nolo-cli 0.1.26 → 0.1.30

package/server/apiRouteAdapter.ts

@@ -0,0 +1,218 @@
+import {
+  createApiError,
+  isApiError,
+  serializeApiError,
+  type ApiContext,
+  type ApiMethod,
+  type ApiProcedure,
+} from "./apiContract";
+
+const JSON_HEADERS: Record<string, string> = {
+  "Content-Type": "application/json",
+};
+
+const CORS_HEADERS: Record<string, string> = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization",
+};
+
+const CORS_MAX_AGE = "86400";
+
+const json = (payload: unknown, status: number, enableCors: boolean) =>
+  new Response(JSON.stringify(payload), {
+    status,
+    headers: {
+      ...JSON_HEADERS,
+      ...(enableCors ? CORS_HEADERS : {}),
+    },
+  });
+
+const nextRequestId = () =>
+  `api-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+
+async function parseInput(req: Request, method: ApiMethod): Promise<unknown> {
+  if (method === "GET") {
+    return Object.fromEntries(new URL(req.url).searchParams);
+  }
+
+  try {
+    return await req.json();
+  } catch {
+    throw createApiError({
+      code: "invalid_input",
+      message: "Request body must be valid JSON",
+      status: 400,
+    });
+  }
+}
+
+function contextFromRequest(req: Request): ApiContext {
+  const authHeader = req.headers.get("authorization") || undefined;
+  const token = authHeader?.startsWith("Bearer ")
+    ? authHeader.slice("Bearer ".length)
+    : authHeader;
+  return {
+    requestId: req.headers.get("x-request-id") || nextRequestId(),
+    ...(token ? { token } : {}),
+  };
+}
+
+function normalizedError(error: unknown) {
+  if (isApiError(error)) return error;
+  return createApiError({
+    code: "internal",
+    message: error instanceof Error ? error.message : "Internal API error",
+    status: 500,
+  });
+}
+
+export type ApiRouteEntry = Partial<Record<ApiMethod, ApiLegacyRouteHandler>> & {
+  OPTIONS?: () => Response;
+};
+
+export function createApiRoute<TInput, TOutput>(
+  procedure: ApiProcedure<TInput, TOutput>,
+  options: { enableCors?: boolean } = {}
+): ApiRouteEntry {
+  const enableCors = options.enableCors ?? true;
+  const handler = async (req: Request): Promise<Response> => {
+    try {
+      const rawInput = await parseInput(req, procedure.method);
+      const input = procedure.input.safeParse(rawInput);
+      if (!input.success) {
+        const error = createApiError({
+          code: "invalid_input",
+          message: "Request input failed validation",
+          status: 400,
+          details: { issues: input.error.issues },
+        });
+        return json(
+          { ok: false, error: serializeApiError(error) },
+          error.status,
+          enableCors
+        );
+      }
+
+      const result = await procedure.handler({
+        input: input.data,
+        context: contextFromRequest(req),
+        request: req,
+      });
+
+      if (!result.ok) {
+        return json(
+          { ok: false, error: serializeApiError(result.error) },
+          result.error.status,
+          enableCors
+        );
+      }
+
+      const output = procedure.output.safeParse(result.data);
+      if (!output.success) {
+        const error = createApiError({
+          code: "invalid_output",
+          message: "Handler output failed validation",
+          status: 500,
+          details: { issues: output.error.issues },
+        });
+        return json(
+          { ok: false, error: serializeApiError(error) },
+          error.status,
+          enableCors
+        );
+      }
+
+      return json({ ok: true, data: output.data }, 200, enableCors);
+    } catch (error) {
+      const apiError = normalizedError(error);
+      return json(
+        { ok: false, error: serializeApiError(apiError) },
+        apiError.status,
+        enableCors
+      );
+    }
+  };
+
+  return {
+    [procedure.method]: handler,
+    OPTIONS: () =>
+      new Response(null, {
+        status: 204,
+        headers: {
+          ...(enableCors ? CORS_HEADERS : {}),
+          "Access-Control-Allow-Methods": `${procedure.method}, OPTIONS`,
+          "Access-Control-Max-Age": CORS_MAX_AGE,
+        },
+      }),
+  };
+}
+
+export type ApiLegacyRouteHandler = (req: Request) => Response | Promise<Response>;
+
+export interface ApiRouteFamilyConfig {
+  path: string;
+  handlers: Partial<Record<ApiMethod, ApiLegacyRouteHandler>>;
+  allowedMethods?: string[];
+  enableCors?: boolean;
+  corsHeaders?: Record<string, string>;
+  wrapCorsResponses?: boolean;
+}
+
+function withCorsResponseHeaders(
+  handler: ApiLegacyRouteHandler,
+  corsHeaders: Record<string, string>
+): ApiLegacyRouteHandler {
+  return async (req: Request) => {
+    const response = await handler(req);
+    const headers = new Headers(response.headers);
+    for (const [key, value] of Object.entries(corsHeaders)) {
+      if (!headers.has(key)) headers.set(key, value);
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers,
+    });
+  };
+}
+
+export function createApiRouteFamily(
+  configs: ApiRouteFamilyConfig[]
+): Record<string, ApiRouteEntry> {
+  return Object.fromEntries(
+    configs.map((config) => {
+      const enableCors = config.enableCors ?? true;
+      const corsHeaders = config.corsHeaders ?? CORS_HEADERS;
+      const handlers = config.wrapCorsResponses
+        ? Object.fromEntries(
+            Object.entries(config.handlers).map(([method, handler]) => [
+              method,
+              handler
+                ? withCorsResponseHeaders(handler, corsHeaders)
+                : handler,
+            ])
+          )
+        : config.handlers;
+      const methods = config.allowedMethods ?? [
+        ...(Object.keys(config.handlers) as ApiMethod[]),
+        "OPTIONS",
+      ];
+      return [
+        config.path,
+        {
+          ...handlers,
+          OPTIONS: () =>
+            new Response(null, {
+              status: 204,
+              headers: {
+                ...(enableCors ? corsHeaders : {}),
+                "Access-Control-Allow-Methods": methods.join(", "),
+                "Access-Control-Max-Age":
+                  corsHeaders["Access-Control-Max-Age"] ?? CORS_MAX_AGE,
+              },
+            }),
+        },
+      ];
+    })
+  );
+}

package/server/appBundler.ts

@@ -0,0 +1,90 @@
+// packages/server/appBundler.ts
+// 服务端 esbuild 打包：将多文件用户代码打包成单一 CF Worker / Bun Worker 兼容 bundle
+// 使用 Bun.build（内置，零依赖）
+
+import { join } from "path";
+import { tmpdir } from "os";
+import { writeFile, unlink, mkdir } from "fs/promises";
+import {
+  normalizeBundleRelativePath,
+  resolveSafeTempFile,
+} from "./safeTempFile";
+
+export interface BundleFile {
+  name: string;   // 文件名，如 "index.ts" 或 "utils/helper.ts"
+  code: string;
+}
+
+export interface BundleResult {
+  code: string;           // 打包后的单文件代码
+  warnings: string[];
+}
+
+/**
+ * 将多个文件打包成单一 ESM Worker bundle
+ * - 入口文件：files 中 name 为 "index.ts" / "index.js" / "main.ts" / "worker.ts" 的文件
+ * - 目标：browser（CF Workers 是 WinterCG，与 browser 兼容）
+ * - 格式：ESM，保留 export default { fetch }
+ */
+export async function bundleWorkerCode(files: BundleFile[]): Promise<BundleResult> {
+  if (files.length === 0) throw new Error("至少需要一个文件");
+
+  const normalizedFiles = files.map((file) => ({
+    ...file,
+    name: normalizeBundleRelativePath(file.name),
+  }));
+
+  // 单文件直接返回，无需打包
+  if (normalizedFiles.length === 1) {
+    return { code: normalizedFiles[0].code, warnings: [] };
+  }
+
+  // 找入口文件
+  const ENTRY_NAMES = ["index.ts", "index.js", "main.ts", "main.js", "worker.ts", "worker.js"];
+  const entry =
+    normalizedFiles.find((f) => ENTRY_NAMES.includes(f.name.toLowerCase())) ??
+    normalizedFiles[0];
+
+  // 写入临时目录。追加随机后缀，避免并发打包在同一毫秒撞到同一路径。
+  const tmpSuffix = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const tmpDir = join(tmpdir(), `nolo-bundle-${tmpSuffix}`);
+  await mkdir(tmpDir, { recursive: true });
+
+  const writtenFiles: string[] = [];
+  try {
+    for (const file of normalizedFiles) {
+      const { absolutePath, dir } = resolveSafeTempFile(tmpDir, file.name);
+      if (dir !== tmpDir) await mkdir(dir, { recursive: true });
+      await writeFile(absolutePath, file.code, "utf-8");
+      writtenFiles.push(absolutePath);
+    }
+
+    const entryPath = resolveSafeTempFile(tmpDir, entry.name).absolutePath;
+    const result = await Bun.build({
+      entrypoints: [entryPath],
+      target: "browser",   // CF Workers / WinterCG 兼容
+      format: "esm",
+      minify: false,        // 保持可读，便于调试
+      sourcemap: "none",
+    });
+
+    if (!result.success) {
+      const errs = result.logs.map((l) => l.message).join("\n");
+      throw new Error(`打包失败:\n${errs}`);
+    }
+
+    const output = result.outputs[0];
+    const code = await output.text();
+    const warnings = result.logs
+      .filter((l) => l.level === "warning")
+      .map((l) => l.message);
+
+    return { code, warnings };
+  } finally {
+    // 清理临时文件
+    await Promise.all(writtenFiles.map((f) => unlink(f).catch(() => {})));
+    import("fs").then(({ rmSync }) => {
+      try { rmSync(tmpDir, { recursive: true, force: true }); } catch { }
+    }).catch(() => {});
+  }
+}

package/server/appRoutes.ts

@@ -0,0 +1,92 @@
+import {
+  handleAppDeploy,
+  handleAppPreflight,
+  handleAppDeployStatus,
+  handleAppList,
+  handleAppDelete,
+  handleAppGet,
+  handleAppShare,
+  handleAppPrepareEdit,
+} from "./handlers/appDeployHandler";
+import {
+  handleAppDomainBind,
+  handleAppDomainUnbind,
+  handleAppDomainList,
+} from "./handlers/appDomainHandler";
+import { CORS_HEADERS_AUTH } from "../auth/utils";
+import { createApiRouteFamily } from "./apiRouteAdapter";
+import type { ApiMethod } from "./apiContract";
+
+const APP_API_PREFIX = "/api/app";
+
+export const appApiRoutes = createApiRouteFamily([
+  {
+    path: "/api/app/deploy",
+    handlers: { POST: handleAppDeploy },
+    corsHeaders: CORS_HEADERS_AUTH,
+  },
+  {
+    path: "/api/app/preflight",
+    handlers: { POST: handleAppPreflight },
+    corsHeaders: CORS_HEADERS_AUTH,
+  },
+  {
+    path: "/api/app/deploy/status",
+    handlers: { POST: handleAppDeployStatus },
+    corsHeaders: CORS_HEADERS_AUTH,
+  },
+  {
+    path: "/api/app/list",
+    handlers: { POST: handleAppList },
+    corsHeaders: CORS_HEADERS_AUTH,
+  },
+  {
+    path: "/api/app/delete",
+    handlers: { POST: handleAppDelete },
+    corsHeaders: CORS_HEADERS_AUTH,
+  },
+  {
+    path: "/api/app/get",
+    handlers: { GET: handleAppGet, POST: handleAppGet },
+    corsHeaders: CORS_HEADERS_AUTH,
+  },
+  {
+    path: "/api/app/prepare-edit",
+    handlers: { POST: handleAppPrepareEdit },
+    corsHeaders: CORS_HEADERS_AUTH,
+  },
+  {
+    path: "/api/app/share",
+    handlers: { POST: handleAppShare },
+    corsHeaders: CORS_HEADERS_AUTH,
+  },
+  {
+    path: "/api/app/domain/bind",
+    handlers: { POST: handleAppDomainBind },
+    corsHeaders: CORS_HEADERS_AUTH,
+  },
+  {
+    path: "/api/app/domain/unbind",
+    handlers: { POST: handleAppDomainUnbind },
+    corsHeaders: CORS_HEADERS_AUTH,
+  },
+  {
+    path: "/api/app/domain/list",
+    handlers: {
+      GET: handleAppDomainList,
+      POST: handleAppDomainList,
+    },
+    corsHeaders: CORS_HEADERS_AUTH,
+  },
+]);
+
+export async function handleAppApiRequest(req: Request, url: URL): Promise<Response | undefined> {
+  if (!url.pathname.startsWith(APP_API_PREFIX)) return undefined;
+
+  const handlers = appApiRoutes[url.pathname];
+  const method = req.method.toUpperCase() as ApiMethod;
+  const handler = handlers?.[method];
+
+  if (!handler) return undefined;
+  return handler(req);
+}

package/server/artifactIconsRoute.ts

@@ -0,0 +1,89 @@
+const LU_ICON_RE = /^Lu[A-Z][A-Za-z0-9]*$/;
+const MAX_ICON_COUNT = 32;
+
+let luIconSourcePromise: Promise<string> | null = null;
+
+function readLuIconSource() {
+  luIconSourcePromise ??= Bun.file("node_modules/react-icons/lu/index.mjs").text();
+  return luIconSourcePromise;
+}
+
+function extractIconDefinition(source: string, name: string) {
+  const re = new RegExp(
+    `export function ${name}\\s*\\(props\\)\\s*\\{\\s*return GenIcon\\(([\\s\\S]*?)\\)\\(props\\);\\s*\\};`
+  );
+  return source.match(re)?.[1] || null;
+}
+
+function createIconModule(definitions: Array<{ name: string; data: string }>) {
+  const exports = definitions
+    .map(({ name, data }) => `export const ${name} = GenIcon(${data});`)
+    .join("\n");
+
+  return `
+const React = globalThis.React;
+function GenIcon(data) {
+  return function Icon(props = {}) {
+    const { children, size = "1em", color = "currentColor", title, ...rest } = props;
+    const renderNode = (node, index) => React.createElement(
+      node.tag,
+      {
+        key: index,
+        ...(node.attr || {}),
+      },
+      ...(node.child || []).map(renderNode)
+    );
+    return React.createElement(
+      data.tag,
+      {
+        ...(data.attr || {}),
+        width: size,
+        height: size,
+        color,
+        ...rest,
+      },
+      title ? React.createElement("title", null, title) : null,
+      ...(data.child || []).map(renderNode),
+      children
+    );
+  };
+}
+${exports}
+`;
+}
+
+export async function artifactIconsRoute(req: Request) {
+  const url = new URL(req.url);
+  const names = Array.from(
+    new Set(
+      (url.searchParams.get("names") || "")
+        .split(",")
+        .map((name) => name.trim())
+        .filter((name) => LU_ICON_RE.test(name))
+    )
+  )
+    .sort()
+    .slice(0, MAX_ICON_COUNT);
+
+  if (names.length === 0) {
+    return new Response("export {};\n", {
+      headers: {
+        "content-type": "application/javascript; charset=utf-8",
+        "cache-control": "public, max-age=31536000, immutable",
+      },
+    });
+  }
+
+  const source = await readLuIconSource();
+  const definitions = names.flatMap((name) => {
+    const data = extractIconDefinition(source, name);
+    return data ? [{ name, data }] : [];
+  });
+
+  return new Response(createIconModule(definitions), {
+    headers: {
+      "content-type": "application/javascript; charset=utf-8",
+      "cache-control": "public, max-age=31536000, immutable",
+    },
+  });
+}

package/server/artifactRuntimeRoute.ts

@@ -0,0 +1,136 @@
+import { isProduction } from "../app/utils/env";
+import { readBuildInfo } from "./devBuildInfo";
+import { resolvePublicPath } from "./publicPaths";
+
+const createCspNonce = () =>
+  Buffer.from(crypto.getRandomValues(new Uint8Array(16))).toString("base64");
+
+type ArtifactRuntimeAssets = {
+  scriptSrc: string;
+  modulePreloads: string[];
+};
+
+const escapeHtmlAttr = (value: string) =>
+  value
+    .replace(/&/g, "&")
+    .replace(/"/g, """)
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+
+export const readArtifactRuntimeAsset = async () => {
+  if (!isProduction) {
+    const info = await readBuildInfo();
+    const version = info?.version ? `?v=${encodeURIComponent(info.version)}` : "";
+    return `/public/assets/artifactRuntime.js${version}`;
+  }
+
+  try {
+    const assets = JSON.parse(
+      await Bun.file(resolvePublicPath("latest-assets.json")).text()
+    );
+    return assets.artifactRuntimeJs || "/public/assets/artifactRuntime.js";
+  } catch {
+    return "/public/assets/artifactRuntime.js";
+  }
+};
+
+export const readArtifactRuntimeAssets = async (): Promise<ArtifactRuntimeAssets> => {
+  const scriptSrc = await readArtifactRuntimeAsset();
+
+  if (!isProduction) {
+    return { scriptSrc, modulePreloads: [] };
+  }
+
+  try {
+    const assets = JSON.parse(
+      await Bun.file(resolvePublicPath("latest-assets.json")).text()
+    );
+    const staticImports = Array.isArray(assets.artifactRuntimePreloads)
+      ? assets.artifactRuntimePreloads.filter((item: unknown) => typeof item === "string")
+      : [];
+    return {
+      scriptSrc,
+      modulePreloads: Array.from(new Set([scriptSrc, ...staticImports])),
+    };
+  } catch {
+    return { scriptSrc, modulePreloads: [scriptSrc] };
+  }
+};
+
+export const artifactRuntimeScriptRoute = async (req: Request) => {
+  const scriptSrc = await readArtifactRuntimeAsset();
+  const normalized = scriptSrc.replace(/^\/public\//, "").replace(/\?.*$/, "");
+  const file = Bun.file(resolvePublicPath(normalized));
+
+  if (!(await file.exists())) {
+    return new Response("Not Found", { status: 404 });
+  }
+
+  const stat = await file.stat();
+  const etag = `"${stat.size}-${stat.mtimeMs}"`;
+  const headers = {
+    "content-type": "text/javascript; charset=utf-8",
+    "cache-control": isProduction
+      ? "public, max-age=60, stale-while-revalidate=3600"
+      : "no-cache",
+    etag,
+    "last-modified": stat.mtime.toUTCString(),
+    "access-control-allow-origin": "*",
+    "cross-origin-resource-policy": "cross-origin",
+  };
+
+  if (
+    req.headers.get("if-none-match") === etag ||
+    req.headers.get("if-modified-since") === headers["last-modified"]
+  ) {
+    return new Response(null, { status: 304, headers });
+  }
+
+  return new Response(req.method === "HEAD" ? null : await file.bytes(), {
+    headers: {
+      ...headers,
+      "content-length": String(stat.size),
+    },
+  });
+};
+
+export const artifactRuntimeRoute = async () => {
+  const nonce = createCspNonce();
+  const { scriptSrc, modulePreloads } = await readArtifactRuntimeAssets();
+  const csp = [
+    `script-src 'self' 'nonce-${nonce}' blob: 'unsafe-eval'`,
+    "worker-src 'self' blob:",
+    "object-src 'none'",
+    "base-uri 'none'",
+    "frame-ancestors 'self'",
+  ].join("; ");
+  const preloadTags = modulePreloads
+    .map(
+      (href) =>
+        `  <link nonce="${nonce}" rel="modulepreload" href="${escapeHtmlAttr(href)}" />`
+    )
+    .join("\n");
+
+  return new Response(
+    `<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Artifact Runtime</title>
+${preloadTags}
+</head>
+<body>
+  <div id="root"></div>
+  <script nonce="${nonce}" type="module" src="${escapeHtmlAttr(scriptSrc)}"></script>
+</body>
+</html>`,
+    {
+      headers: {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-cache",
+        "content-security-policy": csp,
+      },
+    }
+  );
+};

package/server/authenticateToken.ts

@@ -0,0 +1,73 @@
+import { assertSessionTokenVersion } from "../auth/sessionTokenVersion";
+import { parseToken, verifyToken } from "../auth/token";
+import { DB_PREFIX } from "../database/keys";
+import serverDb from "../database/server/db";
+import type { ApiError } from "./api/types";
+
+const unauthorized = (message: string): ApiError => ({
+  code: "unauthorized",
+  message,
+});
+
+const isOutsideTokenWindow = (payload: any): boolean => {
+  const now = Date.now();
+
+  if (payload?.exp != null) {
+    const expMs =
+      typeof payload.exp === "number"
+        ? payload.exp * 1000
+        : new Date(payload.exp).getTime();
+    if (Number.isFinite(expMs) && now > expMs) return true;
+  }
+
+  if (payload?.nbf != null) {
+    const nbfMs =
+      typeof payload.nbf === "number"
+        ? payload.nbf * 1000
+        : new Date(payload.nbf).getTime();
+    if (Number.isFinite(nbfMs) && now < nbfMs) return true;
+  }
+
+  return false;
+};
+
+export async function authenticateToken(token?: string | null): Promise<{
+  userId: string;
+  payload: any;
+}> {
+  if (!token) {
+    throw unauthorized("Authentication required");
+  }
+
+  const parsed = parseToken(token);
+  const userId = parsed?.userId;
+  if (!userId || typeof userId !== "string") {
+    throw unauthorized("Invalid token payload");
+  }
+
+  let user: any;
+  try {
+    user = await serverDb.get(`${DB_PREFIX.USER}${userId}`);
+  } catch {
+    throw unauthorized("User not found");
+  }
+
+  if (!user?.publicKey || user?.isDisabled) {
+    throw unauthorized("User is not allowed");
+  }
+
+  try {
+    const payload = verifyToken(token, user.publicKey);
+    assertSessionTokenVersion(payload, user);
+    if (!payload || payload.userId !== userId) {
+      throw unauthorized("Invalid token subject");
+    }
+    if (isOutsideTokenWindow(payload)) {
+      throw unauthorized("Token has expired");
+    }
+    return { userId, payload };
+  } catch (error: any) {
+    if (error?.code === "unauthorized") throw error;
+    throw unauthorized(error?.message || "Invalid token");
+  }
+}