "shell-token-1",
+    });
+
+    expect(result.data.session.authenticated).toBe(true);
+    expect(result.data.membership?.workspace_slug).toBe("fleet-alpha");
+    expect(result.data.workspaceCanView).toBe(true);
+    expect(result.data.workspaceCanOpen).toBe(false);
+  });
+});