ocean-brain 0.13.0 → 0.13.1

package/server/dist/modules/auth-guard.js

@@ -1,76 +1,57 @@
 import { buildUnauthorizedGraphqlPayload, buildUnauthorizedPayload } from "@baejino/auth";
-import session from "express-session";
 import { GraphQLError } from "graphql";
-import lusca from "lusca";
 import { sanitizeRedirectPath } from "./auth-redirect.js";
-import { AUTH_SESSION_IDLE_TIMEOUT_MS, createSessionStore } from "./session-store.js";
 const JSON_HEADERS = { "Content-Type": "application/json" };
-const isAuthenticatedRequest = (req) => Boolean(req.session?.authenticated);
-const createSessionMiddleware = (authConfig) => {
+const CSRF_COOKIE_NAME = "XSRF-TOKEN";
+const isAuthenticatedRequest = (request) => Boolean(request.session?.authenticated);
+const issueCsrfToken = (authConfig, reply) => {
   if (authConfig.mode !== "password") {
-    return (_req, _res, next) => next();
+    return void 0;
   }
-  return session({
-    secret: authConfig.sessionSecret,
-    name: authConfig.cookieName,
-    store: createSessionStore(),
-    resave: false,
-    saveUninitialized: false,
-    rolling: true,
-    cookie: {
-      maxAge: AUTH_SESSION_IDLE_TIMEOUT_MS,
-      httpOnly: true,
-      sameSite: "lax",
-      secure: process.env.NODE_ENV === "production",
-      path: "/"
-    }
+  const token = reply.generateCsrf();
+  reply.setCookie(CSRF_COOKIE_NAME, token, {
+    httpOnly: false,
+    path: "/",
+    sameSite: "lax",
+    secure: process.env.NODE_ENV === "production"
   });
+  return token;
 };
 const createCsrfProtection = (authConfig) => {
   if (authConfig.mode !== "password") {
-    return (_req, _res, next) => next();
+    return (_request, _reply, done) => done();
   }
-  return lusca.csrf({
-    angular: true,
-    cookie: {
-      options: {
-        path: "/",
-        sameSite: "lax",
-        secure: process.env.NODE_ENV === "production"
-      }
-    }
-  });
-};
-const isCsrfTokenError = (error) => error instanceof Error && error.message.startsWith("CSRF token ");
-const buildLoginRedirectPath = (req) => {
-  const nextPath = sanitizeRedirectPath(req.body?.next);
-  return `/login?next=${encodeURIComponent(nextPath)}`;
-};
-const createLoginCsrfFailureHandler = (authConfig) => {
-  return (error, req, res, next) => {
-    if (authConfig.mode !== "password" || !isCsrfTokenError(error) || req.method !== "POST" || req.path !== "/login" || isAuthenticatedRequest(req)) {
-      next(error);
+  return (request, reply, done) => {
+    if (request.method === "GET" || request.method === "HEAD" || request.method === "OPTIONS") {
+      done();
       return;
     }
-    res.redirect(303, buildLoginRedirectPath(req));
+    request.server.csrfProtection(request, reply, done);
   };
 };
+const isCsrfTokenError = (error) => error instanceof Error && ("code" in error ? error.code === "FST_CSRF_INVALID_TOKEN" || error.code === "FST_CSRF_MISSING_SECRET" : error.message.toLowerCase().includes("csrf"));
+const buildLoginCsrfRedirectPath = (request) => {
+  const body = request.body;
+  const nextPath = sanitizeRedirectPath(body?.next);
+  return `/login?next=${encodeURIComponent(nextPath)}`;
+};
+const shouldRedirectLoginCsrfFailure = (error, request, authConfig) => authConfig.mode === "password" && isCsrfTokenError(error) && request.method === "POST" && request.url.split("?")[0] === "/login" && !isAuthenticatedRequest(request);
 const requireSessionForWrite = (authConfig) => {
-  return (req, res, next) => {
-    if (authConfig.mode === "open" || isAuthenticatedRequest(req)) {
-      next();
+  return (request, reply, done) => {
+    if (authConfig.mode === "open" || isAuthenticatedRequest(request)) {
+      done();
       return;
     }
-    res.status(401).set(JSON_HEADERS).json(buildUnauthorizedPayload()).end();
+    void reply.code(401).headers(JSON_HEADERS).send(buildUnauthorizedPayload());
   };
 };
 const requireSessionForGraphql = (authConfig) => {
-  return (req, res, next) => {
-    if (authConfig.mode === "open" || isAuthenticatedRequest(req)) {
-      next();
+  return (request, reply, done) => {
+    if (authConfig.mode === "open" || isAuthenticatedRequest(request)) {
+      done();
       return;
     }
-    res.status(401).set(JSON_HEADERS).json(buildUnauthorizedGraphqlPayload()).end();
+    void reply.code(401).headers(JSON_HEADERS).send(buildUnauthorizedGraphqlPayload());
   };
 };
 const createMutationAuthValidationRule = () => {
@@ -94,11 +75,13 @@ const createMutationAuthValidationRule = () => {
   };
 };
 export {
+  buildLoginCsrfRedirectPath,
   createCsrfProtection,
-  createLoginCsrfFailureHandler,
   createMutationAuthValidationRule,
-  createSessionMiddleware,
   isAuthenticatedRequest,
+  isCsrfTokenError,
+  issueCsrfToken,
   requireSessionForGraphql,
-  requireSessionForWrite
+  requireSessionForWrite,
+  shouldRedirectLoginCsrfFailure
 };

package/server/dist/modules/blocknote.js

@@ -83,10 +83,12 @@ function mapBlockContent(content, mapInline) {
     ...content,
     rows: content.rows?.map((row) => ({
       ...row,
-      cells: row.cells?.map((cell) => ({
-        ...cell,
-        content: cell.content?.map(mapInline)
-      }))
+      cells: row.cells?.map(
+        (cell) => Array.isArray(cell) ? cell.map(mapInline) : {
+          ...cell,
+          content: cell.content?.map(mapInline)
+        }
+      )
     }))
   };
 }
@@ -103,10 +105,15 @@ async function mapBlockContentAsync(content, mapInline) {
       (content.rows ?? []).map(async (row) => ({
         ...row,
         cells: await Promise.all(
-          (row.cells ?? []).map(async (cell) => ({
-            ...cell,
-            content: cell.content ? (await Promise.all(cell.content.map(mapInline))).flat() : cell.content
-          }))
+          (row.cells ?? []).map(async (cell) => {
+            if (Array.isArray(cell)) {
+              return (await Promise.all(cell.map(mapInline))).flat();
+            }
+            return {
+              ...cell,
+              content: cell.content ? (await Promise.all(cell.content.map(mapInline))).flat() : cell.content
+            };
+          })
         )
       }))
     )
@@ -124,7 +131,7 @@ function visitBlockContent(content, visitInline) {
   }
   for (const row of content.rows ?? []) {
     for (const cell of row.cells ?? []) {
-      for (const inline of cell.content ?? []) {
+      for (const inline of Array.isArray(cell) ? cell : cell.content ?? []) {
         visitInline(inline);
       }
     }

package/server/dist/modules/error-handler.js

@@ -1,3 +1,4 @@
+import { buildLoginCsrfRedirectPath, isCsrfTokenError, shouldRedirectLoginCsrfFailure } from "./auth-guard.js";
 class AppError extends Error {
   code;
   status;
@@ -13,42 +14,38 @@ class AppError extends Error {
 const createAppError = (status, code, message, details) => {
   return new AppError(status, code, message, details);
 };
-const hasErrorType = (error, type) => error instanceof Error && "type" in error && error.type === type;
-const createErrorHandler = () => {
-  return (error, _req, res, next) => {
-    if (res.headersSent) {
-      next(error);
+const createErrorHandler = (authConfig) => {
+  return (error, request, reply) => {
+    if (reply.sent) {
+      request.log.error({ error }, "Error occurred after the response was sent");
+      return;
+    }
+    if (shouldRedirectLoginCsrfFailure(error, request, authConfig)) {
+      void reply.redirect(buildLoginCsrfRedirectPath(request), 303);
       return;
     }
     if (error instanceof AppError) {
-      res.status(error.status).json({
+      void reply.status(error.status).send({
         code: error.code,
         message: error.message,
         ...error.details ? { details: error.details } : {}
-      }).end();
-      return;
-    }
-    if (hasErrorType(error, "encoding.unsupported")) {
-      res.status(415).json({
-        code: "UNSUPPORTED_CONTENT_ENCODING",
-        message: "Compressed request bodies are not supported."
-      }).end();
+      });
       return;
     }
-    if (error instanceof Error && error.message.startsWith("CSRF token ")) {
-      res.status(403).json({
+    if (isCsrfTokenError(error)) {
+      void reply.status(403).send({
         code: "CSRF_TOKEN_INVALID",
-        message: error.message
-      }).end();
+        message: error instanceof Error ? error.message : "Invalid CSRF token"
+      });
       return;
     }
     const message = error instanceof Error ? error.stack || error.message : String(error);
     process.stderr.write(`[error] ${message}
 `);
-    res.status(500).json({
+    void reply.status(500).send({
       code: "INTERNAL_SERVER_ERROR",
       message: "Internal Server Error"
-    }).end();
+    });
   };
 };
 export {

package/server/dist/modules/mcp-auth.js

@@ -44,64 +44,58 @@ const readBearerToken = (authorizationHeader) => {
   return authorizationHeader.slice("Bearer ".length).trim() || void 0;
 };
 const createMcpAuthMiddleware = (_authConfig, mcpAdminAuth) => {
-  return async (req, res, next) => {
-    try {
-      const status = await mcpAdminAuth.getStatus();
-      if (!status.enabled) {
-        res.status(403).set(JSON_HEADERS).json({
-          code: "MCP_DISABLED",
-          message: "MCP access is disabled by admin."
-        }).end();
-        return;
-      }
-      const bearerToken = readBearerToken(req.headers.authorization);
-      if (!bearerToken) {
-        res.status(401).set(JSON_HEADERS).json({
-          code: "UNAUTHORIZED",
-          message: "A valid MCP bearer token is required."
-        }).end();
-        return;
-      }
-      const validation = await mcpAdminAuth.validatePresentedToken(bearerToken);
-      if (!validation.ok && validation.reason === "not_configured") {
-        res.status(503).set(JSON_HEADERS).json({
-          code: "MCP_AUTH_NOT_CONFIGURED",
-          message: "MCP bearer auth is not configured."
-        }).end();
-        return;
-      }
-      if (!validation.ok) {
-        res.status(403).set(JSON_HEADERS).json({
-          code: "FORBIDDEN",
-          message: "Invalid MCP bearer token."
-        }).end();
-        return;
-      }
-      const versionInfo = getOceanBrainVersionInfo();
-      const mcpCompatibilityVersion = readMcpCompatibilityVersion(req);
-      const mcpClientVersion = readMcpClientVersion(req);
-      if (!mcpCompatibilityVersion || !isMcpVersionCompatible(versionInfo.mcp.compatibilityVersion, mcpCompatibilityVersion)) {
-        res.status(426).set(JSON_HEADERS).json({
-          code: "MCP_VERSION_INCOMPATIBLE",
-          message: createMcpVersionCompatibilityMessage({
-            serverVersion: versionInfo.version,
-            requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,
-            mcpCompatibilityVersion,
-            mcpClientVersion
-          }),
+  return async (req, reply) => {
+    const status = await mcpAdminAuth.getStatus();
+    if (!status.enabled) {
+      await reply.status(403).headers(JSON_HEADERS).send({
+        code: "MCP_DISABLED",
+        message: "MCP access is disabled by admin."
+      });
+      return;
+    }
+    const bearerToken = readBearerToken(req.headers.authorization);
+    if (!bearerToken) {
+      await reply.status(401).headers(JSON_HEADERS).send({
+        code: "UNAUTHORIZED",
+        message: "A valid MCP bearer token is required."
+      });
+      return;
+    }
+    const validation = await mcpAdminAuth.validatePresentedToken(bearerToken);
+    if (!validation.ok && validation.reason === "not_configured") {
+      await reply.status(503).headers(JSON_HEADERS).send({
+        code: "MCP_AUTH_NOT_CONFIGURED",
+        message: "MCP bearer auth is not configured."
+      });
+      return;
+    }
+    if (!validation.ok) {
+      await reply.status(403).headers(JSON_HEADERS).send({
+        code: "FORBIDDEN",
+        message: "Invalid MCP bearer token."
+      });
+      return;
+    }
+    const versionInfo = getOceanBrainVersionInfo();
+    const mcpCompatibilityVersion = readMcpCompatibilityVersion(req);
+    const mcpClientVersion = readMcpClientVersion(req);
+    if (!mcpCompatibilityVersion || !isMcpVersionCompatible(versionInfo.mcp.compatibilityVersion, mcpCompatibilityVersion)) {
+      await reply.status(426).headers(JSON_HEADERS).send({
+        code: "MCP_VERSION_INCOMPATIBLE",
+        message: createMcpVersionCompatibilityMessage({
           serverVersion: versionInfo.version,
-          mcpVersion: mcpClientVersion ?? mcpCompatibilityVersion ?? null,
-          mcpClientVersion: mcpClientVersion ?? null,
-          mcpCompatibilityVersion: mcpCompatibilityVersion ?? null,
-          requiredMcpVersion: versionInfo.mcpVersionRequirement,
           requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,
-          releaseUrl: versionInfo.releaseUrl
-        }).end();
-        return;
-      }
-      next();
-    } catch (error) {
-      next(error);
+          mcpCompatibilityVersion,
+          mcpClientVersion
+        }),
+        serverVersion: versionInfo.version,
+        mcpVersion: mcpClientVersion ?? mcpCompatibilityVersion ?? null,
+        mcpClientVersion: mcpClientVersion ?? null,
+        mcpCompatibilityVersion: mcpCompatibilityVersion ?? null,
+        requiredMcpVersion: versionInfo.mcpVersionRequirement,
+        requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,
+        releaseUrl: versionInfo.releaseUrl
+      });
     }
   };
 };

package/server/dist/modules/rate-limit.js

@@ -1,31 +1,31 @@
-import { rateLimit } from "express-rate-limit";
+import { isAuthenticatedRequest } from "./auth-guard.js";
+import { createAppError } from "./error-handler.js";
 const AUTH_RATE_LIMIT_MESSAGE = "Too many authentication attempts. Please try again later.";
 const SESSION_ACCESS_RATE_LIMIT_MESSAGE = "Too many authenticated requests. Please try again later.";
-const createAuthAttemptRateLimit = () => rateLimit({
-  windowMs: 15 * 60 * 1e3,
-  limit: 10,
-  standardHeaders: true,
-  legacyHeaders: false,
-  handler: (_req, res) => {
-    res.status(429).json({
-      code: "AUTH_RATE_LIMITED",
-      message: AUTH_RATE_LIMIT_MESSAGE
-    });
-  }
+const IMAGE_ASSET_RATE_LIMIT_MESSAGE = "Too many image asset requests. Please try again later.";
+const createOptions = (max, timeWindow, code, message, options = {}) => ({
+  max,
+  timeWindow,
+  hook: "preHandler",
+  enableDraftSpec: true,
+  errorResponseBuilder: (_request, context) => createAppError(context.statusCode, code, message),
+  ...options
 });
-const createSessionAccessRateLimit = () => rateLimit({
-  windowMs: 60 * 1e3,
-  limit: 300,
-  standardHeaders: true,
-  legacyHeaders: false,
-  handler: (_req, res) => {
-    res.status(429).json({
-      code: "SESSION_RATE_LIMITED",
-      message: SESSION_ACCESS_RATE_LIMIT_MESSAGE
-    });
-  }
+const createAuthAttemptRateLimit = () => createOptions(10, 15 * 60 * 1e3, "AUTH_RATE_LIMITED", AUTH_RATE_LIMIT_MESSAGE, {
+  groupId: "auth-attempt"
+});
+const createSessionAccessRateLimit = () => createOptions(300, 60 * 1e3, "SESSION_RATE_LIMITED", SESSION_ACCESS_RATE_LIMIT_MESSAGE, {
+  groupId: "session-access"
+});
+const createImageAssetRateLimit = (authConfig) => ({
+  ...createOptions(10, 15 * 60 * 1e3, "IMAGE_ASSET_RATE_LIMITED", IMAGE_ASSET_RATE_LIMIT_MESSAGE, {
+    groupId: "image-asset",
+    allowList: (request) => authConfig.mode !== "password" || isAuthenticatedRequest(request)
+  }),
+  hook: "onRequest"
 });
 export {
   createAuthAttemptRateLimit,
+  createImageAssetRateLimit,
   createSessionAccessRateLimit
 };

package/server/dist/modules/server-events-handler.js

@@ -12,23 +12,25 @@ const getEventStreamLifetimeMs = (expires) => {
   return Math.max(0, Math.min(expiresAt.getTime() - Date.now(), AUTH_SESSION_IDLE_TIMEOUT_MS));
 };
 const createServerEventsHandler = () => {
-  return async (req, res) => {
-    res.status(200);
-    res.setHeader("Content-Type", "text/event-stream; charset=utf-8");
-    res.setHeader("Cache-Control", "no-cache, no-transform");
-    res.setHeader("Connection", "keep-alive");
-    res.setHeader("X-Accel-Buffering", "no");
-    res.flushHeaders?.();
-    res.write(": connected\n\n");
+  return async (req, reply) => {
+    reply.hijack();
+    const response = reply.raw;
+    response.statusCode = 200;
+    response.setHeader("Content-Type", "text/event-stream; charset=utf-8");
+    response.setHeader("Cache-Control", "no-cache, no-transform");
+    response.setHeader("Connection", "keep-alive");
+    response.setHeader("X-Accel-Buffering", "no");
+    response.flushHeaders();
+    response.write(": connected\n\n");
     const unsubscribe = subscribeServerEvents((event) => {
-      res.write(serializeServerEvent(event));
+      response.write(serializeServerEvent(event));
     });
     const keepAliveTimer = setInterval(() => {
-      res.write(": keepalive\n\n");
+      response.write(": keepalive\n\n");
     }, KEEP_ALIVE_INTERVAL_MS);
     keepAliveTimer.unref?.();
     const sessionExpiryTimer = setTimeout(() => {
-      res.end();
+      response.end();
     }, getEventStreamLifetimeMs(req.session?.cookie.expires));
     sessionExpiryTimer.unref?.();
     let cleanedUp = false;
@@ -41,8 +43,8 @@ const createServerEventsHandler = () => {
       clearTimeout(sessionExpiryTimer);
       unsubscribe();
     };
-    req.on("close", cleanup);
-    res.on("close", cleanup);
+    req.raw.on("close", cleanup);
+    response.on("close", cleanup);
   };
 };
 export {

package/server/dist/modules/session-store.js

@@ -1,4 +1,3 @@
-import session from "express-session";
 const AUTH_SESSION_IDLE_TIMEOUT_MS = 7 * 24 * 60 * 60 * 1e3;
 const ANONYMOUS_SESSION_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
 const AUTH_SESSION_PRUNE_INTERVAL_MS = 60 * 60 * 1e3;
@@ -25,9 +24,8 @@ const getSessionExpiry = (data, now = Date.now()) => {
   }
   return fallbackExpiresAt;
 };
-class TtlMemorySessionStore extends session.Store {
+class TtlMemorySessionStore {
   constructor(options = {}) {
-    super();
     this.options = options;
     this.pruneTimer = setInterval(() => {
       this.pruneExpiredSessions();
@@ -54,7 +52,7 @@ class TtlMemorySessionStore extends session.Store {
       callback(error);
     }
   }
-  set(sid, data, callback) {
+  set(sid, data, callback = () => void 0) {
     try {
       const now = Date.now();
       this.sessions.set(sid, {
@@ -65,14 +63,14 @@ class TtlMemorySessionStore extends session.Store {
       });
       this.pruneExpiredSessions();
       this.evictOldestSessions();
-      callback?.();
+      callback();
     } catch (error) {
-      callback?.(error);
+      callback(error);
     }
   }
-  destroy(sid, callback) {
+  destroy(sid, callback = () => void 0) {
     this.sessions.delete(sid);
-    callback?.();
+    callback();
   }
   touch(sid, data, callback) {
     const entry = this.sessions.get(sid);

package/server/dist/paths.js

@@ -6,9 +6,10 @@ const DATA_DIR = process.env.OCEAN_BRAIN_DATA_DIR || ".";
 const IMAGE_DIR = process.env.OCEAN_BRAIN_IMAGE_DIR || path.resolve(DATA_DIR, "assets/images");
 const SEARCH_INDEX_PATH = process.env.OCEAN_BRAIN_SEARCH_INDEX_PATH || path.resolve(DATA_DIR, "search.sqlite3");
 const EMBEDDING_API_KEY_PATH = path.resolve(DATA_DIR, "embedding-api-key");
+const CLIENT_DIST = process.env.OCEAN_BRAIN_CLIENT_DIST || path.resolve(PACKAGE_ROOT, "client/dist");
 const paths = {
   packageRoot: path.resolve(PACKAGE_ROOT),
-  clientDist: path.resolve(PACKAGE_ROOT, "client/dist"),
+  clientDist: path.resolve(CLIENT_DIST),
   imageDir: path.resolve(IMAGE_DIR),
   searchIndex: path.resolve(SEARCH_INDEX_PATH),
   embeddingApiKey: path.resolve(EMBEDDING_API_KEY_PATH)