minutework 0.1.40 → 0.1.42

package/assets/templates/vuilder-shell/src/lib/app-routes.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+
+import { appRoutes } from "@/lib/app-routes";
+
+describe("appRoutes", () => {
+  it("builds a blog route from a single slug segment", () => {
+    expect(appRoutes.blogPost("launching-the-combined-web-starter")).toBe(
+      "/blog/launching-the-combined-web-starter",
+    );
+    expect(appRoutes.blogPost(["launching-the-combined-web-starter"])).toBe(
+      "/blog/launching-the-combined-web-starter",
+    );
+  });
+
+  it("rejects multi-segment blog slugs instead of truncating them", () => {
+    expect(() => appRoutes.blogPost(["release", "v1"])).toThrow(
+      "Blog routes require exactly one slug segment.",
+    );
+  });
+
+  it("builds branded workspace shell routes", () => {
+    expect(appRoutes.workspaceConnect("fleet-alpha")).toBe("/w/fleet-alpha/connect");
+    expect(appRoutes.workspaceShell(["fleet alpha"])).toBe("/w/fleet%20alpha");
+    expect(appRoutes.loginForWorkspace("fleet-alpha")).toBe(
+      "/login?return_to=%2Fw%2Ffleet-alpha",
+    );
+    expect(appRoutes.loginForWorkspaceConnect("fleet-alpha")).toBe(
+      "/login?return_to=%2Fw%2Ffleet-alpha%2Fconnect",
+    );
+  });
+
+  it("rejects ambiguous workspace route segments", () => {
+    expect(() => appRoutes.workspaceShell(["fleet", "alpha"])).toThrow(
+      "Workspace routes require exactly one slug segment.",
+    );
+  });
+});

package/assets/templates/vuilder-shell/src/lib/app-routes.ts

@@ -0,0 +1,86 @@
+import type { Route } from "next";
+
+function joinRouteSegments(segments: readonly string[]) {
+  return segments.map((segment) => encodeURIComponent(segment)).join("/");
+}
+
+function requireSingleRouteSegment(
+  slug: string | readonly string[],
+  routeLabel: string,
+) {
+  if (typeof slug === "string") {
+    const segment = slug.trim();
+
+    if (segment.length === 0) {
+      throw new Error(`${routeLabel} require a non-empty slug segment.`);
+    }
+
+    return segment;
+  }
+
+  if (slug.length !== 1) {
+    throw new Error(`${routeLabel} require exactly one slug segment.`);
+  }
+
+  const [segment] = slug;
+  const normalizedSegment = segment?.trim();
+
+  if (!normalizedSegment) {
+    throw new Error(`${routeLabel} require a non-empty slug segment.`);
+  }
+
+  return normalizedSegment;
+}
+
+const publicHomeRoute: Route = "/";
+const pricingRoute: Route = "/pricing";
+const docsIndexRoute: Route = "/docs";
+const blogIndexRoute: Route = "/blog";
+const loginRoute: Route = "/login";
+const appHomeRoute: Route = "/app";
+const demoRoute = "/app/demo" as Route;
+
+function loginWithReturnTo(returnTo: Route) {
+  const params = new URLSearchParams({ return_to: returnTo });
+  return `${loginRoute}?${params.toString()}` as Route;
+}
+
+function workspaceShellRoute(workspaceSlug: string | readonly string[]) {
+  return `/w/${encodeURIComponent(
+    requireSingleRouteSegment(workspaceSlug, "Workspace routes"),
+  )}` as Route;
+}
+
+function workspaceConnectRoute(workspaceSlug: string | readonly string[]) {
+  return `${workspaceShellRoute(workspaceSlug)}/connect` as Route;
+}
+
+export const appRoutes = {
+  publicHome: publicHomeRoute,
+  pricing: pricingRoute,
+  docsIndex: docsIndexRoute,
+  docsPage(slugParts: readonly string[]) {
+    return `/docs/${joinRouteSegments(slugParts)}` as Route;
+  },
+  blogIndex: blogIndexRoute,
+  blogPost(slug: string | readonly string[]) {
+    return `/blog/${encodeURIComponent(
+      requireSingleRouteSegment(slug, "Blog routes"),
+    )}` as Route;
+  },
+  login: loginRoute,
+  loginForWorkspace(workspaceSlug: string | readonly string[]) {
+    return loginWithReturnTo(workspaceShellRoute(workspaceSlug));
+  },
+  loginForWorkspaceConnect(workspaceSlug: string | readonly string[]) {
+    return loginWithReturnTo(workspaceConnectRoute(workspaceSlug));
+  },
+  appHome: appHomeRoute,
+  demo: demoRoute,
+  workspaceShell(workspaceSlug: string | readonly string[]) {
+    return workspaceShellRoute(workspaceSlug);
+  },
+  workspaceConnect(workspaceSlug: string | readonly string[]) {
+    return workspaceConnectRoute(workspaceSlug);
+  },
+};

package/assets/templates/vuilder-shell/src/lib/auth-routes.server.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it } from "vitest";
+
+import { buildCentralSsoLoginUrl, buildShellAbsoluteUrl } from "@/lib/auth-routes.server";
+
+describe("auth route helpers", () => {
+  it("builds an SSO login URL that returns to the requested workspace path", () => {
+    expect(buildCentralSsoLoginUrl("/w/fleet-alpha/connect", "state-1")).toBe(
+      "http://127.0.0.1:3400/login?returnTo=http%3A%2F%2F127.0.0.1%3A3301%2Fw%2Ffleet-alpha%2Fconnect%3Fmw_shell_state%3Dstate-1",
+    );
+  });
+
+  it("normalizes bare workspace returns to the connect route for shell handoff", () => {
+    expect(buildCentralSsoLoginUrl("/w/fleet-alpha", "state-1")).toBe(
+      "http://127.0.0.1:3400/login?returnTo=http%3A%2F%2F127.0.0.1%3A3301%2Fw%2Ffleet-alpha%2Fconnect%3Fmw_shell_state%3Dstate-1",
+    );
+  });
+
+  it("falls back to /app for unsafe return paths", () => {
+    expect(buildShellAbsoluteUrl("https://evil.example.com")).toBe(
+      "http://127.0.0.1:3301/app",
+    );
+    expect(buildShellAbsoluteUrl("//evil.example.com")).toBe(
+      "http://127.0.0.1:3301/app",
+    );
+  });
+});

package/assets/templates/vuilder-shell/src/lib/auth-routes.server.ts

@@ -0,0 +1,53 @@
+import "server-only";
+
+import type { Route } from "next";
+
+import { appRoutes } from "@/lib/app-routes";
+import { getEnv } from "@/lib/platform/env.server";
+
+const SHELL_HANDOFF_STATE_PARAM = "mw_shell_state";
+
+function normalizeShellReturnPath(value?: string | null): Route {
+  const candidate = String(value ?? "").trim();
+  if (!candidate || !candidate.startsWith("/") || candidate.startsWith("//")) {
+    return appRoutes.appHome;
+  }
+
+  try {
+    const parsed = new URL(candidate, "http://localhost");
+    if (parsed.origin !== "http://localhost" || !parsed.pathname.startsWith("/")) {
+      return appRoutes.appHome;
+    }
+    const segments = parsed.pathname.split("/").filter(Boolean);
+    if (segments.length === 2 && segments[0] === "w") {
+      const workspaceSlug = decodeURIComponent(segments[1] ?? "");
+      return `${appRoutes.workspaceConnect(workspaceSlug)}${parsed.search}${parsed.hash}` as Route;
+    }
+    return `${parsed.pathname}${parsed.search}${parsed.hash}` as Route;
+  } catch {
+    return appRoutes.appHome;
+  }
+}
+
+export function buildShellAbsoluteUrl(
+  path: string | null | undefined,
+  handoffState?: string | null,
+) {
+  const { MW_PUBLIC_BASE_URL } = getEnv();
+  const url = new URL(normalizeShellReturnPath(path), MW_PUBLIC_BASE_URL);
+  const normalizedState = String(handoffState ?? "").trim();
+  if (normalizedState) {
+    url.searchParams.set(SHELL_HANDOFF_STATE_PARAM, normalizedState);
+  }
+  return url.toString();
+}
+
+export function buildCentralSsoLoginUrl(
+  returnPath?: string | null,
+  handoffState?: string | null,
+) {
+  const { MW_AUTH_BASE_URL } = getEnv();
+  const url = new URL("/login", MW_AUTH_BASE_URL);
+  url.searchParams.set("returnTo", buildShellAbsoluteUrl(returnPath, handoffState));
+  return url.toString();
+}

package/assets/templates/vuilder-shell/src/lib/http/same-origin.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+
+import { hasTrustedBrowserOrigin } from "@/lib/http/same-origin";
+
+describe("hasTrustedBrowserOrigin", () => {
+  it("accepts a same-origin browser POST", () => {
+    const request = new Request("https://shell.example.com/api/auth/logout", {
+      method: "POST",
+      headers: { origin: "https://shell.example.com" },
+    });
+
+    expect(hasTrustedBrowserOrigin(request)).toBe(true);
+  });
+
+  it("rejects a cross-origin browser POST", () => {
+    const request = new Request("https://shell.example.com/api/auth/logout", {
+      method: "POST",
+      headers: { origin: "https://evil.example.com" },
+    });
+
+    expect(hasTrustedBrowserOrigin(request)).toBe(false);
+  });
+});

package/assets/templates/vuilder-shell/src/lib/http/same-origin.ts

@@ -0,0 +1,18 @@
+export function hasTrustedBrowserOrigin(request: Request) {
+  const requestOrigin = new URL(request.url).origin;
+  const origin = request.headers.get("origin");
+  if (origin) {
+    return origin === requestOrigin;
+  }
+
+  const referer = request.headers.get("referer");
+  if (referer) {
+    try {
+      return new URL(referer).origin === requestOrigin;
+    } catch {
+      return false;
+    }
+  }
+
+  return request.headers.get("sec-fetch-site") === "same-origin";
+}

package/assets/templates/vuilder-shell/src/lib/platform/client.server.test.ts

@@ -0,0 +1,201 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import {
+  exchangeVuilderShellSessionHandoffCode,
+  loadCurrentSession,
+  loadCurrentWorkspaceShellSession,
+  loadWorkspaceShellSession,
+  revokeVuilderShellSession,
+} from "@/lib/platform/client.server";
+
+function shellContext(overrides: Record<string, unknown> = {}) {
+  return {
+    allowed_entry_visibilities: ["client_safe", "member_only", "system"],
+    affordances: {
+      workspace_shell_open: true,
+    },
+    capabilities: {
+      channels: {
+        view: true,
+      },
+      threads: {
+        post: true,
+        view: true,
+      },
+    },
+    principal_kind: "tenant_member",
+    property_key: "",
+    role_slug: "member",
+    role_slugs: ["member"],
+    shadow_identity_ref: "",
+    stored_permissions: ["shell.channels.view", "shell.threads.view"],
+    tenant_id: "tenant-1",
+    thread_id: "",
+    user: {
+      avatar_url: "",
+      display_name: "Fleet Owner",
+      email: "owner@example.com",
+      id: "user-1",
+      username: "owner@example.com",
+    },
+    workspace_name: "Fleet Alpha",
+    workspace_slug: "fleet-alpha",
+    ...overrides,
+  };
+}
+
+describe("vuilder-shell platform client", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("loads shell context with the bounded shell-token header only", async () => {
+    const fetchMock = vi.fn<typeof fetch>(async () => {
+      return new Response(JSON.stringify(shellContext()), {
+        headers: { "content-type": "application/json" },
+        status: 200,
+      });
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await loadWorkspaceShellSession(
+      { shellSessionToken: "shell-token-1" },
+      "fleet-alpha",
+    );
+
+    expect(result.data.session.authenticated).toBe(true);
+    expect(result.data.membership?.workspace_slug).toBe("fleet-alpha");
+    expect(result.data.workspaceCanView).toBe(true);
+    expect(result.data.workspaceCanOpen).toBe(true);
+    const firstCall = fetchMock.mock.calls[0] as
+      | [RequestInfo | URL, RequestInit?]
+      | undefined;
+    expect(firstCall).toBeDefined();
+    const headers = firstCall?.[1]?.headers as Headers;
+    expect(headers.get("X-Vuilder-Shell-Session")).toBe("shell-token-1");
+    expect(headers.get("Cookie")).toBeNull();
+    expect(headers.get("X-CSRFToken")).toBeNull();
+  });
+
+  it("does not call platform when no shell token is present", async () => {
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await loadCurrentSession({ shellSessionToken: null });
+
+    expect(result.data).toEqual({ authenticated: false });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("exchanges handoff code without raw platform credentials", async () => {
+    const fetchMock = vi.fn<typeof fetch>(async () => {
+      return new Response(
+        JSON.stringify({
+          expires_at: "2026-06-09T00:00:00Z",
+          shell_context: shellContext(),
+          shell_session_token: "shell-token-1",
+        }),
+        {
+          headers: { "content-type": "application/json" },
+          status: 200,
+        },
+      );
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await exchangeVuilderShellSessionHandoffCode("code-1", "state-1");
+
+    expect(result.data.shell_session_token).toBe("shell-token-1");
+    const firstCall = fetchMock.mock.calls[0] as
+      | [RequestInfo | URL, RequestInit?]
+      | undefined;
+    expect(firstCall).toBeDefined();
+    const headers = firstCall?.[1]?.headers as Headers;
+    expect(headers.get("Cookie")).toBeNull();
+    expect(headers.get("X-CSRFToken")).toBeNull();
+    expect(headers.get("X-Vuilder-Shell-Session")).toBeNull();
+    expect(firstCall?.[1]?.body).toBe(
+      JSON.stringify({
+        shell_session_handoff_code: "code-1",
+        shell_state: "state-1",
+      }),
+    );
+  });
+
+  it("revokes a shell session through the bounded shell-token header", async () => {
+    const fetchMock = vi.fn<typeof fetch>(async () => {
+      return new Response(null, { status: 204 });
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    await revokeVuilderShellSession({ shellSessionToken: "shell-token-1" });
+
+    const firstCall = fetchMock.mock.calls[0] as
+      | [RequestInfo | URL, RequestInit?]
+      | undefined;
+    expect(firstCall).toBeDefined();
+    const headers = firstCall?.[1]?.headers as Headers;
+    expect(firstCall?.[1]?.method).toBe("POST");
+    expect(headers.get("X-Vuilder-Shell-Session")).toBe("shell-token-1");
+    expect(headers.get("Cookie")).toBeNull();
+    expect(headers.get("X-CSRFToken")).toBeNull();
+  });
+
+  it("keeps authenticated context but fails workspace view when capabilities are missing", async () => {
+    const fetchMock = vi.fn(async () => {
+      return new Response(
+        JSON.stringify(
+          shellContext({
+            capabilities: {
+              channels: { view: true },
+              threads: { post: false, view: false },
+            },
+          }),
+        ),
+        {
+          headers: { "content-type": "application/json" },
+          status: 200,
+        },
+      );
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await loadWorkspaceShellSession(
+      { shellSessionToken: "shell-token-1" },
+      "fleet-alpha",
+    );
+
+    expect(result.data.session.authenticated).toBe(true);
+    expect(result.data.membership?.workspace_slug).toBe("fleet-alpha");
+    expect(result.data.workspaceCanView).toBe(false);
+    expect(result.data.workspaceCanOpen).toBe(false);
+  });
+
+  it("loads the current shell workspace and preserves pending-open status", async () => {
+    const fetchMock = vi.fn(async () => {
+      return new Response(
+        JSON.stringify(
+          shellContext({
+            affordances: {
+              workspace_shell_open: false,
+            },
+          }),
+        ),
+        {
+          headers: { "content-type": "application/json" },
+          status: 200,
+        },
+      );
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await loadCurrentWorkspaceShellSession({
+      shellSessionToken: "shell-token-1",
+    });
+
+    expect(result.data.session.authenticated).toBe(true);
+    expect(result.data.membership?.workspace_slug).toBe("fleet-alpha");
+    expect(result.data.workspaceCanView).toBe(true);
+    expect(result.data.workspaceCanOpen).toBe(false);
+  });
+});