nolo-cli 0.1.23 → 0.1.29

package/share/server/listCommunityShares.ts

@@ -0,0 +1,167 @@
+import { ensureServerDbOpen } from "../../database/server/db";
+import { shareKey } from "../keys";
+import { normalizeUserId } from "../helpers";
+import {
+  jsonResponse,
+  errorResponse,
+  parseLimitParam,
+  parseCursorParam,
+  scanIndexToSummaries,
+  toShareSummary,
+} from "./helpers";
+import serverDb from "../../database/server/db";
+import { parseToken, verifyToken } from "../../auth/token";
+import { assertSessionTokenVersion } from "../../auth/sessionTokenVersion";
+import { DB_PREFIX } from "../../database/keys";
+
+type ShareListRequest = Request & {
+  params?: { userId?: string };
+};
+
+const getCoverSummaryOptions = (req: Request) => {
+  const url = new URL(req.url);
+  const coverImage = url.searchParams.get("coverImage");
+  const coverImageAsUrl = coverImage === "url";
+  return {
+    includeCoverImage: coverImage !== "0" && !coverImageAsUrl,
+    coverImageAsUrl,
+    coverImageBaseUrl: url.origin,
+  };
+};
+
+// ── List a specific creator's community shares ──────────────────────
+
+export const handleListCreatorCommunityShares = async (req: ShareListRequest) => {
+  const requestedUserId = normalizeUserId(req.params?.userId);
+  if (!requestedUserId) {
+    return errorResponse(400, "Invalid user id", "userId is required");
+  }
+
+  const limit = parseLimitParam(req.url);
+  const cursor = parseCursorParam(req.url);
+  const coverSummaryOptions = getCoverSummaryOptions(req);
+
+  try {
+    await ensureServerDbOpen();
+
+    const range = shareKey.communityCreatorRange(requestedUserId);
+    const result = await scanIndexToSummaries(range, limit, cursor, {
+      requireCommunity: true,
+      requireAuthorId: requestedUserId,
+      ...coverSummaryOptions,
+    });
+
+    // Fallback: full scan for legacy data without indexes
+    if (result.shares.length === 0 && !cursor) {
+      const shareRange = shareKey.range();
+      const legacyShares = [];
+      for await (const [dbKey, rawValue] of serverDb.iterator({
+        gte: shareRange.start,
+        lte: shareRange.end,
+      })) {
+        const summary = toShareSummary(dbKey, rawValue, {
+          requireCommunity: true,
+          requireAuthorId: requestedUserId,
+          ...coverSummaryOptions,
+        });
+        if (summary) legacyShares.push(summary);
+      }
+      legacyShares.sort((a, b) => b.createdAt - a.createdAt);
+      return jsonResponse({ data: legacyShares.slice(0, limit) });
+    }
+
+    return jsonResponse({
+      data: result.shares,
+      ...(result.nextCursor ? { nextCursor: result.nextCursor } : {}),
+    });
+  } catch (error: any) {
+    return errorResponse(500, "Internal Server Error", error?.message || "Failed to list shares");
+  }
+};
+
+// ── List all community shares (global feed) ─────────────────────────
+
+export const handleListAllCommunityShares = async (req: Request) => {
+  const limit = parseLimitParam(req.url);
+  const cursor = parseCursorParam(req.url);
+  const coverSummaryOptions = getCoverSummaryOptions(req);
+
+  try {
+    await ensureServerDbOpen();
+
+    const range = shareKey.communityAllRange();
+    const result = await scanIndexToSummaries(range, limit, cursor, {
+      requireCommunity: true,
+      ...coverSummaryOptions,
+    });
+
+    return jsonResponse({
+      data: result.shares,
+      ...(result.nextCursor ? { nextCursor: result.nextCursor } : {}),
+    });
+  } catch (error: any) {
+    return errorResponse(500, "Internal Server Error", error?.message || "Failed to list community shares");
+  }
+};
+
+// ── Authenticate request and return userId (null if invalid) ─────────
+
+const getAuthorizedUserId = async (req: Request): Promise<string | null> => {
+  const authHeader = (req as any).headers?.get?.("authorization");
+  const token = typeof authHeader === "string" ? authHeader.split(" ")[1] : "";
+  if (!token) return null;
+
+  const parsed = parseToken(token);
+  const userId = parsed?.userId;
+  if (!userId || typeof userId !== "string") return null;
+
+  try {
+    const user = await serverDb.get(`${DB_PREFIX.USER}${userId}`);
+    if (!user?.publicKey || user?.isDisabled) return null;
+
+    const payload = verifyToken(token, user.publicKey);
+    assertSessionTokenVersion(payload, user);
+    if (!payload || payload.userId !== userId) return null;
+    return userId;
+  } catch {
+    return null;
+  }
+};
+
+// ── List owner's shares (all visibilities, auth required) ───────────
+
+export const handleListOwnerShares = async (req: ShareListRequest) => {
+  const requestedUserId = normalizeUserId(req.params?.userId);
+  if (!requestedUserId) {
+    return errorResponse(400, "Invalid user id", "userId is required");
+  }
+
+  await ensureServerDbOpen();
+
+  const authedUserId = await getAuthorizedUserId(req);
+  if (!authedUserId) {
+    return errorResponse(401, "Unauthorized", "Authentication required");
+  }
+  if (authedUserId !== requestedUserId) {
+    return errorResponse(403, "Forbidden", "You can only list your own shares");
+  }
+
+  const limit = parseLimitParam(req.url);
+  const cursor = parseCursorParam(req.url);
+  const includeCoverImage = new URL(req.url).searchParams.get("coverImage") !== "0";
+
+  try {
+    const range = shareKey.ownerRange(requestedUserId);
+    const result = await scanIndexToSummaries(range, limit, cursor, {
+      requireAuthorId: requestedUserId,
+      includeCoverImage,
+    });
+
+    return jsonResponse({
+      data: result.shares,
+      ...(result.nextCursor ? { nextCursor: result.nextCursor } : {}),
+    });
+  } catch (error: any) {
+    return errorResponse(500, "Internal Server Error", error?.message || "Failed to list owner shares");
+  }
+};

package/share/server/purchaseDoc.ts

@@ -0,0 +1,224 @@
+/**
+ * 社区 Doc 购买接口
+ *
+ * POST /api/share/:token/purchase
+ *   - 验证身份 → 读取 share productId → 购买产品 → 写入 entitlement
+ *   - 免费 Doc（无 productId）直接返回 access: true
+ *
+ * GET /api/share/:token/access
+ *   - 检查当前用户是否有权访问（已购买或免费）
+ */
+
+import { handleToken } from "../../auth/server/token";
+import serverDb from "../../database/server/db";
+import { logger } from "../../auth/server/shared";
+import {
+  getProductPriceCredits,
+  hasActiveEntitlement,
+} from "../../auth/server/productEntitlements";
+import { purchaseProduct } from "../../auth/server/productPurchase";
+import { resolveSharePaidAccess } from "../paidAccess";
+
+const CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "POST, GET, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization",
+  "Content-Type": "application/json",
+};
+
+/** 从 URL 中提取 share token */
+const extractToken = (req: Request): string | null => {
+  const url = new URL(req.url);
+  const parts = url.pathname.split("/");
+  // /api/v1/share/:token/purchase  →  ["", "api", "v1", "share", token, ...]
+  return parts[4] ?? null;
+};
+
+/** 认证并返回 userId，无 token 时返回 null（不抛错） */
+async function authenticate(req: Request): Promise<string | null> {
+  const authReq: any = { headers: { get: (k: string) => req.headers.get(k) } };
+  // mock res：handleToken 在 token 缺失或无效时会调用 res.status().json()
+  // 我们用 mock 让它静默返回 null
+  const mockRes: any = {
+    status: () => ({ json: () => null }),
+  };
+  try {
+    const user = await handleToken(authReq, mockRes);
+    return user?.userId ?? null;
+  } catch {
+    return null;
+  }
+}
+
+// ── POST /api/share/:token/purchase ──────────────────────────────────
+
+export async function handlePurchaseDoc(req: Request): Promise<Response> {
+  try {
+    const userId = await authenticate(req);
+    if (!userId) {
+      return new Response(
+        JSON.stringify({ success: false, message: "未登录" }),
+        { status: 401, headers: CORS_HEADERS }
+      );
+    }
+
+    const token = extractToken(req);
+    if (!token) {
+      return new Response(
+        JSON.stringify({ success: false, message: "缺少 share token" }),
+        { status: 400, headers: CORS_HEADERS }
+      );
+    }
+
+    // 读取 share 记录
+    const shareDbKey = `share-${token}`;
+    let shareData: any;
+    try {
+      shareData = await serverDb.get(shareDbKey);
+    } catch {
+      return new Response(
+        JSON.stringify({ success: false, message: "分享不存在" }),
+        { status: 404, headers: CORS_HEADERS }
+      );
+    }
+
+    const paidAccess = resolveSharePaidAccess(shareData);
+    const authorId: string = shareData?.meta?.authorId ?? "";
+
+    // 免费内容直接放行
+    if (paidAccess.mode === "free") {
+      return new Response(
+        JSON.stringify({ success: true, access: true, paid: false, price: 0 }),
+        { headers: CORS_HEADERS }
+      );
+    }
+
+    const { productId } = paidAccess;
+
+    if (userId === authorId) {
+      return new Response(
+        JSON.stringify({ success: true, access: true, paid: false, ownContent: true }),
+        { headers: CORS_HEADERS }
+      );
+    }
+
+    const result = await purchaseProduct({ buyerId: userId, productId });
+    if (!result.success) {
+      const status =
+        result.status === "insufficient_funds"
+          ? 402
+          : result.status === "not_found"
+            ? 404
+            : result.status === "disabled"
+              ? 410
+              : 400;
+      return new Response(
+        JSON.stringify({
+          success: false,
+          message: result.error,
+          productId,
+          balance: result.balance,
+        }),
+        { status, headers: CORS_HEADERS }
+      );
+    }
+
+    logger.info({
+      event: "product_doc_purchased",
+      buyerId: userId,
+      authorId,
+      shareToken: token,
+      productId,
+      status: result.status,
+      txId: result.txId,
+    });
+
+    return new Response(
+      JSON.stringify({
+        success: true,
+        access: true,
+        paid: result.status !== "owner_access",
+        price: result.amountCredits ?? 0,
+        productId,
+        txId: result.txId,
+        alreadyPurchased: result.status === "already_entitled",
+      }),
+      { headers: CORS_HEADERS }
+    );
+  } catch (err: any) {
+    logger.error({ event: "purchase_doc_failed", error: err?.message });
+    return new Response(
+      JSON.stringify({ success: false, message: err?.message ?? "服务器错误" }),
+      { status: 500, headers: CORS_HEADERS }
+    );
+  }
+}
+
+// ── GET /api/share/:token/access ─────────────────────────────────────
+
+export async function handleCheckDocAccess(req: Request): Promise<Response> {
+  try {
+    const userId = await authenticate(req);
+    const token = extractToken(req);
+
+    if (!token) {
+      return new Response(
+        JSON.stringify({ success: false, message: "缺少 share token" }),
+        { status: 400, headers: CORS_HEADERS }
+      );
+    }
+
+    // 读取 share 记录获取价格
+    let shareData: any;
+    try {
+      shareData = await serverDb.get(`share-${token}`);
+    } catch {
+      return new Response(
+        JSON.stringify({ success: false, message: "分享不存在" }),
+        { status: 404, headers: CORS_HEADERS }
+      );
+    }
+
+    const paidAccess = resolveSharePaidAccess(shareData);
+    const authorId: string = shareData?.meta?.authorId ?? "";
+
+    // 免费内容无需鉴权
+    if (paidAccess.mode === "free") {
+      return new Response(
+        JSON.stringify({ access: true, price: 0 }),
+        { headers: CORS_HEADERS }
+      );
+    }
+
+    const { productId } = paidAccess;
+    const price = await getProductPriceCredits({ productId });
+
+    // 未登录用户只返回价格信息
+    if (!userId) {
+      return new Response(
+        JSON.stringify({ access: false, price, requiresLogin: true }),
+        { headers: CORS_HEADERS }
+      );
+    }
+
+    // 作者本人有权访问
+    if (userId === authorId) {
+      return new Response(
+        JSON.stringify({ access: true, price, ownContent: true }),
+        { headers: CORS_HEADERS }
+      );
+    }
+
+    const purchased = await hasActiveEntitlement({ userId, productId });
+    return new Response(
+      JSON.stringify({ access: purchased, price, productId, purchased }),
+      { headers: CORS_HEADERS }
+    );
+  } catch (err: any) {
+    logger.error({ event: "check_doc_access_failed", error: err?.message });
+    return new Response(
+      JSON.stringify({ success: false, message: err?.message ?? "服务器错误" }),
+      { status: 500, headers: CORS_HEADERS }
+    );
+  }
+}

package/share/server/readCommunityShareCover.ts

@@ -0,0 +1,73 @@
+import { Buffer } from "node:buffer";
+import { ensureServerDbOpen } from "../../database/server/db";
+import { shareKey } from "../keys";
+import { toSafeString } from "../helpers";
+import { errorResponse, readShareByDbKey } from "./helpers";
+
+type CommunityCoverRequest = Request & {
+  params?: { token?: string };
+};
+
+const CACHE_HEADERS = {
+  "Cache-Control": "public, max-age=31536000, immutable",
+};
+
+const parseDataUrl = (value: string): { mimeType: string; body: Buffer } | null => {
+  const match = value.match(/^data:([^;,]+)?(;base64)?,(.*)$/s);
+  if (!match) return null;
+
+  const mimeType = match[1] || "application/octet-stream";
+  const isBase64 = Boolean(match[2]);
+  const payload = match[3] || "";
+
+  try {
+    return {
+      mimeType,
+      body: isBase64
+        ? Buffer.from(payload, "base64")
+        : Buffer.from(decodeURIComponent(payload), "utf8"),
+    };
+  } catch {
+    return null;
+  }
+};
+
+export const handleReadCommunityShareCover = async (req: CommunityCoverRequest) => {
+  const token = toSafeString(req.params?.token);
+  if (!token) {
+    return errorResponse(400, "Invalid token", "token is required");
+  }
+
+  try {
+    await ensureServerDbOpen();
+
+    const rawShare = await readShareByDbKey(shareKey.create(token));
+    if (!rawShare || rawShare?.meta?.visibility !== "community") {
+      return errorResponse(404, "Not Found", "Community share cover not found");
+    }
+
+    const coverImage = toSafeString(rawShare?.meta?.coverImage);
+    if (!coverImage) {
+      return errorResponse(404, "Not Found", "Community share cover not found");
+    }
+
+    if (coverImage.startsWith("http://") || coverImage.startsWith("https://")) {
+      return Response.redirect(coverImage, 302);
+    }
+
+    const parsed = parseDataUrl(coverImage);
+    if (!parsed) {
+      return errorResponse(415, "Unsupported Media Type", "Unsupported cover image format");
+    }
+
+    return new Response(parsed.body, {
+      headers: {
+        ...CACHE_HEADERS,
+        "Content-Type": parsed.mimeType,
+        "Content-Length": String(parsed.body.length),
+      },
+    });
+  } catch (error: any) {
+    return errorResponse(500, "Internal Server Error", error?.message || "Failed to read share cover");
+  }
+};

package/share/server/readSharedTable.ts

@@ -0,0 +1,139 @@
+import serverDb from "../../database/server/db";
+import { rowKey } from "../../database/keys";
+import { DataType } from "../../create/types";
+import { isTombstoneRecord } from "../../database/tombstones";
+import { errorResponse, jsonResponse, readShareByDbKey } from "./helpers";
+
+const DEFAULT_ROW_LIMIT = 200;
+const extractToken = (req: Request): string | null => {
+  const parts = new URL(req.url).pathname.split("/");
+  return parts[4] ?? null;
+};
+
+const toLiveTableMetadata = (shareData: any) => {
+  if (!shareData || shareData.type !== DataType.TABLE) return null;
+
+  const mode =
+    typeof shareData?.data?.mode === "string"
+      ? shareData.data.mode
+      : typeof shareData?.meta?.mode === "string"
+        ? shareData.meta.mode
+        : null;
+  if (mode !== "live") return null;
+
+  const tableDbKey =
+    typeof shareData?.data?.tableDbKey === "string"
+      ? shareData.data.tableDbKey
+      : typeof shareData?.meta?.tableDbKey === "string"
+        ? shareData.meta.tableDbKey
+        : null;
+
+  return tableDbKey ? { tableDbKey } : null;
+};
+
+const normalizeOrigin = (value: unknown): string | null => {
+  if (typeof value !== "string" || value.trim().length === 0) return null;
+  try {
+    return new URL(value).origin.replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+};
+
+export interface SharedTablePreview {
+  tableMeta: Record<string, unknown>;
+  rows: Record<string, unknown>[];
+}
+
+interface ReadSharedTablePreviewOptions {
+  rowLimit?: number;
+  currentOrigin?: string;
+}
+
+const resolveRowLimit = (value: unknown): number | null => {
+  if (value === "all") return null;
+  const parsed =
+    typeof value === "string" && value.trim().length > 0
+      ? Number.parseInt(value, 10)
+      : typeof value === "number"
+        ? value
+        : Number.NaN;
+  if (!Number.isFinite(parsed) || parsed < 1) return DEFAULT_ROW_LIMIT;
+  return parsed;
+};
+
+export async function readSharedTablePreview(
+  token: string,
+  options: ReadSharedTablePreviewOptions = {}
+): Promise<SharedTablePreview | null> {
+  const rowLimit = resolveRowLimit(options.rowLimit);
+  const shareData = await readShareByDbKey(`share-${token}`);
+  if (!shareData || isTombstoneRecord(shareData)) return null;
+
+  const liveTable = toLiveTableMetadata(shareData);
+  if (!liveTable) return null;
+
+  const tableMeta = await readShareByDbKey(liveTable.tableDbKey);
+  if (tableMeta && !isTombstoneRecord(tableMeta)) {
+    const tenantId =
+      typeof tableMeta?.tenantId === "string" && tableMeta.tenantId.trim().length > 0
+        ? tableMeta.tenantId
+        : null;
+    const tableId =
+      typeof tableMeta?.tableId === "string" && tableMeta.tableId.trim().length > 0
+        ? tableMeta.tableId
+        : null;
+    if (!tenantId || !tableId) return null;
+
+    const rows: Record<string, unknown>[] = [];
+    const { gte, lte } = rowKey.range(tenantId, tableId);
+    for await (const [, value] of serverDb.iterator({ gte, lte })) {
+      if (value?.type === DataType.TABLE_ROW && !value?.deletedAt) {
+        rows.push(value);
+        if (rowLimit != null && rows.length >= rowLimit) break;
+      }
+    }
+
+    return { tableMeta, rows };
+  }
+
+  const originServer = normalizeOrigin(
+    shareData?.data?.originServer ?? shareData?.meta?.originServer
+  );
+  const currentOrigin = normalizeOrigin(options.currentOrigin);
+  if (!originServer || (currentOrigin && originServer === currentOrigin)) {
+    return null;
+  }
+
+  try {
+    const response = await fetch(
+      `${originServer}/api/v1/share/${encodeURIComponent(token)}/table?rowLimit=${rowLimit == null ? "all" : rowLimit}`
+    );
+    if (response.status !== 200) return null;
+    const payload = await response.json();
+    return payload?.tableMeta && Array.isArray(payload?.rows) ? payload : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function handleReadSharedTable(req: Request): Promise<Response> {
+  const token = extractToken(req);
+  if (!token) {
+    return errorResponse(400, "invalid_token", "缺少 share token");
+  }
+
+  try {
+    const url = new URL(req.url);
+    const preview = await readSharedTablePreview(token, {
+      currentOrigin: url.origin,
+      rowLimit: url.searchParams.get("rowLimit") ?? undefined,
+    });
+    if (!preview) {
+      return errorResponse(404, "table_preview_not_found", "未找到可预览的表格分享");
+    }
+    return jsonResponse(preview);
+  } catch (error: any) {
+    return errorResponse(500, "table_preview_failed", error?.message || "读取表格分享失败");
+  }
+}