ocean-brain 0.7.4 → 0.8.0

package/server/client/dist/assets/trash-C5ntddLu.js

@@ -0,0 +1 @@
+import{j as e}from"./note-vendor-DkYKUmLo.js";import{Y as Q,j as F,aF as M,k as L,G as _,a5 as I,b1 as K,q as i,ao as E,b2 as B,N as O,b3 as G,P as w,Q as Y,T as d,aG as H,B as b,Z as W,b4 as $,i as l,m as z,d as U,ak as V,u as Z,b5 as J,M as y}from"./index-VHp17GQX.js";import{a as k}from"./graph-vendor-UTvF2NS_.js";import{S as C}from"./SurfaceCard-CNSQfYfM.js";import"./note-core-BklwyZHk.js";const m=25,v=F(M),S=30,R=`Deleted notes stay here for ${S} days before permanent removal`,g={title:"Permanently delete note?",description:"This note is referenced by the notes below. If you permanently delete it, those links will stay broken. Other notes will not be edited automatically.",confirmLabel:"Delete now",confirmVariant:"danger"},P=s=>U(s).format("YYYY-MM-DD HH:mm"),X=({note:s,onClose:o})=>{const a=s?.id??"",c=s?.title||"Untitled note",r=Z({queryKey:i.notes.trashDetail(a),enabled:!!s,queryFn:async()=>{const h=await J(a);if(h.type==="error")throw h;if(!h.trashedNote)throw new Error("Trashed note not found");return h.trashedNote}}),f=r.data?.contentAsMarkdown.trim()??"";return e.jsxs(y,{isOpen:!!s,onClose:o,variant:"inspect",children:[e.jsx(y.Header,{title:c,onClose:o}),e.jsx(y.Body,{children:e.jsxs("div",{className:"flex flex-col gap-3",children:[s&&e.jsxs(d,{as:"p",variant:"meta",tone:"secondary",children:["Deleted ",P(s.deletedAt)]}),r.isLoading&&e.jsx(d,{as:"p",variant:"meta",tone:"secondary",children:"Loading deleted note content..."}),r.isError&&e.jsx(d,{as:"p",variant:"meta",tone:"error",children:"Failed to load deleted note content."}),!r.isLoading&&!r.isError&&f&&e.jsx("pre",{className:"max-h-[60vh] overflow-auto whitespace-pre-wrap break-words rounded-[14px] border border-border-subtle bg-hover-subtle/50 px-4 py-3 text-sm leading-6 text-fg-secondary",children:f}),!r.isLoading&&!r.isError&&!f&&e.jsx(d,{as:"p",variant:"meta",tone:"secondary",className:"rounded-[14px] border border-border-subtle bg-hover-subtle/50 px-4 py-3",children:"No readable content was found for this deleted note."})]})}),e.jsx(y.Footer,{children:e.jsx(b,{variant:"ghost",size:"sm",onClick:o,children:"Close"})})]})},ee=()=>e.jsx(w,{title:"Trash",variant:"default",heading:e.jsx(l,{width:118,height:24,className:"rounded-full"}),description:e.jsx(l,{width:352,height:16,className:"rounded-full"}),children:e.jsx("div",{className:"grid gap-3",children:Array.from({length:3},(s,o)=>e.jsx(C,{padding:"compact",children:e.jsxs("div",{className:"flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between",children:[e.jsxs("div",{className:"min-w-0 flex-1 space-y-2",children:[e.jsx(l,{width:"40%",height:18,className:"rounded-full"}),e.jsxs("div",{className:"flex flex-wrap gap-2",children:[e.jsx(l,{width:168,height:14,className:"rounded-full"}),e.jsx(l,{width:176,height:14,className:"rounded-full"})]}),e.jsxs("div",{className:"flex flex-wrap gap-2",children:[e.jsx(l,{width:56,height:24,className:"rounded-full"}),e.jsx(l,{width:72,height:24,className:"rounded-full"})]})]}),e.jsx(l,{width:92,height:32,className:"rounded-[12px]"})]})},o))})}),te=()=>{const{page:s}=v.useSearch(),o=v.useNavigate(),a=L(),c=z(),r=_(),[f,h]=k.useState(null),[x,j]=k.useState(null),{data:u}=I({queryKey:i.notes.trash({limit:m,offset:(s-1)*m}),queryFn:async()=>{const t=await K({limit:m,offset:(s-1)*m});if(t.type==="error")throw t;return t.trashedNotes}}),N=E({mutationFn:B,onSuccess:async t=>{if(t.type==="error")throw t;await Promise.all([a.invalidateQueries({queryKey:i.notes.all(),exact:!1}),a.invalidateQueries({queryKey:i.tags.all(),exact:!1}),a.invalidateQueries({queryKey:i.reminders.all(),exact:!1}),a.invalidateQueries({queryKey:i.images.all(),exact:!1}),a.invalidateQueries({queryKey:i.calendar.all(),exact:!1})]),c("The note has been restored."),o({to:O,params:{id:t.restoreTrashedNote.id}})},onError:()=>{c("Failed to restore the note.")}}),p=E({mutationFn:G,onSuccess:async t=>{if(t.type==="error")throw t;await a.invalidateQueries({queryKey:i.notes.trashAll(),exact:!1}),c("The note has been permanently deleted.")},onError:()=>{c("Failed to permanently delete the note.")}}),D=()=>{if(!x)return;const{id:t}=x;j(null),p.mutate(t)},q=async t=>{const n=await V(t);if(n.type==="error"){c("Failed to check linked notes before permanently deleting this note.");return}if(a.setQueryData(i.notes.backReferences(t),n.backReferences),n.backReferences.length>0){j({id:t,backReferences:n.backReferences});return}await r("Permanently delete this note? This cannot be undone.")&&p.mutate(t)},T=u.totalCount>0?`Trash (${u.totalCount})`:void 0,A=u.notes.find(t=>t.id===f)??null;return u.notes.length===0?e.jsx(w,{title:"Trash",variant:"default",heading:T,description:R,children:e.jsx(Y,{title:"Trash is empty",description:`Delete a note and you can restore it here for ${S} days before permanent removal`})}):e.jsxs(w,{title:"Trash",variant:"default",heading:T,description:R,children:[e.jsxs("div",{className:"flex flex-col gap-4",children:[e.jsx("div",{className:"grid gap-3",children:u.notes.map(t=>e.jsx(C,{padding:"compact",children:e.jsxs("div",{className:"flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between",children:[e.jsxs("div",{className:"min-w-0 flex-1",children:[e.jsxs("div",{className:"flex min-w-0 items-start gap-1.5",children:[e.jsx(d,{as:"h2",variant:"body",weight:"medium",className:"min-w-0 flex-1 break-words leading-[1.25]",children:t.title||"Untitled note"}),t.pinned&&e.jsx("span",{title:"Pinned",className:"inline-flex h-5 w-5 shrink-0 items-center justify-center text-fg-tertiary",children:e.jsx(H,{className:"h-3.5 w-3.5"})})]}),e.jsx("div",{className:"mt-1 flex flex-wrap items-center gap-x-3 gap-y-1",children:e.jsxs(d,{as:"div",variant:"meta",weight:"medium",tone:"secondary",children:["Deleted ",P(t.deletedAt)]})}),t.tagNames.length>0&&e.jsx("div",{className:"mt-2 flex flex-wrap gap-1.5",children:t.tagNames.map(n=>e.jsx(d,{as:"span",variant:"label",weight:"medium",tone:"tertiary",className:"rounded-full border border-border-subtle bg-hover-subtle px-2 py-0.5",children:n},`${t.id}-${n}`))}),t.contentPreview&&e.jsx("div",{className:"mt-3 rounded-[14px] border border-border-subtle bg-hover-subtle/50 px-3 py-2",children:e.jsx(d,{as:"p",variant:"meta",tone:"secondary",className:"line-clamp-3 whitespace-pre-wrap break-words",children:t.contentPreview})})]}),e.jsxs("div",{className:"flex shrink-0 flex-wrap gap-2 sm:justify-end",children:[e.jsx(b,{variant:"subtle",size:"sm",onClick:()=>h(t.id),children:"View content"}),e.jsx(b,{variant:"subtle",size:"sm",isLoading:N.isPending&&N.variables===t.id,onClick:()=>N.mutate(t.id),children:"Restore"}),e.jsx(b,{variant:"soft-danger",size:"sm",isLoading:p.isPending&&p.variables===t.id,onClick:()=>q(t.id),children:"Delete now"})]})]})},t.id))}),u.totalCount>m&&e.jsx(W,{page:s,last:Math.ceil(u.totalCount/m),onChange:t=>{o({search:n=>({...n,page:t})})}})]}),e.jsx(X,{note:A,onClose:()=>h(null)}),e.jsx($,{isOpen:!!x,title:g.title,description:g.description,references:x?.backReferences??[],confirmLabel:g.confirmLabel,confirmVariant:g.confirmVariant,onClose:()=>j(null),onConfirm:D})]})},oe=()=>{const{page:s}=v.useSearch();return e.jsx(Q,{fallback:e.jsx(ee,{}),errorTitle:"Failed to load trash",errorDescription:"Retry loading deleted notes",resetKeys:[s],children:e.jsx(te,{})})};export{oe as default};

package/server/client/dist/assets/{useReminderMutate-BWymIujb.js → useReminderMutate-CoXXqJY2.js}

@@ -1,4 +1,4 @@
-import{j as y}from"./note-vendor-i1M2FSI2.js";import{h as u,a6 as f,q as n,k as R,m as $}from"./index-BFfQKAUY.js";import{a as l}from"./graph-vendor-CUxe67Lr.js";const g=(e={})=>({limit:e.limit??10,offset:e.offset??0}),D=async(e,t)=>u(`
+import{j as y}from"./note-vendor-DkYKUmLo.js";import{h as u,a5 as f,q as n,k as R,m as $}from"./index-VHp17GQX.js";import{a as l}from"./graph-vendor-UTvF2NS_.js";const g=(e={})=>({limit:e.limit??10,offset:e.offset??0}),D=async(e,t)=>u(`
         query FetchNoteReminders($noteId: ID!, $pagination: PaginationInput) {
             noteReminders(noteId: $noteId, pagination: $pagination) {
                 totalCount

package/server/client/dist/index.html

@@ -6,11 +6,11 @@
     <link rel="icon" type="image/png" href="/icon.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Ocean Brain</title>
-  <script type="module" crossorigin src="/assets/index-BFfQKAUY.js"></script>
-  <link rel="modulepreload" crossorigin href="/assets/graph-vendor-CUxe67Lr.js">
-  <link rel="modulepreload" crossorigin href="/assets/note-core-Z6kqulGB.js">
-  <link rel="modulepreload" crossorigin href="/assets/note-vendor-i1M2FSI2.js">
-  <link rel="stylesheet" crossorigin href="/assets/index-C5BGzDgt.css">
+  <script type="module" crossorigin src="/assets/index-VHp17GQX.js"></script>
+  <link rel="modulepreload" crossorigin href="/assets/graph-vendor-UTvF2NS_.js">
+  <link rel="modulepreload" crossorigin href="/assets/note-core-BklwyZHk.js">
+  <link rel="modulepreload" crossorigin href="/assets/note-vendor-DkYKUmLo.js">
+  <link rel="stylesheet" crossorigin href="/assets/index-BEUqDuAZ.css">
 </head>
 
 <body>

package/server/dist/app.js

@@ -2,7 +2,7 @@ import express from "express";
 import { createMcpAdminService } from "./features/mcp-admin/service.js";
 import { purgeExpiredNoteSnapshots } from "./features/note/services/snapshot.js";
 import { purgeExpiredTrashedNotes } from "./features/note/services/trash.js";
-import { createCsrfProtection, createSessionMiddleware } from "./modules/auth-guard.js";
+import { createSessionMiddleware } from "./modules/auth-guard.js";
 import { createErrorHandler } from "./modules/error-handler.js";
 import logger from "./modules/logger.js";
 import { createApiRouter, createAuthPagesRouter, createClientRouter, createGraphqlRouter } from "./routes/index.js";
@@ -18,7 +18,7 @@ const createAppWithMcpAuth = (authConfig, mcpAdminService) => {
     process.stderr.write(`[recovery] Startup cleanup failed: ${message}
 `);
   });
-  app.use(logger).use(createSessionMiddleware(authConfig)).use(express.urlencoded({ extended: false })).use(express.json({ limit: "50mb" })).use(createCsrfProtection(authConfig)).use("/api", createApiRouter(authConfig, mcpAdminService)).use(createAuthPagesRouter(authConfig)).use("/graphql", createGraphqlRouter(authConfig, mcpAdminService)).use(createClientRouter(authConfig)).use(createErrorHandler());
+  app.use(logger).use(createSessionMiddleware(authConfig)).use(express.urlencoded({ extended: false })).use(express.json({ limit: "50mb" })).use("/api", createApiRouter(authConfig, mcpAdminService)).use(createAuthPagesRouter(authConfig)).use("/graphql", createGraphqlRouter(authConfig, mcpAdminService)).use(createClientRouter(authConfig)).use(createErrorHandler());
   return app;
 };
 var app_default = createApp;

package/server/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/app.ts"],"sourcesContent":["import express from 'express';\nimport { createMcpAdminService, type McpAdminService } from './features/mcp-admin/service.js';\nimport { purgeExpiredNoteSnapshots } from './features/note/services/snapshot.js';\nimport { purgeExpiredTrashedNotes } from './features/note/services/trash.js';\nimport { createCsrfProtection, createSessionMiddleware } from './modules/auth-guard.js';\nimport type { AuthConfig } from './modules/auth-mode.js';\nimport { createErrorHandler } from './modules/error-handler.js';\nimport logger from './modules/logger.js';\nimport { createApiRouter, createAuthPagesRouter, createClientRouter, createGraphqlRouter } from './routes/index.js';\n\nexport const createApp = (authConfig: AuthConfig) => {\n    const mcpAdminService = createMcpAdminService();\n    return createAppWithMcpAuth(authConfig, mcpAdminService);\n};\n\nexport const createAppWithMcpAuth = (authConfig: AuthConfig, mcpAdminService: McpAdminService) => {\n    const app = express();\n    app.locals.authConfig = authConfig;\n\n    void Promise.all([purgeExpiredNoteSnapshots(), purgeExpiredTrashedNotes()]).catch((error) => {\n        const message = error instanceof Error ? error.message : 'Unknown recovery cleanup error';\n        process.stderr.write(`[recovery] Startup cleanup failed: ${message}\\n`);\n    });\n\n    app.use(logger)\n        .use(createSessionMiddleware(authConfig))\n        .use(express.urlencoded({ extended: false }))\n        .use(express.json({ limit: '50mb' }))\n        .use(createCsrfProtection(authConfig))\n        .use('/api', createApiRouter(authConfig, mcpAdminService))\n        .use(createAuthPagesRouter(authConfig))\n        .use('/graphql', createGraphqlRouter(authConfig, mcpAdminService))\n        .use(createClientRouter(authConfig))\n        .use(createErrorHandler());\n\n    return app;\n};\n\nexport default createApp;\n"],"mappings":"AAAA,OAAO,aAAa;AACpB,SAAS,6BAAmD;AAC5D,SAAS,iCAAiC;AAC1C,SAAS,gCAAgC;AACzC,SAAS,sBAAsB,+BAA+B;AAE9D,SAAS,0BAA0B;AACnC,OAAO,YAAY;AACnB,SAAS,iBAAiB,uBAAuB,oBAAoB,2BAA2B;AAEzF,MAAM,YAAY,CAAC,eAA2B;AACjD,QAAM,kBAAkB,sBAAsB;AAC9C,SAAO,qBAAqB,YAAY,eAAe;AAC3D;AAEO,MAAM,uBAAuB,CAAC,YAAwB,oBAAqC;AAC9F,QAAM,MAAM,QAAQ;AACpB,MAAI,OAAO,aAAa;AAExB,OAAK,QAAQ,IAAI,CAAC,0BAA0B,GAAG,yBAAyB,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU;AACzF,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAQ,OAAO,MAAM,sCAAsC,OAAO;AAAA,CAAI;AAAA,EAC1E,CAAC;AAED,MAAI,IAAI,MAAM,EACT,IAAI,wBAAwB,UAAU,CAAC,EACvC,IAAI,QAAQ,WAAW,EAAE,UAAU,MAAM,CAAC,CAAC,EAC3C,IAAI,QAAQ,KAAK,EAAE,OAAO,OAAO,CAAC,CAAC,EACnC,IAAI,qBAAqB,UAAU,CAAC,EACpC,IAAI,QAAQ,gBAAgB,YAAY,eAAe,CAAC,EACxD,IAAI,sBAAsB,UAAU,CAAC,EACrC,IAAI,YAAY,oBAAoB,YAAY,eAAe,CAAC,EAChE,IAAI,mBAAmB,UAAU,CAAC,EAClC,IAAI,mBAAmB,CAAC;AAE7B,SAAO;AACX;AAEA,IAAO,cAAQ;","names":[]}
+{"version":3,"sources":["../src/app.ts"],"sourcesContent":["import express from 'express';\nimport { createMcpAdminService, type McpAdminService } from './features/mcp-admin/service.js';\nimport { purgeExpiredNoteSnapshots } from './features/note/services/snapshot.js';\nimport { purgeExpiredTrashedNotes } from './features/note/services/trash.js';\nimport { createSessionMiddleware } from './modules/auth-guard.js';\nimport type { AuthConfig } from './modules/auth-mode.js';\nimport { createErrorHandler } from './modules/error-handler.js';\nimport logger from './modules/logger.js';\nimport { createApiRouter, createAuthPagesRouter, createClientRouter, createGraphqlRouter } from './routes/index.js';\n\nexport const createApp = (authConfig: AuthConfig) => {\n    const mcpAdminService = createMcpAdminService();\n    return createAppWithMcpAuth(authConfig, mcpAdminService);\n};\n\nexport const createAppWithMcpAuth = (authConfig: AuthConfig, mcpAdminService: McpAdminService) => {\n    const app = express();\n    app.locals.authConfig = authConfig;\n\n    void Promise.all([purgeExpiredNoteSnapshots(), purgeExpiredTrashedNotes()]).catch((error) => {\n        const message = error instanceof Error ? error.message : 'Unknown recovery cleanup error';\n        process.stderr.write(`[recovery] Startup cleanup failed: ${message}\\n`);\n    });\n\n    app.use(logger)\n        .use(createSessionMiddleware(authConfig))\n        .use(express.urlencoded({ extended: false }))\n        .use(express.json({ limit: '50mb' }))\n        .use('/api', createApiRouter(authConfig, mcpAdminService))\n        .use(createAuthPagesRouter(authConfig))\n        .use('/graphql', createGraphqlRouter(authConfig, mcpAdminService))\n        .use(createClientRouter(authConfig))\n        .use(createErrorHandler());\n\n    return app;\n};\n\nexport default createApp;\n"],"mappings":"AAAA,OAAO,aAAa;AACpB,SAAS,6BAAmD;AAC5D,SAAS,iCAAiC;AAC1C,SAAS,gCAAgC;AACzC,SAAS,+BAA+B;AAExC,SAAS,0BAA0B;AACnC,OAAO,YAAY;AACnB,SAAS,iBAAiB,uBAAuB,oBAAoB,2BAA2B;AAEzF,MAAM,YAAY,CAAC,eAA2B;AACjD,QAAM,kBAAkB,sBAAsB;AAC9C,SAAO,qBAAqB,YAAY,eAAe;AAC3D;AAEO,MAAM,uBAAuB,CAAC,YAAwB,oBAAqC;AAC9F,QAAM,MAAM,QAAQ;AACpB,MAAI,OAAO,aAAa;AAExB,OAAK,QAAQ,IAAI,CAAC,0BAA0B,GAAG,yBAAyB,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU;AACzF,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAQ,OAAO,MAAM,sCAAsC,OAAO;AAAA,CAAI;AAAA,EAC1E,CAAC;AAED,MAAI,IAAI,MAAM,EACT,IAAI,wBAAwB,UAAU,CAAC,EACvC,IAAI,QAAQ,WAAW,EAAE,UAAU,MAAM,CAAC,CAAC,EAC3C,IAAI,QAAQ,KAAK,EAAE,OAAO,OAAO,CAAC,CAAC,EACnC,IAAI,QAAQ,gBAAgB,YAAY,eAAe,CAAC,EACxD,IAAI,sBAAsB,UAAU,CAAC,EACrC,IAAI,YAAY,oBAAoB,YAAY,eAAe,CAAC,EAChE,IAAI,mBAAmB,UAAU,CAAC,EAClC,IAAI,mBAAmB,CAAC;AAE7B,SAAO;AACX;AAEA,IAAO,cAAQ;","names":[]}

package/server/dist/features/auth/http/api.js

@@ -5,7 +5,9 @@ import {
   buildSessionResponse,
   compareSharedSecret,
   destroySession,
-  regenerateSession
+  refreshCsrfToken,
+  regenerateSession,
+  setSessionStatusHeaders
 } from "../service.js";
 const createLoginHandler = (authConfig) => {
   return async (req, res) => {
@@ -16,6 +18,7 @@ const createLoginHandler = (authConfig) => {
     }
     await regenerateSession(req);
     req.session.authenticated = true;
+    refreshCsrfToken(req);
     res.status(200).json(buildSessionResponse(authConfig, req)).end();
   };
 };
@@ -29,6 +32,7 @@ const createLogoutHandler = (authConfig) => {
 };
 const createSessionStatusHandler = (authConfig) => {
   return async (req, res) => {
+    setSessionStatusHeaders(res);
     res.status(200).json(buildSessionResponse(authConfig, req)).end();
   };
 };

package/server/dist/features/auth/http/api.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/features/auth/http/api.ts"],"sourcesContent":["import { buildAuthSessionResponse } from '@baejino/auth';\nimport type { AuthConfig } from '~/modules/auth-mode.js';\nimport { createAppError } from '~/modules/error-handler.js';\nimport type { Controller } from '~/types/index.js';\nimport {\n    assertPasswordLoginAvailable,\n    buildSessionResponse,\n    compareSharedSecret,\n    destroySession,\n    regenerateSession,\n} from '../service.js';\n\nexport const createLoginHandler = (authConfig: AuthConfig): Controller => {\n    return async (req, res) => {\n        const expectedPassword = assertPasswordLoginAvailable(authConfig);\n        const password = typeof req.body?.password === 'string' ? req.body.password : '';\n\n        if (!password || !compareSharedSecret(expectedPassword, password)) {\n            throw createAppError(401, 'UNAUTHORIZED', 'Invalid password');\n        }\n\n        await regenerateSession(req);\n        req.session.authenticated = true;\n\n        res.status(200).json(buildSessionResponse(authConfig, req)).end();\n    };\n};\n\nexport const createLogoutHandler = (authConfig: AuthConfig): Controller => {\n    return async (req, res) => {\n        if (authConfig.mode === 'password') {\n            await destroySession(req);\n        }\n\n        res.status(200).json(buildAuthSessionResponse(authConfig, false)).end();\n    };\n};\n\nexport const createSessionStatusHandler = (authConfig: AuthConfig): Controller => {\n    return async (req, res) => {\n        res.status(200).json(buildSessionResponse(authConfig, req)).end();\n    };\n};\n"],"mappings":"AAAA,SAAS,gCAAgC;AAEzC,SAAS,sBAAsB;AAE/B;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAEA,MAAM,qBAAqB,CAAC,eAAuC;AACtE,SAAO,OAAO,KAAK,QAAQ;AACvB,UAAM,mBAAmB,6BAA6B,UAAU;AAChE,UAAM,WAAW,OAAO,IAAI,MAAM,aAAa,WAAW,IAAI,KAAK,WAAW;AAE9E,QAAI,CAAC,YAAY,CAAC,oBAAoB,kBAAkB,QAAQ,GAAG;AAC/D,YAAM,eAAe,KAAK,gBAAgB,kBAAkB;AAAA,IAChE;AAEA,UAAM,kBAAkB,GAAG;AAC3B,QAAI,QAAQ,gBAAgB;AAE5B,QAAI,OAAO,GAAG,EAAE,KAAK,qBAAqB,YAAY,GAAG,CAAC,EAAE,IAAI;AAAA,EACpE;AACJ;AAEO,MAAM,sBAAsB,CAAC,eAAuC;AACvE,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI,WAAW,SAAS,YAAY;AAChC,YAAM,eAAe,GAAG;AAAA,IAC5B;AAEA,QAAI,OAAO,GAAG,EAAE,KAAK,yBAAyB,YAAY,KAAK,CAAC,EAAE,IAAI;AAAA,EAC1E;AACJ;AAEO,MAAM,6BAA6B,CAAC,eAAuC;AAC9E,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI,OAAO,GAAG,EAAE,KAAK,qBAAqB,YAAY,GAAG,CAAC,EAAE,IAAI;AAAA,EACpE;AACJ;","names":[]}
+{"version":3,"sources":["../../../../src/features/auth/http/api.ts"],"sourcesContent":["import { buildAuthSessionResponse } from '@baejino/auth';\nimport type { AuthConfig } from '~/modules/auth-mode.js';\nimport { createAppError } from '~/modules/error-handler.js';\nimport type { Controller } from '~/types/index.js';\nimport {\n    assertPasswordLoginAvailable,\n    buildSessionResponse,\n    compareSharedSecret,\n    destroySession,\n    refreshCsrfToken,\n    regenerateSession,\n    setSessionStatusHeaders,\n} from '../service.js';\n\nexport const createLoginHandler = (authConfig: AuthConfig): Controller => {\n    return async (req, res) => {\n        const expectedPassword = assertPasswordLoginAvailable(authConfig);\n        const password = typeof req.body?.password === 'string' ? req.body.password : '';\n\n        if (!password || !compareSharedSecret(expectedPassword, password)) {\n            throw createAppError(401, 'UNAUTHORIZED', 'Invalid password');\n        }\n\n        await regenerateSession(req);\n        req.session.authenticated = true;\n        refreshCsrfToken(req);\n\n        res.status(200).json(buildSessionResponse(authConfig, req)).end();\n    };\n};\n\nexport const createLogoutHandler = (authConfig: AuthConfig): Controller => {\n    return async (req, res) => {\n        if (authConfig.mode === 'password') {\n            await destroySession(req);\n        }\n\n        res.status(200).json(buildAuthSessionResponse(authConfig, false)).end();\n    };\n};\n\nexport const createSessionStatusHandler = (authConfig: AuthConfig): Controller => {\n    return async (req, res) => {\n        setSessionStatusHeaders(res);\n        res.status(200).json(buildSessionResponse(authConfig, req)).end();\n    };\n};\n"],"mappings":"AAAA,SAAS,gCAAgC;AAEzC,SAAS,sBAAsB;AAE/B;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAEA,MAAM,qBAAqB,CAAC,eAAuC;AACtE,SAAO,OAAO,KAAK,QAAQ;AACvB,UAAM,mBAAmB,6BAA6B,UAAU;AAChE,UAAM,WAAW,OAAO,IAAI,MAAM,aAAa,WAAW,IAAI,KAAK,WAAW;AAE9E,QAAI,CAAC,YAAY,CAAC,oBAAoB,kBAAkB,QAAQ,GAAG;AAC/D,YAAM,eAAe,KAAK,gBAAgB,kBAAkB;AAAA,IAChE;AAEA,UAAM,kBAAkB,GAAG;AAC3B,QAAI,QAAQ,gBAAgB;AAC5B,qBAAiB,GAAG;AAEpB,QAAI,OAAO,GAAG,EAAE,KAAK,qBAAqB,YAAY,GAAG,CAAC,EAAE,IAAI;AAAA,EACpE;AACJ;AAEO,MAAM,sBAAsB,CAAC,eAAuC;AACvE,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI,WAAW,SAAS,YAAY;AAChC,YAAM,eAAe,GAAG;AAAA,IAC5B;AAEA,QAAI,OAAO,GAAG,EAAE,KAAK,yBAAyB,YAAY,KAAK,CAAC,EAAE,IAAI;AAAA,EAC1E;AACJ;AAEO,MAAM,6BAA6B,CAAC,eAAuC;AAC9E,SAAO,OAAO,KAAK,QAAQ;AACvB,4BAAwB,GAAG;AAC3B,QAAI,OAAO,GAAG,EAAE,KAAK,qBAAqB,YAAY,GAAG,CAAC,EAAE,IAAI;AAAA,EACpE;AACJ;","names":[]}

package/server/dist/features/auth/http/login-page.js

@@ -3,7 +3,7 @@ const LOGIN_ERROR_TOKEN = "<!-- OCEAN_BRAIN_LOGIN_ERROR -->";
 const NEXT_PATH_TOKEN = "OCEAN_BRAIN_NEXT_PATH";
 const readLoginPageTemplate = () => {
   if (true) {
-    return '<!doctype html>\n<html lang="en">\n<head>\n    <meta charset="utf-8" />\n    <meta name="viewport" content="width=device-width, initial-scale=1" />\n    <title>Ocean Brain Sign In</title>\n    <style>\n        :root {\n            color-scheme: light dark;\n            --surface: #f7f8fa;\n            --elevated: #fbfcfd;\n            --fg-default: #202631;\n            --fg-secondary: #626d7c;\n            --fg-tertiary: #8993a2;\n            --fg-placeholder: #98a2b0;\n            --fg-error: #a24545;\n            --fg-on-filled: #f6f8fb;\n            --border-subtle: #e5e9ee;\n            --border-focus: #757f8d;\n            --border-error: #d47777;\n            --accent-soft-danger: rgba(214, 141, 135, 0.18);\n            --accent-soft-primary: rgba(93, 102, 114, 0.12);\n            --cta: #23272d;\n            --cta-hover: #171a1f;\n            --page-bg: #f2f5f8;\n            font-family: "Pretendard Variable", "Pretendard", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;\n            background: var(--page-bg);\n            color: var(--fg-default);\n        }\n        @media (prefers-color-scheme: dark) {\n            :root {\n                --surface: #16191e;\n                --elevated: #1d2229;\n                --fg-default: #e6ebf2;\n                --fg-secondary: #a9b3c2;\n                --fg-tertiary: #7f8998;\n                --fg-placeholder: #717b88;\n                --fg-error: #efaaaa;\n                --fg-on-filled: #12161c;\n                --border-subtle: #29303a;\n                --border-focus: #b4c0cf;\n                --border-error: #efaaaa;\n                --accent-soft-danger: rgba(215, 146, 139, 0.14);\n                --accent-soft-primary: rgba(184, 192, 202, 0.12);\n                --cta: #edf1f5;\n                --cta-hover: #f8fafc;\n                --page-bg: #101318;\n            }\n        }\n        * {\n            box-sizing: border-box;\n        }\n        body {\n            margin: 0;\n            min-height: 100vh;\n            display: grid;\n            place-items: center;\n            background: var(--page-bg);\n            padding: 24px;\n        }\n        .shell {\n            width: min(392px, 100%);\n        }\n        .brand {\n            margin-bottom: 14px;\n            color: var(--fg-tertiary);\n            font-size: 12px;\n            font-weight: 700;\n            line-height: 1.4;\n        }\n        .panel {\n            padding: 24px;\n            border: 1px solid var(--border-subtle);\n            border-radius: 16px;\n            background: var(--surface);\n            box-shadow:\n                inset 0 1px 0 rgba(255, 255, 255, 0.1),\n                0 1px 4px -2px rgba(23, 29, 38, 0.04);\n        }\n        h1 {\n            margin: 0;\n            color: var(--fg-default);\n            font-size: 1.375rem;\n            line-height: 1.3;\n            font-weight: 700;\n        }\n        .lead {\n            margin: 6px 0 22px;\n            color: var(--fg-tertiary);\n            font-size: 0.875rem;\n            line-height: 1.5;\n            font-weight: 500;\n        }\n        label {\n            display: block;\n            margin-bottom: 8px;\n            color: var(--fg-secondary);\n            font-size: 0.75rem;\n            line-height: 1.4;\n            font-weight: 600;\n        }\n        form {\n            display: grid;\n            gap: 16px;\n        }\n        .field {\n            display: grid;\n        }\n        input {\n            width: 100%;\n            box-sizing: border-box;\n            padding: 14px 16px;\n            border: 1px solid var(--border-subtle);\n            border-radius: 16px;\n            background: var(--elevated);\n            font-size: 16px;\n            color: var(--fg-default);\n            transition: border-color 0.18s ease, box-shadow 0.18s ease, background-color 0.18s ease;\n        }\n        input::placeholder {\n            color: var(--fg-placeholder);\n        }\n        input:focus {\n            outline: none;\n            border-color: var(--border-focus);\n            box-shadow: 0 0 0 4px var(--accent-soft-primary);\n        }\n        .hint {\n            margin-top: 10px;\n            color: var(--fg-tertiary);\n            font-size: 0.75rem;\n            line-height: 1.4;\n        }\n        button {\n            width: 100%;\n            border: 1px solid transparent;\n            border-radius: 14px;\n            background: var(--cta);\n            color: var(--fg-on-filled);\n            padding: 14px 18px;\n            font-size: 16px;\n            font-weight: 600;\n            cursor: pointer;\n            transition: transform 0.18s ease, box-shadow 0.18s ease, background-color 0.18s ease;\n        }\n        button:hover {\n            background: var(--cta-hover);\n        }\n        button:active {\n            transform: translateY(1px);\n        }\n        button:focus-visible {\n            outline: none;\n            box-shadow: 0 0 0 4px var(--accent-soft-primary);\n        }\n        .error {\n            margin-bottom: 18px;\n            padding: 13px 14px;\n            border: 1px solid var(--border-error);\n            border-radius: 14px;\n            background: var(--accent-soft-danger);\n            color: var(--fg-error);\n            font-size: 14px;\n            font-weight: 600;\n        }\n        @media (prefers-color-scheme: dark) {\n            .panel {\n                box-shadow:\n                    inset 0 1px 0 rgba(255, 255, 255, 0.03),\n                    0 1px 4px -2px rgba(0, 0, 0, 0.18);\n            }\n        }\n        @media (max-width: 640px) {\n            body {\n                place-items: stretch;\n                padding: 18px;\n            }\n            .shell {\n                width: 100%;\n                margin: auto 0;\n            }\n            .panel {\n                padding: 22px;\n            }\n        }\n    </style>\n</head>\n<body>\n    <main class="shell">\n        <div class="brand">Ocean Brain</div>\n        <section class="panel" aria-labelledby="login-title">\n            <h1 id="login-title">Sign in</h1>\n            <p class="lead">Enter the workspace password to continue.</p>\n            <!-- OCEAN_BRAIN_LOGIN_ERROR -->\n            <form method="post" action="/login">\n                <!-- OCEAN_BRAIN_CSRF_INPUT -->\n                <input type="hidden" name="next" value="OCEAN_BRAIN_NEXT_PATH" />\n                <div class="field">\n                    <label for="password">Password</label>\n                    <input id="password" name="password" type="password" autocomplete="current-password" required autofocus />\n                </div>\n                <button type="submit">Sign in</button>\n            </form>\n            <div class="hint">This session must be authenticated before the workspace loads.</div>\n        </section>\n    </main>\n</body>\n</html>\n';
+    return '<!doctype html>\n<html lang="en">\n<head>\n    <meta charset="utf-8" />\n    <meta name="viewport" content="width=device-width, initial-scale=1" />\n    <title>Ocean Brain Sign In</title>\n    <style>\n        :root {\n            color-scheme: light dark;\n            --surface: #f7f8fa;\n            --elevated: #fbfcfd;\n            --fg-default: #202631;\n            --fg-secondary: #626d7c;\n            --fg-tertiary: #8993a2;\n            --fg-placeholder: #98a2b0;\n            --fg-error: #a24545;\n            --fg-on-filled: #f6f8fb;\n            --border-subtle: #e5e9ee;\n            --border-focus: #757f8d;\n            --border-error: #d47777;\n            --accent-soft-danger: rgba(214, 141, 135, 0.18);\n            --accent-soft-primary: rgba(93, 102, 114, 0.12);\n            --cta: #23272d;\n            --cta-hover: #171a1f;\n            --page-bg: #f2f5f8;\n            font-family: "Pretendard Variable", "Pretendard", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;\n            background: var(--page-bg);\n            color: var(--fg-default);\n        }\n        @media (prefers-color-scheme: dark) {\n            :root {\n                --surface: #16191e;\n                --elevated: #1d2229;\n                --fg-default: #e6ebf2;\n                --fg-secondary: #a9b3c2;\n                --fg-tertiary: #7f8998;\n                --fg-placeholder: #717b88;\n                --fg-error: #efaaaa;\n                --fg-on-filled: #12161c;\n                --border-subtle: #29303a;\n                --border-focus: #b4c0cf;\n                --border-error: #efaaaa;\n                --accent-soft-danger: rgba(215, 146, 139, 0.14);\n                --accent-soft-primary: rgba(184, 192, 202, 0.12);\n                --cta: #edf1f5;\n                --cta-hover: #f8fafc;\n                --page-bg: #101318;\n            }\n        }\n        * {\n            box-sizing: border-box;\n        }\n        body {\n            margin: 0;\n            min-height: 100vh;\n            display: grid;\n            place-items: center;\n            background: var(--page-bg);\n            padding: 24px;\n        }\n        .shell {\n            width: min(392px, 100%);\n        }\n        .brand {\n            display: flex;\n            align-items: center;\n            gap: 10px;\n            margin-bottom: 14px;\n            color: var(--fg-tertiary);\n            font-size: 12px;\n            font-weight: 700;\n            line-height: 1.4;\n        }\n        .brand img {\n            width: 28px;\n            height: 28px;\n            border-radius: 8px;\n        }\n        .panel {\n            padding: 24px;\n            border: 1px solid var(--border-subtle);\n            border-radius: 16px;\n            background: var(--surface);\n            box-shadow:\n                inset 0 1px 0 rgba(255, 255, 255, 0.1),\n                0 1px 4px -2px rgba(23, 29, 38, 0.04);\n        }\n        .sr-only {\n            position: absolute;\n            width: 1px;\n            height: 1px;\n            padding: 0;\n            margin: -1px;\n            overflow: hidden;\n            clip: rect(0, 0, 0, 0);\n            white-space: nowrap;\n            border: 0;\n        }\n        label {\n            display: block;\n            margin-bottom: 8px;\n            color: var(--fg-secondary);\n            font-size: 0.75rem;\n            line-height: 1.4;\n            font-weight: 600;\n        }\n        form {\n            display: grid;\n            gap: 16px;\n        }\n        .field {\n            display: grid;\n        }\n        input {\n            width: 100%;\n            box-sizing: border-box;\n            padding: 14px 16px;\n            border: 1px solid var(--border-subtle);\n            border-radius: 16px;\n            background: var(--elevated);\n            font-size: 16px;\n            color: var(--fg-default);\n            transition: border-color 0.18s ease, box-shadow 0.18s ease, background-color 0.18s ease;\n        }\n        input::placeholder {\n            color: var(--fg-placeholder);\n        }\n        input:focus {\n            outline: none;\n            border-color: var(--border-focus);\n            box-shadow: 0 0 0 4px var(--accent-soft-primary);\n        }\n        button {\n            width: 100%;\n            border: 1px solid transparent;\n            border-radius: 14px;\n            background: var(--cta);\n            color: var(--fg-on-filled);\n            padding: 14px 18px;\n            font-size: 16px;\n            font-weight: 600;\n            cursor: pointer;\n            transition: transform 0.18s ease, box-shadow 0.18s ease, background-color 0.18s ease;\n        }\n        button:hover {\n            background: var(--cta-hover);\n        }\n        button:active {\n            transform: translateY(1px);\n        }\n        button:focus-visible {\n            outline: none;\n            box-shadow: 0 0 0 4px var(--accent-soft-primary);\n        }\n        .error {\n            margin-bottom: 18px;\n            padding: 13px 14px;\n            border: 1px solid var(--border-error);\n            border-radius: 14px;\n            background: var(--accent-soft-danger);\n            color: var(--fg-error);\n            font-size: 14px;\n            font-weight: 600;\n        }\n        @media (prefers-color-scheme: dark) {\n            .panel {\n                box-shadow:\n                    inset 0 1px 0 rgba(255, 255, 255, 0.03),\n                    0 1px 4px -2px rgba(0, 0, 0, 0.18);\n            }\n        }\n        @media (max-width: 640px) {\n            body {\n                place-items: stretch;\n                padding: 18px;\n            }\n            .shell {\n                width: 100%;\n                margin: auto 0;\n            }\n            .panel {\n                padding: 22px;\n            }\n        }\n    </style>\n</head>\n<body>\n    <main class="shell">\n        <div class="brand"><img src="/icon.png" alt="" aria-hidden="true" />Ocean Brain</div>\n        <section class="panel" aria-labelledby="login-title">\n            <h1 id="login-title" class="sr-only">Sign in</h1>\n            <!-- OCEAN_BRAIN_LOGIN_ERROR -->\n            <form method="post" action="/login">\n                <!-- OCEAN_BRAIN_CSRF_INPUT -->\n                <input type="hidden" name="next" value="OCEAN_BRAIN_NEXT_PATH" />\n                <div class="field">\n                    <label for="password">Password</label>\n                    <input id="password" name="password" type="password" autocomplete="current-password" required autofocus />\n                </div>\n                <button type="submit">Sign in</button>\n            </form>\n        </section>\n    </main>\n</body>\n</html>\n';
   }
   return readFileSync(new URL("./login-page.html", import.meta.url), "utf8");
 };

package/server/dist/features/auth/http/pages.js

@@ -1,4 +1,10 @@
-import { compareSharedSecret, destroySession, regenerateSession, sanitizeRedirectPath } from "../service.js";
+import {
+  compareSharedSecret,
+  destroySession,
+  refreshCsrfToken,
+  regenerateSession,
+  sanitizeRedirectPath
+} from "../service.js";
 import { renderLoginPage } from "./login-page.js";
 const createLoginPageHandler = (authConfig) => {
   return async (req, res) => {
@@ -30,6 +36,7 @@ const createLoginPageSubmitHandler = (authConfig) => {
     }
     await regenerateSession(req);
     req.session.authenticated = true;
+    refreshCsrfToken(req);
     res.redirect(303, nextPath);
   };
 };

package/server/dist/features/auth/http/pages.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/features/auth/http/pages.ts"],"sourcesContent":["import type { AuthConfig } from '~/modules/auth-mode.js';\nimport type { Controller } from '~/types/index.js';\nimport { compareSharedSecret, destroySession, regenerateSession, sanitizeRedirectPath } from '../service.js';\nimport { renderLoginPage } from './login-page.js';\n\nexport const createLoginPageHandler = (authConfig: AuthConfig): Controller => {\n    return async (req, res) => {\n        if (authConfig.mode !== 'password' || req.session?.authenticated) {\n            res.redirect(303, sanitizeRedirectPath(req.query.next));\n            return;\n        }\n\n        const nextPath = sanitizeRedirectPath(req.query.next);\n        res.status(200)\n            .type('html')\n            .send(renderLoginPage({ nextPath, csrfToken: res.locals._csrf }))\n            .end();\n    };\n};\n\nexport const createLoginPageSubmitHandler = (authConfig: AuthConfig): Controller => {\n    return async (req, res) => {\n        const nextPath = sanitizeRedirectPath(req.body?.next);\n\n        if (authConfig.mode !== 'password' || !authConfig.password) {\n            res.redirect(303, nextPath);\n            return;\n        }\n\n        const password = typeof req.body?.password === 'string' ? req.body.password : '';\n\n        if (!password || !compareSharedSecret(authConfig.password, password)) {\n            res.status(401)\n                .type('html')\n                .send(\n                    renderLoginPage({\n                        nextPath,\n                        errorMessage: 'Invalid password',\n                        csrfToken: res.locals._csrf,\n                    }),\n                )\n                .end();\n            return;\n        }\n\n        await regenerateSession(req);\n        req.session.authenticated = true;\n\n        res.redirect(303, nextPath);\n    };\n};\n\nexport const createLogoutPageHandler = (authConfig: AuthConfig): Controller => {\n    return async (req, res) => {\n        if (authConfig.mode === 'password') {\n            await destroySession(req);\n            res.redirect(303, '/login');\n            return;\n        }\n\n        res.redirect(303, '/');\n    };\n};\n"],"mappings":"AAEA,SAAS,qBAAqB,gBAAgB,mBAAmB,4BAA4B;AAC7F,SAAS,uBAAuB;AAEzB,MAAM,yBAAyB,CAAC,eAAuC;AAC1E,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI,WAAW,SAAS,cAAc,IAAI,SAAS,eAAe;AAC9D,UAAI,SAAS,KAAK,qBAAqB,IAAI,MAAM,IAAI,CAAC;AACtD;AAAA,IACJ;AAEA,UAAM,WAAW,qBAAqB,IAAI,MAAM,IAAI;AACpD,QAAI,OAAO,GAAG,EACT,KAAK,MAAM,EACX,KAAK,gBAAgB,EAAE,UAAU,WAAW,IAAI,OAAO,MAAM,CAAC,CAAC,EAC/D,IAAI;AAAA,EACb;AACJ;AAEO,MAAM,+BAA+B,CAAC,eAAuC;AAChF,SAAO,OAAO,KAAK,QAAQ;AACvB,UAAM,WAAW,qBAAqB,IAAI,MAAM,IAAI;AAEpD,QAAI,WAAW,SAAS,cAAc,CAAC,WAAW,UAAU;AACxD,UAAI,SAAS,KAAK,QAAQ;AAC1B;AAAA,IACJ;AAEA,UAAM,WAAW,OAAO,IAAI,MAAM,aAAa,WAAW,IAAI,KAAK,WAAW;AAE9E,QAAI,CAAC,YAAY,CAAC,oBAAoB,WAAW,UAAU,QAAQ,GAAG;AAClE,UAAI,OAAO,GAAG,EACT,KAAK,MAAM,EACX;AAAA,QACG,gBAAgB;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,UACd,WAAW,IAAI,OAAO;AAAA,QAC1B,CAAC;AAAA,MACL,EACC,IAAI;AACT;AAAA,IACJ;AAEA,UAAM,kBAAkB,GAAG;AAC3B,QAAI,QAAQ,gBAAgB;AAE5B,QAAI,SAAS,KAAK,QAAQ;AAAA,EAC9B;AACJ;AAEO,MAAM,0BAA0B,CAAC,eAAuC;AAC3E,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI,WAAW,SAAS,YAAY;AAChC,YAAM,eAAe,GAAG;AACxB,UAAI,SAAS,KAAK,QAAQ;AAC1B;AAAA,IACJ;AAEA,QAAI,SAAS,KAAK,GAAG;AAAA,EACzB;AACJ;","names":[]}
+{"version":3,"sources":["../../../../src/features/auth/http/pages.ts"],"sourcesContent":["import type { AuthConfig } from '~/modules/auth-mode.js';\nimport type { Controller } from '~/types/index.js';\nimport {\n    compareSharedSecret,\n    destroySession,\n    refreshCsrfToken,\n    regenerateSession,\n    sanitizeRedirectPath,\n} from '../service.js';\nimport { renderLoginPage } from './login-page.js';\n\nexport const createLoginPageHandler = (authConfig: AuthConfig): Controller => {\n    return async (req, res) => {\n        if (authConfig.mode !== 'password' || req.session?.authenticated) {\n            res.redirect(303, sanitizeRedirectPath(req.query.next));\n            return;\n        }\n\n        const nextPath = sanitizeRedirectPath(req.query.next);\n        res.status(200)\n            .type('html')\n            .send(renderLoginPage({ nextPath, csrfToken: res.locals._csrf }))\n            .end();\n    };\n};\n\nexport const createLoginPageSubmitHandler = (authConfig: AuthConfig): Controller => {\n    return async (req, res) => {\n        const nextPath = sanitizeRedirectPath(req.body?.next);\n\n        if (authConfig.mode !== 'password' || !authConfig.password) {\n            res.redirect(303, nextPath);\n            return;\n        }\n\n        const password = typeof req.body?.password === 'string' ? req.body.password : '';\n\n        if (!password || !compareSharedSecret(authConfig.password, password)) {\n            res.status(401)\n                .type('html')\n                .send(\n                    renderLoginPage({\n                        nextPath,\n                        errorMessage: 'Invalid password',\n                        csrfToken: res.locals._csrf,\n                    }),\n                )\n                .end();\n            return;\n        }\n\n        await regenerateSession(req);\n        req.session.authenticated = true;\n        refreshCsrfToken(req);\n\n        res.redirect(303, nextPath);\n    };\n};\n\nexport const createLogoutPageHandler = (authConfig: AuthConfig): Controller => {\n    return async (req, res) => {\n        if (authConfig.mode === 'password') {\n            await destroySession(req);\n            res.redirect(303, '/login');\n            return;\n        }\n\n        res.redirect(303, '/');\n    };\n};\n"],"mappings":"AAEA;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AACP,SAAS,uBAAuB;AAEzB,MAAM,yBAAyB,CAAC,eAAuC;AAC1E,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI,WAAW,SAAS,cAAc,IAAI,SAAS,eAAe;AAC9D,UAAI,SAAS,KAAK,qBAAqB,IAAI,MAAM,IAAI,CAAC;AACtD;AAAA,IACJ;AAEA,UAAM,WAAW,qBAAqB,IAAI,MAAM,IAAI;AACpD,QAAI,OAAO,GAAG,EACT,KAAK,MAAM,EACX,KAAK,gBAAgB,EAAE,UAAU,WAAW,IAAI,OAAO,MAAM,CAAC,CAAC,EAC/D,IAAI;AAAA,EACb;AACJ;AAEO,MAAM,+BAA+B,CAAC,eAAuC;AAChF,SAAO,OAAO,KAAK,QAAQ;AACvB,UAAM,WAAW,qBAAqB,IAAI,MAAM,IAAI;AAEpD,QAAI,WAAW,SAAS,cAAc,CAAC,WAAW,UAAU;AACxD,UAAI,SAAS,KAAK,QAAQ;AAC1B;AAAA,IACJ;AAEA,UAAM,WAAW,OAAO,IAAI,MAAM,aAAa,WAAW,IAAI,KAAK,WAAW;AAE9E,QAAI,CAAC,YAAY,CAAC,oBAAoB,WAAW,UAAU,QAAQ,GAAG;AAClE,UAAI,OAAO,GAAG,EACT,KAAK,MAAM,EACX;AAAA,QACG,gBAAgB;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,UACd,WAAW,IAAI,OAAO;AAAA,QAC1B,CAAC;AAAA,MACL,EACC,IAAI;AACT;AAAA,IACJ;AAEA,UAAM,kBAAkB,GAAG;AAC3B,QAAI,QAAQ,gBAAgB;AAC5B,qBAAiB,GAAG;AAEpB,QAAI,SAAS,KAAK,QAAQ;AAAA,EAC9B;AACJ;AAEO,MAAM,0BAA0B,CAAC,eAAuC;AAC3E,SAAO,OAAO,KAAK,QAAQ;AACvB,QAAI,WAAW,SAAS,YAAY;AAChC,YAAM,eAAe,GAAG;AACxB,UAAI,SAAS,KAAK,QAAQ;AAC1B;AAAA,IACJ;AAEA,QAAI,SAAS,KAAK,GAAG;AAAA,EACzB;AACJ;","names":[]}

package/server/dist/features/auth/service.js

@@ -1,7 +1,10 @@
-import { buildAuthSessionResponse, sanitizeRedirectPath as sanitizeCommonRedirectPath } from "@baejino/auth";
+import { buildAuthSessionResponse } from "@baejino/auth";
 import { compareSharedSecret as compareCommonSharedSecret } from "@baejino/auth/crypto";
 import crypto from "crypto";
+import { sanitizeRedirectPath } from "../../modules/auth-redirect.js";
 import { createAppError } from "../../modules/error-handler.js";
+const AUTH_SESSION_GENERATION_HEADER = "X-Ocean-Brain-Session-Generation";
+const AUTH_SESSION_GENERATION = crypto.randomUUID();
 const createPasswordHash = async (password) => {
   const salt = crypto.randomBytes(16).toString("hex");
   const hash = crypto.pbkdf2Sync(password, salt, 1e3, 64, "sha512").toString("hex");
@@ -14,6 +17,14 @@ const comparePassword = async (password, storedHash) => {
 };
 const compareSharedSecret = compareCommonSharedSecret;
 const buildSessionResponse = (authConfig, req) => buildAuthSessionResponse(authConfig, Boolean(req.session?.authenticated));
+const setSessionStatusHeaders = (res) => {
+  res.set(AUTH_SESSION_GENERATION_HEADER, AUTH_SESSION_GENERATION);
+  res.set("Cache-Control", "no-store");
+};
+const refreshCsrfToken = (req) => {
+  const requestWithCsrf = req;
+  requestWithCsrf.csrfToken?.();
+};
 const assertPasswordLoginAvailable = (authConfig) => {
   if (authConfig.mode !== "password") {
     throw createAppError(409, "AUTH_OPEN_MODE", "Login is unavailable while auth mode is open.");
@@ -45,19 +56,17 @@ const destroySession = async (req) => {
     });
   });
 };
-const sanitizeRedirectPath = (value) => sanitizeCommonRedirectPath(value, {
-  fallbackPath: "/",
-  loginPath: "/login",
-  allowedAbsoluteHosts: ["localhost", "127.0.0.1", "::1"]
-});
 export {
+  AUTH_SESSION_GENERATION_HEADER,
   assertPasswordLoginAvailable,
   buildSessionResponse,
   comparePassword,
   compareSharedSecret,
   createPasswordHash,
   destroySession,
+  refreshCsrfToken,
   regenerateSession,
-  sanitizeRedirectPath
+  sanitizeRedirectPath,
+  setSessionStatusHeaders
 };
 //# sourceMappingURL=service.js.map

package/server/dist/features/auth/service.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/features/auth/service.ts"],"sourcesContent":["import { buildAuthSessionResponse, sanitizeRedirectPath as sanitizeCommonRedirectPath } from '@baejino/auth';\nimport { compareSharedSecret as compareCommonSharedSecret } from '@baejino/auth/crypto';\nimport crypto from 'crypto';\nimport type { Request } from 'express';\nimport type { AuthConfig } from '~/modules/auth-mode.js';\nimport { createAppError } from '~/modules/error-handler.js';\n\nexport const createPasswordHash = async (password: string) => {\n    const salt = crypto.randomBytes(16).toString('hex');\n    const hash = crypto.pbkdf2Sync(password, salt, 1000, 64, 'sha512').toString('hex');\n    return `${salt}:${hash}`;\n};\n\nexport const comparePassword = async (password: string, storedHash: string) => {\n    const [salt, hash] = storedHash.split(':');\n    const newHash = crypto.pbkdf2Sync(password, salt, 1000, 64, 'sha512').toString('hex');\n    return hash === newHash;\n};\n\nexport const compareSharedSecret = compareCommonSharedSecret;\n\nexport const buildSessionResponse = (authConfig: AuthConfig, req: Request) =>\n    buildAuthSessionResponse(authConfig, Boolean(req.session?.authenticated));\n\nexport const assertPasswordLoginAvailable = (authConfig: AuthConfig) => {\n    if (authConfig.mode !== 'password') {\n        throw createAppError(409, 'AUTH_OPEN_MODE', 'Login is unavailable while auth mode is open.');\n    }\n\n    return authConfig.password;\n};\n\nexport const regenerateSession = async (req: Request) => {\n    await new Promise<void>((resolve, reject) => {\n        req.session.regenerate((error) => {\n            if (error) {\n                reject(error);\n                return;\n            }\n\n            resolve();\n        });\n    });\n};\n\nexport const destroySession = async (req: Request) => {\n    if (!req.session) {\n        return;\n    }\n\n    await new Promise<void>((resolve, reject) => {\n        req.session.destroy((error) => {\n            if (error) {\n                reject(error);\n                return;\n            }\n\n            resolve();\n        });\n    });\n};\n\nexport const sanitizeRedirectPath = (value: unknown) =>\n    sanitizeCommonRedirectPath(value, {\n        fallbackPath: '/',\n        loginPath: '/login',\n        allowedAbsoluteHosts: ['localhost', '127.0.0.1', '::1'],\n    });\n"],"mappings":"AAAA,SAAS,0BAA0B,wBAAwB,kCAAkC;AAC7F,SAAS,uBAAuB,iCAAiC;AACjE,OAAO,YAAY;AAGnB,SAAS,sBAAsB;AAExB,MAAM,qBAAqB,OAAO,aAAqB;AAC1D,QAAM,OAAO,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAClD,QAAM,OAAO,OAAO,WAAW,UAAU,MAAM,KAAM,IAAI,QAAQ,EAAE,SAAS,KAAK;AACjF,SAAO,GAAG,IAAI,IAAI,IAAI;AAC1B;AAEO,MAAM,kBAAkB,OAAO,UAAkB,eAAuB;AAC3E,QAAM,CAAC,MAAM,IAAI,IAAI,WAAW,MAAM,GAAG;AACzC,QAAM,UAAU,OAAO,WAAW,UAAU,MAAM,KAAM,IAAI,QAAQ,EAAE,SAAS,KAAK;AACpF,SAAO,SAAS;AACpB;AAEO,MAAM,sBAAsB;AAE5B,MAAM,uBAAuB,CAAC,YAAwB,QACzD,yBAAyB,YAAY,QAAQ,IAAI,SAAS,aAAa,CAAC;AAErE,MAAM,+BAA+B,CAAC,eAA2B;AACpE,MAAI,WAAW,SAAS,YAAY;AAChC,UAAM,eAAe,KAAK,kBAAkB,+CAA+C;AAAA,EAC/F;AAEA,SAAO,WAAW;AACtB;AAEO,MAAM,oBAAoB,OAAO,QAAiB;AACrD,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AACzC,QAAI,QAAQ,WAAW,CAAC,UAAU;AAC9B,UAAI,OAAO;AACP,eAAO,KAAK;AACZ;AAAA,MACJ;AAEA,cAAQ;AAAA,IACZ,CAAC;AAAA,EACL,CAAC;AACL;AAEO,MAAM,iBAAiB,OAAO,QAAiB;AAClD,MAAI,CAAC,IAAI,SAAS;AACd;AAAA,EACJ;AAEA,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AACzC,QAAI,QAAQ,QAAQ,CAAC,UAAU;AAC3B,UAAI,OAAO;AACP,eAAO,KAAK;AACZ;AAAA,MACJ;AAEA,cAAQ;AAAA,IACZ,CAAC;AAAA,EACL,CAAC;AACL;AAEO,MAAM,uBAAuB,CAAC,UACjC,2BAA2B,OAAO;AAAA,EAC9B,cAAc;AAAA,EACd,WAAW;AAAA,EACX,sBAAsB,CAAC,aAAa,aAAa,KAAK;AAC1D,CAAC;","names":[]}
+{"version":3,"sources":["../../../src/features/auth/service.ts"],"sourcesContent":["import { buildAuthSessionResponse } from '@baejino/auth';\nimport { compareSharedSecret as compareCommonSharedSecret } from '@baejino/auth/crypto';\nimport crypto from 'crypto';\nimport type { Request, Response } from 'express';\nimport type { AuthConfig } from '~/modules/auth-mode.js';\nimport { sanitizeRedirectPath } from '~/modules/auth-redirect.js';\nimport { createAppError } from '~/modules/error-handler.js';\n\nexport const AUTH_SESSION_GENERATION_HEADER = 'X-Ocean-Brain-Session-Generation';\nconst AUTH_SESSION_GENERATION = crypto.randomUUID();\n\nexport const createPasswordHash = async (password: string) => {\n    const salt = crypto.randomBytes(16).toString('hex');\n    const hash = crypto.pbkdf2Sync(password, salt, 1000, 64, 'sha512').toString('hex');\n    return `${salt}:${hash}`;\n};\n\nexport const comparePassword = async (password: string, storedHash: string) => {\n    const [salt, hash] = storedHash.split(':');\n    const newHash = crypto.pbkdf2Sync(password, salt, 1000, 64, 'sha512').toString('hex');\n    return hash === newHash;\n};\n\nexport const compareSharedSecret = compareCommonSharedSecret;\n\nexport const buildSessionResponse = (authConfig: AuthConfig, req: Request) =>\n    buildAuthSessionResponse(authConfig, Boolean(req.session?.authenticated));\n\nexport const setSessionStatusHeaders = (res: Response) => {\n    res.set(AUTH_SESSION_GENERATION_HEADER, AUTH_SESSION_GENERATION);\n    res.set('Cache-Control', 'no-store');\n};\n\nexport const refreshCsrfToken = (req: Request) => {\n    const requestWithCsrf = req as Request & { csrfToken?: () => string };\n    requestWithCsrf.csrfToken?.();\n};\n\nexport const assertPasswordLoginAvailable = (authConfig: AuthConfig) => {\n    if (authConfig.mode !== 'password') {\n        throw createAppError(409, 'AUTH_OPEN_MODE', 'Login is unavailable while auth mode is open.');\n    }\n\n    return authConfig.password;\n};\n\nexport const regenerateSession = async (req: Request) => {\n    await new Promise<void>((resolve, reject) => {\n        req.session.regenerate((error) => {\n            if (error) {\n                reject(error);\n                return;\n            }\n\n            resolve();\n        });\n    });\n};\n\nexport const destroySession = async (req: Request) => {\n    if (!req.session) {\n        return;\n    }\n\n    await new Promise<void>((resolve, reject) => {\n        req.session.destroy((error) => {\n            if (error) {\n                reject(error);\n                return;\n            }\n\n            resolve();\n        });\n    });\n};\n\nexport { sanitizeRedirectPath };\n"],"mappings":"AAAA,SAAS,gCAAgC;AACzC,SAAS,uBAAuB,iCAAiC;AACjE,OAAO,YAAY;AAGnB,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAExB,MAAM,iCAAiC;AAC9C,MAAM,0BAA0B,OAAO,WAAW;AAE3C,MAAM,qBAAqB,OAAO,aAAqB;AAC1D,QAAM,OAAO,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAClD,QAAM,OAAO,OAAO,WAAW,UAAU,MAAM,KAAM,IAAI,QAAQ,EAAE,SAAS,KAAK;AACjF,SAAO,GAAG,IAAI,IAAI,IAAI;AAC1B;AAEO,MAAM,kBAAkB,OAAO,UAAkB,eAAuB;AAC3E,QAAM,CAAC,MAAM,IAAI,IAAI,WAAW,MAAM,GAAG;AACzC,QAAM,UAAU,OAAO,WAAW,UAAU,MAAM,KAAM,IAAI,QAAQ,EAAE,SAAS,KAAK;AACpF,SAAO,SAAS;AACpB;AAEO,MAAM,sBAAsB;AAE5B,MAAM,uBAAuB,CAAC,YAAwB,QACzD,yBAAyB,YAAY,QAAQ,IAAI,SAAS,aAAa,CAAC;AAErE,MAAM,0BAA0B,CAAC,QAAkB;AACtD,MAAI,IAAI,gCAAgC,uBAAuB;AAC/D,MAAI,IAAI,iBAAiB,UAAU;AACvC;AAEO,MAAM,mBAAmB,CAAC,QAAiB;AAC9C,QAAM,kBAAkB;AACxB,kBAAgB,YAAY;AAChC;AAEO,MAAM,+BAA+B,CAAC,eAA2B;AACpE,MAAI,WAAW,SAAS,YAAY;AAChC,UAAM,eAAe,KAAK,kBAAkB,+CAA+C;AAAA,EAC/F;AAEA,SAAO,WAAW;AACtB;AAEO,MAAM,oBAAoB,OAAO,QAAiB;AACrD,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AACzC,QAAI,QAAQ,WAAW,CAAC,UAAU;AAC9B,UAAI,OAAO;AACP,eAAO,KAAK;AACZ;AAAA,MACJ;AAEA,cAAQ;AAAA,IACZ,CAAC;AAAA,EACL,CAAC;AACL;AAEO,MAAM,iBAAiB,OAAO,QAAiB;AAClD,MAAI,CAAC,IAAI,SAAS;AACd;AAAA,EACJ;AAEA,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AACzC,QAAI,QAAQ,QAAQ,CAAC,UAAU;AAC3B,UAAI,OAAO;AACP,eAAO,KAAK;AACZ;AAAA,MACJ;AAEA,cAAQ;AAAA,IACZ,CAAC;AAAA,EACL,CAAC;AACL;","names":[]}

package/server/dist/features/image/http/upload.js

@@ -1,48 +1,59 @@
 import { createAppError } from "../../../modules/error-handler.js";
-import { fetchRemoteImage, RemoteImageFetchError } from "../services/remote-fetch.js";
 import { persistUploadedImage } from "../services/upload.js";
+import { ImageValidationError, normalizeImageContentType, validateImagePayload } from "../services/validation.js";
+const IMAGE_DATA_URL_PATTERN = /^data:(image\/[a-z0-9.+-]+);base64,([A-Za-z0-9+/]+={0,2})$/i;
 const createUploadResponse = (image) => {
   return {
     id: image.id,
     url: image.url
   };
 };
+const parseImageDataUrl = (image) => {
+  const match = IMAGE_DATA_URL_PATTERN.exec(image);
+  if (!match || !match[2] || match[2].length % 4 !== 0) {
+    return null;
+  }
+  return {
+    base64: match[2],
+    contentType: normalizeImageContentType(match[1])
+  };
+};
+const createUploadValidationError = (error) => {
+  if (error.code === "IMAGE_UNSUPPORTED_CONTENT_TYPE") {
+    return createAppError(415, "IMAGE_UPLOAD_UNSUPPORTED_TYPE", "Uploaded image content type is not supported.");
+  }
+  return createAppError(400, "INVALID_IMAGE_UPLOAD", "Uploaded image content is invalid.");
+};
 const createUploadImageHandler = (persistImage = persistUploadedImage) => {
   return async (req, res) => {
     const { image } = req.body ?? {};
-    if (typeof image !== "string" || !image.match(/data:image\/\s*(\w+);base64,/)) {
+    if (typeof image !== "string") {
       throw createAppError(400, "INVALID_IMAGE_UPLOAD", "No image uploaded");
     }
-    const [info, data] = image.split(",");
-    const buffer = Buffer.from(data, "base64");
-    const extension = info.split(";")[0]?.split("/")[1] ?? "";
-    const uploadedImage = await persistImage({
-      buffer,
-      extension
-    });
-    res.status(200).json(createUploadResponse(uploadedImage)).end();
-  };
-};
-const createUploadImageFromSrcHandler = (fetchImage = fetchRemoteImage, persistImage = persistUploadedImage) => {
-  return async (req, res) => {
-    const src = String(req.body?.src ?? "");
+    const parsedImage = parseImageDataUrl(image);
+    if (!parsedImage) {
+      throw createAppError(400, "INVALID_IMAGE_UPLOAD", "No image uploaded");
+    }
+    let validatedImage;
     try {
-      const remoteImage = await fetchImage(src);
-      const uploadedImage = await persistImage({
-        buffer: remoteImage.buffer,
-        extension: remoteImage.extension
+      validatedImage = validateImagePayload({
+        buffer: Buffer.from(parsedImage.base64, "base64"),
+        contentType: parsedImage.contentType
       });
-      res.status(200).json(createUploadResponse(uploadedImage)).end();
     } catch (error) {
-      if (error instanceof RemoteImageFetchError) {
-        throw createAppError(error.status, error.code, error.message);
+      if (error instanceof ImageValidationError) {
+        throw createUploadValidationError(error);
       }
       throw error;
     }
+    const uploadedImage = await persistImage({
+      buffer: validatedImage.buffer,
+      extension: validatedImage.extension
+    });
+    res.status(200).json(createUploadResponse(uploadedImage)).end();
   };
 };
 export {
-  createUploadImageFromSrcHandler,
   createUploadImageHandler
 };
 //# sourceMappingURL=upload.js.map

package/server/dist/features/image/http/upload.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/features/image/http/upload.ts"],"sourcesContent":["import { createAppError } from '~/modules/error-handler.js';\nimport type { Controller } from '~/types/index.js';\nimport { fetchRemoteImage, type RemoteImage, RemoteImageFetchError } from '../services/remote-fetch.js';\nimport { type PersistedImageSummary, type PersistImageInput, persistUploadedImage } from '../services/upload.js';\n\ntype PersistImage = (input: PersistImageInput) => Promise<PersistedImageSummary>;\ntype FetchImage = (src: string) => Promise<RemoteImage>;\n\nconst createUploadResponse = (image: PersistedImageSummary) => {\n    return {\n        id: image.id,\n        url: image.url,\n    };\n};\n\nexport const createUploadImageHandler = (persistImage: PersistImage = persistUploadedImage): Controller => {\n    return async (req, res) => {\n        const { image } = req.body ?? {};\n\n        if (typeof image !== 'string' || !image.match(/data:image\\/\\s*(\\w+);base64,/)) {\n            throw createAppError(400, 'INVALID_IMAGE_UPLOAD', 'No image uploaded');\n        }\n\n        const [info, data] = image.split(',');\n        const buffer = Buffer.from(data, 'base64');\n        const extension = info.split(';')[0]?.split('/')[1] ?? '';\n        const uploadedImage = await persistImage({\n            buffer,\n            extension,\n        });\n\n        res.status(200).json(createUploadResponse(uploadedImage)).end();\n    };\n};\n\nexport const createUploadImageFromSrcHandler = (\n    fetchImage: FetchImage = fetchRemoteImage,\n    persistImage: PersistImage = persistUploadedImage,\n): Controller => {\n    return async (req, res) => {\n        const src = String(req.body?.src ?? '');\n\n        try {\n            const remoteImage = await fetchImage(src);\n            const uploadedImage = await persistImage({\n                buffer: remoteImage.buffer,\n                extension: remoteImage.extension,\n            });\n\n            res.status(200).json(createUploadResponse(uploadedImage)).end();\n        } catch (error) {\n            if (error instanceof RemoteImageFetchError) {\n                throw createAppError(error.status, error.code, error.message);\n            }\n\n            throw error;\n        }\n    };\n};\n"],"mappings":"AAAA,SAAS,sBAAsB;AAE/B,SAAS,kBAAoC,6BAA6B;AAC1E,SAA6D,4BAA4B;AAKzF,MAAM,uBAAuB,CAAC,UAAiC;AAC3D,SAAO;AAAA,IACH,IAAI,MAAM;AAAA,IACV,KAAK,MAAM;AAAA,EACf;AACJ;AAEO,MAAM,2BAA2B,CAAC,eAA6B,yBAAqC;AACvG,SAAO,OAAO,KAAK,QAAQ;AACvB,UAAM,EAAE,MAAM,IAAI,IAAI,QAAQ,CAAC;AAE/B,QAAI,OAAO,UAAU,YAAY,CAAC,MAAM,MAAM,8BAA8B,GAAG;AAC3E,YAAM,eAAe,KAAK,wBAAwB,mBAAmB;AAAA,IACzE;AAEA,UAAM,CAAC,MAAM,IAAI,IAAI,MAAM,MAAM,GAAG;AACpC,UAAM,SAAS,OAAO,KAAK,MAAM,QAAQ;AACzC,UAAM,YAAY,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,GAAG,EAAE,CAAC,KAAK;AACvD,UAAM,gBAAgB,MAAM,aAAa;AAAA,MACrC;AAAA,MACA;AAAA,IACJ,CAAC;AAED,QAAI,OAAO,GAAG,EAAE,KAAK,qBAAqB,aAAa,CAAC,EAAE,IAAI;AAAA,EAClE;AACJ;AAEO,MAAM,kCAAkC,CAC3C,aAAyB,kBACzB,eAA6B,yBAChB;AACb,SAAO,OAAO,KAAK,QAAQ;AACvB,UAAM,MAAM,OAAO,IAAI,MAAM,OAAO,EAAE;AAEtC,QAAI;AACA,YAAM,cAAc,MAAM,WAAW,GAAG;AACxC,YAAM,gBAAgB,MAAM,aAAa;AAAA,QACrC,QAAQ,YAAY;AAAA,QACpB,WAAW,YAAY;AAAA,MAC3B,CAAC;AAED,UAAI,OAAO,GAAG,EAAE,KAAK,qBAAqB,aAAa,CAAC,EAAE,IAAI;AAAA,IAClE,SAAS,OAAO;AACZ,UAAI,iBAAiB,uBAAuB;AACxC,cAAM,eAAe,MAAM,QAAQ,MAAM,MAAM,MAAM,OAAO;AAAA,MAChE;AAEA,YAAM;AAAA,IACV;AAAA,EACJ;AACJ;","names":[]}
+{"version":3,"sources":["../../../../src/features/image/http/upload.ts"],"sourcesContent":["import { createAppError } from '~/modules/error-handler.js';\nimport type { Controller } from '~/types/index.js';\nimport { type PersistedImageSummary, type PersistImageInput, persistUploadedImage } from '../services/upload.js';\nimport { ImageValidationError, normalizeImageContentType, validateImagePayload } from '../services/validation.js';\n\ntype PersistImage = (input: PersistImageInput) => Promise<PersistedImageSummary>;\n\nconst IMAGE_DATA_URL_PATTERN = /^data:(image\\/[a-z0-9.+-]+);base64,([A-Za-z0-9+/]+={0,2})$/i;\n\nconst createUploadResponse = (image: PersistedImageSummary) => {\n    return {\n        id: image.id,\n        url: image.url,\n    };\n};\n\nconst parseImageDataUrl = (image: string) => {\n    const match = IMAGE_DATA_URL_PATTERN.exec(image);\n\n    if (!match || !match[2] || match[2].length % 4 !== 0) {\n        return null;\n    }\n\n    return {\n        base64: match[2],\n        contentType: normalizeImageContentType(match[1]),\n    };\n};\n\nconst createUploadValidationError = (error: ImageValidationError) => {\n    if (error.code === 'IMAGE_UNSUPPORTED_CONTENT_TYPE') {\n        return createAppError(415, 'IMAGE_UPLOAD_UNSUPPORTED_TYPE', 'Uploaded image content type is not supported.');\n    }\n\n    return createAppError(400, 'INVALID_IMAGE_UPLOAD', 'Uploaded image content is invalid.');\n};\n\nexport const createUploadImageHandler = (persistImage: PersistImage = persistUploadedImage): Controller => {\n    return async (req, res) => {\n        const { image } = req.body ?? {};\n\n        if (typeof image !== 'string') {\n            throw createAppError(400, 'INVALID_IMAGE_UPLOAD', 'No image uploaded');\n        }\n\n        const parsedImage = parseImageDataUrl(image);\n\n        if (!parsedImage) {\n            throw createAppError(400, 'INVALID_IMAGE_UPLOAD', 'No image uploaded');\n        }\n\n        let validatedImage;\n\n        try {\n            validatedImage = validateImagePayload({\n                buffer: Buffer.from(parsedImage.base64, 'base64'),\n                contentType: parsedImage.contentType,\n            });\n        } catch (error) {\n            if (error instanceof ImageValidationError) {\n                throw createUploadValidationError(error);\n            }\n\n            throw error;\n        }\n\n        const uploadedImage = await persistImage({\n            buffer: validatedImage.buffer,\n            extension: validatedImage.extension,\n        });\n\n        res.status(200).json(createUploadResponse(uploadedImage)).end();\n    };\n};\n"],"mappings":"AAAA,SAAS,sBAAsB;AAE/B,SAA6D,4BAA4B;AACzF,SAAS,sBAAsB,2BAA2B,4BAA4B;AAItF,MAAM,yBAAyB;AAE/B,MAAM,uBAAuB,CAAC,UAAiC;AAC3D,SAAO;AAAA,IACH,IAAI,MAAM;AAAA,IACV,KAAK,MAAM;AAAA,EACf;AACJ;AAEA,MAAM,oBAAoB,CAAC,UAAkB;AACzC,QAAM,QAAQ,uBAAuB,KAAK,KAAK;AAE/C,MAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,SAAS,MAAM,GAAG;AAClD,WAAO;AAAA,EACX;AAEA,SAAO;AAAA,IACH,QAAQ,MAAM,CAAC;AAAA,IACf,aAAa,0BAA0B,MAAM,CAAC,CAAC;AAAA,EACnD;AACJ;AAEA,MAAM,8BAA8B,CAAC,UAAgC;AACjE,MAAI,MAAM,SAAS,kCAAkC;AACjD,WAAO,eAAe,KAAK,iCAAiC,+CAA+C;AAAA,EAC/G;AAEA,SAAO,eAAe,KAAK,wBAAwB,oCAAoC;AAC3F;AAEO,MAAM,2BAA2B,CAAC,eAA6B,yBAAqC;AACvG,SAAO,OAAO,KAAK,QAAQ;AACvB,UAAM,EAAE,MAAM,IAAI,IAAI,QAAQ,CAAC;AAE/B,QAAI,OAAO,UAAU,UAAU;AAC3B,YAAM,eAAe,KAAK,wBAAwB,mBAAmB;AAAA,IACzE;AAEA,UAAM,cAAc,kBAAkB,KAAK;AAE3C,QAAI,CAAC,aAAa;AACd,YAAM,eAAe,KAAK,wBAAwB,mBAAmB;AAAA,IACzE;AAEA,QAAI;AAEJ,QAAI;AACA,uBAAiB,qBAAqB;AAAA,QAClC,QAAQ,OAAO,KAAK,YAAY,QAAQ,QAAQ;AAAA,QAChD,aAAa,YAAY;AAAA,MAC7B,CAAC;AAAA,IACL,SAAS,OAAO;AACZ,UAAI,iBAAiB,sBAAsB;AACvC,cAAM,4BAA4B,KAAK;AAAA,MAC3C;AAEA,YAAM;AAAA,IACV;AAEA,UAAM,gBAAgB,MAAM,aAAa;AAAA,MACrC,QAAQ,eAAe;AAAA,MACvB,WAAW,eAAe;AAAA,IAC9B,CAAC;AAED,QAAI,OAAO,GAAG,EAAE,KAAK,qBAAqB,aAAa,CAAC,EAAE,IAAI;AAAA,EAClE;AACJ;","names":[]}

package/server/dist/features/image/services/validation.js

@@ -0,0 +1,111 @@
+class ImageValidationError extends Error {
+  code;
+  status;
+  constructor(code, status, message) {
+    super(message);
+    this.name = "ImageValidationError";
+    this.code = code;
+    this.status = status;
+  }
+}
+const SUPPORTED_IMAGE_TYPES = /* @__PURE__ */ new Map([
+  ["image/png", "png"],
+  ["image/jpeg", "jpg"],
+  ["image/gif", "gif"],
+  ["image/webp", "webp"],
+  ["image/bmp", "bmp"],
+  ["image/avif", "avif"]
+]);
+const startsWithBytes = (buffer, bytes) => {
+  return bytes.every((byte, index) => buffer[index] === byte);
+};
+const readAscii = (buffer, start, end) => {
+  return buffer.subarray(start, end).toString("ascii");
+};
+const hasPngSignature = (buffer) => {
+  return buffer.length >= 8 && startsWithBytes(buffer, [137, 80, 78, 71, 13, 10, 26, 10]);
+};
+const hasJpegSignature = (buffer) => {
+  return buffer.length >= 3 && startsWithBytes(buffer, [255, 216, 255]);
+};
+const hasGifSignature = (buffer) => {
+  return buffer.length >= 6 && ["GIF87a", "GIF89a"].includes(readAscii(buffer, 0, 6));
+};
+const hasWebpSignature = (buffer) => {
+  return buffer.length >= 12 && readAscii(buffer, 0, 4) === "RIFF" && readAscii(buffer, 8, 12) === "WEBP";
+};
+const hasBmpSignature = (buffer) => {
+  return buffer.length >= 2 && readAscii(buffer, 0, 2) === "BM";
+};
+const hasAvifSignature = (buffer) => {
+  if (buffer.length < 16 || readAscii(buffer, 4, 8) !== "ftyp") {
+    return false;
+  }
+  const ftypBoxSize = buffer.readUInt32BE(0);
+  if (ftypBoxSize !== 0 && (ftypBoxSize < 16 || ftypBoxSize > buffer.length)) {
+    return false;
+  }
+  const isAvifBrand = (brand) => brand === "avif" || brand === "avis";
+  const majorBrand = readAscii(buffer, 8, 12);
+  if (isAvifBrand(majorBrand)) {
+    return true;
+  }
+  const boxEnd = ftypBoxSize === 0 ? buffer.length : ftypBoxSize;
+  for (let offset = 16; offset + 4 <= boxEnd; offset += 4) {
+    const brand = readAscii(buffer, offset, offset + 4);
+    if (isAvifBrand(brand)) {
+      return true;
+    }
+  }
+  return false;
+};
+const hasExpectedImageSignature = (contentType, buffer) => {
+  switch (contentType) {
+    case "image/png":
+      return hasPngSignature(buffer);
+    case "image/jpeg":
+      return hasJpegSignature(buffer);
+    case "image/gif":
+      return hasGifSignature(buffer);
+    case "image/webp":
+      return hasWebpSignature(buffer);
+    case "image/bmp":
+      return hasBmpSignature(buffer);
+    case "image/avif":
+      return hasAvifSignature(buffer);
+    default:
+      return false;
+  }
+};
+const normalizeImageContentType = (contentType) => {
+  return contentType?.split(";")[0]?.trim().toLowerCase() ?? "";
+};
+const getSupportedImageExtension = (contentType) => {
+  return SUPPORTED_IMAGE_TYPES.get(normalizeImageContentType(contentType));
+};
+const validateImagePayload = ({
+  buffer,
+  contentType: rawContentType
+}) => {
+  const contentType = normalizeImageContentType(rawContentType);
+  const extension = SUPPORTED_IMAGE_TYPES.get(contentType);
+  if (!extension) {
+    throw new ImageValidationError("IMAGE_UNSUPPORTED_CONTENT_TYPE", 415, "Image content type is not supported.");
+  }
+  const hasExpectedSignature = hasExpectedImageSignature(contentType, buffer);
+  if (!hasExpectedSignature) {
+    throw new ImageValidationError("IMAGE_INVALID_CONTENT", 415, "Image content does not match the declared type.");
+  }
+  return {
+    buffer,
+    contentType,
+    extension
+  };
+};
+export {
+  ImageValidationError,
+  getSupportedImageExtension,
+  normalizeImageContentType,
+  validateImagePayload
+};
+//# sourceMappingURL=validation.js.map

package/server/dist/features/image/services/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/features/image/services/validation.ts"],"sourcesContent":["export type ImageValidationErrorCode = 'IMAGE_INVALID_CONTENT' | 'IMAGE_UNSUPPORTED_CONTENT_TYPE';\n\nexport class ImageValidationError extends Error {\n    public readonly code: ImageValidationErrorCode;\n    public readonly status: number;\n\n    constructor(code: ImageValidationErrorCode, status: number, message: string) {\n        super(message);\n        this.name = 'ImageValidationError';\n        this.code = code;\n        this.status = status;\n    }\n}\n\ninterface ValidateImagePayloadInput {\n    buffer: Buffer;\n    contentType: string;\n}\n\nexport interface ValidatedImagePayload {\n    buffer: Buffer;\n    contentType: string;\n    extension: string;\n}\n\nconst SUPPORTED_IMAGE_TYPES = new Map([\n    ['image/png', 'png'],\n    ['image/jpeg', 'jpg'],\n    ['image/gif', 'gif'],\n    ['image/webp', 'webp'],\n    ['image/bmp', 'bmp'],\n    ['image/avif', 'avif'],\n]);\n\nconst startsWithBytes = (buffer: Buffer, bytes: number[]) => {\n    return bytes.every((byte, index) => buffer[index] === byte);\n};\n\nconst readAscii = (buffer: Buffer, start: number, end: number) => {\n    return buffer.subarray(start, end).toString('ascii');\n};\n\nconst hasPngSignature = (buffer: Buffer) => {\n    return buffer.length >= 8 && startsWithBytes(buffer, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);\n};\n\nconst hasJpegSignature = (buffer: Buffer) => {\n    return buffer.length >= 3 && startsWithBytes(buffer, [0xff, 0xd8, 0xff]);\n};\n\nconst hasGifSignature = (buffer: Buffer) => {\n    return buffer.length >= 6 && ['GIF87a', 'GIF89a'].includes(readAscii(buffer, 0, 6));\n};\n\nconst hasWebpSignature = (buffer: Buffer) => {\n    return buffer.length >= 12 && readAscii(buffer, 0, 4) === 'RIFF' && readAscii(buffer, 8, 12) === 'WEBP';\n};\n\nconst hasBmpSignature = (buffer: Buffer) => {\n    return buffer.length >= 2 && readAscii(buffer, 0, 2) === 'BM';\n};\n\nconst hasAvifSignature = (buffer: Buffer) => {\n    if (buffer.length < 16 || readAscii(buffer, 4, 8) !== 'ftyp') {\n        return false;\n    }\n\n    const ftypBoxSize = buffer.readUInt32BE(0);\n\n    if (ftypBoxSize !== 0 && (ftypBoxSize < 16 || ftypBoxSize > buffer.length)) {\n        return false;\n    }\n\n    const isAvifBrand = (brand: string) => brand === 'avif' || brand === 'avis';\n    const majorBrand = readAscii(buffer, 8, 12);\n\n    if (isAvifBrand(majorBrand)) {\n        return true;\n    }\n\n    const boxEnd = ftypBoxSize === 0 ? buffer.length : ftypBoxSize;\n\n    for (let offset = 16; offset + 4 <= boxEnd; offset += 4) {\n        const brand = readAscii(buffer, offset, offset + 4);\n\n        if (isAvifBrand(brand)) {\n            return true;\n        }\n    }\n\n    return false;\n};\n\nconst hasExpectedImageSignature = (contentType: string, buffer: Buffer) => {\n    switch (contentType) {\n        case 'image/png':\n            return hasPngSignature(buffer);\n        case 'image/jpeg':\n            return hasJpegSignature(buffer);\n        case 'image/gif':\n            return hasGifSignature(buffer);\n        case 'image/webp':\n            return hasWebpSignature(buffer);\n        case 'image/bmp':\n            return hasBmpSignature(buffer);\n        case 'image/avif':\n            return hasAvifSignature(buffer);\n        default:\n            return false;\n    }\n};\n\nexport const normalizeImageContentType = (contentType: string | null | undefined) => {\n    return contentType?.split(';')[0]?.trim().toLowerCase() ?? '';\n};\n\nexport const getSupportedImageExtension = (contentType: string) => {\n    return SUPPORTED_IMAGE_TYPES.get(normalizeImageContentType(contentType));\n};\n\nexport const validateImagePayload = ({\n    buffer,\n    contentType: rawContentType,\n}: ValidateImagePayloadInput): ValidatedImagePayload => {\n    const contentType = normalizeImageContentType(rawContentType);\n    const extension = SUPPORTED_IMAGE_TYPES.get(contentType);\n\n    if (!extension) {\n        throw new ImageValidationError('IMAGE_UNSUPPORTED_CONTENT_TYPE', 415, 'Image content type is not supported.');\n    }\n\n    const hasExpectedSignature = hasExpectedImageSignature(contentType, buffer);\n\n    if (!hasExpectedSignature) {\n        throw new ImageValidationError('IMAGE_INVALID_CONTENT', 415, 'Image content does not match the declared type.');\n    }\n\n    return {\n        buffer,\n        contentType,\n        extension,\n    };\n};\n"],"mappings":"AAEO,MAAM,6BAA6B,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EAEhB,YAAY,MAAgC,QAAgB,SAAiB;AACzE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAClB;AACJ;AAaA,MAAM,wBAAwB,oBAAI,IAAI;AAAA,EAClC,CAAC,aAAa,KAAK;AAAA,EACnB,CAAC,cAAc,KAAK;AAAA,EACpB,CAAC,aAAa,KAAK;AAAA,EACnB,CAAC,cAAc,MAAM;AAAA,EACrB,CAAC,aAAa,KAAK;AAAA,EACnB,CAAC,cAAc,MAAM;AACzB,CAAC;AAED,MAAM,kBAAkB,CAAC,QAAgB,UAAoB;AACzD,SAAO,MAAM,MAAM,CAAC,MAAM,UAAU,OAAO,KAAK,MAAM,IAAI;AAC9D;AAEA,MAAM,YAAY,CAAC,QAAgB,OAAe,QAAgB;AAC9D,SAAO,OAAO,SAAS,OAAO,GAAG,EAAE,SAAS,OAAO;AACvD;AAEA,MAAM,kBAAkB,CAAC,WAAmB;AACxC,SAAO,OAAO,UAAU,KAAK,gBAAgB,QAAQ,CAAC,KAAM,IAAM,IAAM,IAAM,IAAM,IAAM,IAAM,EAAI,CAAC;AACzG;AAEA,MAAM,mBAAmB,CAAC,WAAmB;AACzC,SAAO,OAAO,UAAU,KAAK,gBAAgB,QAAQ,CAAC,KAAM,KAAM,GAAI,CAAC;AAC3E;AAEA,MAAM,kBAAkB,CAAC,WAAmB;AACxC,SAAO,OAAO,UAAU,KAAK,CAAC,UAAU,QAAQ,EAAE,SAAS,UAAU,QAAQ,GAAG,CAAC,CAAC;AACtF;AAEA,MAAM,mBAAmB,CAAC,WAAmB;AACzC,SAAO,OAAO,UAAU,MAAM,UAAU,QAAQ,GAAG,CAAC,MAAM,UAAU,UAAU,QAAQ,GAAG,EAAE,MAAM;AACrG;AAEA,MAAM,kBAAkB,CAAC,WAAmB;AACxC,SAAO,OAAO,UAAU,KAAK,UAAU,QAAQ,GAAG,CAAC,MAAM;AAC7D;AAEA,MAAM,mBAAmB,CAAC,WAAmB;AACzC,MAAI,OAAO,SAAS,MAAM,UAAU,QAAQ,GAAG,CAAC,MAAM,QAAQ;AAC1D,WAAO;AAAA,EACX;AAEA,QAAM,cAAc,OAAO,aAAa,CAAC;AAEzC,MAAI,gBAAgB,MAAM,cAAc,MAAM,cAAc,OAAO,SAAS;AACxE,WAAO;AAAA,EACX;AAEA,QAAM,cAAc,CAAC,UAAkB,UAAU,UAAU,UAAU;AACrE,QAAM,aAAa,UAAU,QAAQ,GAAG,EAAE;AAE1C,MAAI,YAAY,UAAU,GAAG;AACzB,WAAO;AAAA,EACX;AAEA,QAAM,SAAS,gBAAgB,IAAI,OAAO,SAAS;AAEnD,WAAS,SAAS,IAAI,SAAS,KAAK,QAAQ,UAAU,GAAG;AACrD,UAAM,QAAQ,UAAU,QAAQ,QAAQ,SAAS,CAAC;AAElD,QAAI,YAAY,KAAK,GAAG;AACpB,aAAO;AAAA,IACX;AAAA,EACJ;AAEA,SAAO;AACX;AAEA,MAAM,4BAA4B,CAAC,aAAqB,WAAmB;AACvE,UAAQ,aAAa;AAAA,IACjB,KAAK;AACD,aAAO,gBAAgB,MAAM;AAAA,IACjC,KAAK;AACD,aAAO,iBAAiB,MAAM;AAAA,IAClC,KAAK;AACD,aAAO,gBAAgB,MAAM;AAAA,IACjC,KAAK;AACD,aAAO,iBAAiB,MAAM;AAAA,IAClC,KAAK;AACD,aAAO,gBAAgB,MAAM;AAAA,IACjC,KAAK;AACD,aAAO,iBAAiB,MAAM;AAAA,IAClC;AACI,aAAO;AAAA,EACf;AACJ;AAEO,MAAM,4BAA4B,CAAC,gBAA2C;AACjF,SAAO,aAAa,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY,KAAK;AAC/D;AAEO,MAAM,6BAA6B,CAAC,gBAAwB;AAC/D,SAAO,sBAAsB,IAAI,0BAA0B,WAAW,CAAC;AAC3E;AAEO,MAAM,uBAAuB,CAAC;AAAA,EACjC;AAAA,EACA,aAAa;AACjB,MAAwD;AACpD,QAAM,cAAc,0BAA0B,cAAc;AAC5D,QAAM,YAAY,sBAAsB,IAAI,WAAW;AAEvD,MAAI,CAAC,WAAW;AACZ,UAAM,IAAI,qBAAqB,kCAAkC,KAAK,sCAAsC;AAAA,EAChH;AAEA,QAAM,uBAAuB,0BAA0B,aAAa,MAAM;AAE1E,MAAI,CAAC,sBAAsB;AACvB,UAAM,IAAI,qBAAqB,yBAAyB,KAAK,iDAAiD;AAAA,EAClH;AAEA,SAAO;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,EACJ;AACJ;","names":[]}

package/server/dist/features/mcp-admin/http/handlers.js

@@ -1,8 +1,16 @@
+import { getOceanBrainVersionInfo } from "../../../modules/app-version.js";
 import { createAppError } from "../../../modules/error-handler.js";
 import { createMcpAdminService } from "../service.js";
+const createMcpAdminStatusResponse = async (service) => {
+  const status = await service.getStatus();
+  return {
+    ...status,
+    server: getOceanBrainVersionInfo()
+  };
+};
 const createMcpAdminStatusHandler = (service = createMcpAdminService()) => {
   return async (_req, res) => {
-    const status = await service.getStatus();
+    const status = await createMcpAdminStatusResponse(service);
     res.status(200).json(status).end();
   };
 };
@@ -13,7 +21,7 @@ const createMcpAdminSetEnabledHandler = (service = createMcpAdminService()) => {
       throw createAppError(400, "INVALID_MCP_ENABLED", "enabled must be a boolean.");
     }
     await service.setEnabled(enabled);
-    const status = await service.getStatus();
+    const status = await createMcpAdminStatusResponse(service);
     res.status(200).json(status).end();
   };
 };
@@ -29,7 +37,7 @@ const createMcpAdminRotateTokenHandler = (service = createMcpAdminService()) =>
 const createMcpAdminRevokeTokenHandler = (service = createMcpAdminService()) => {
   return async (_req, res) => {
     await service.revokeActiveToken();
-    const status = await service.getStatus();
+    const status = await createMcpAdminStatusResponse(service);
     res.status(200).json(status).end();
   };
 };

package/server/dist/features/mcp-admin/http/handlers.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/features/mcp-admin/http/handlers.ts"],"sourcesContent":["import { createAppError } from '~/modules/error-handler.js';\nimport type { Controller } from '~/types/index.js';\nimport { createMcpAdminService, type McpAdminService } from '../service.js';\n\ntype McpAdminControllerService = Pick<\n    McpAdminService,\n    'getStatus' | 'setEnabled' | 'rotateToken' | 'revokeActiveToken'\n>;\n\nexport const createMcpAdminStatusHandler = (\n    service: McpAdminControllerService = createMcpAdminService(),\n): Controller => {\n    return async (_req, res) => {\n        const status = await service.getStatus();\n        res.status(200).json(status).end();\n    };\n};\n\nexport const createMcpAdminSetEnabledHandler = (\n    service: McpAdminControllerService = createMcpAdminService(),\n): Controller => {\n    return async (req, res) => {\n        const enabled = req.body?.enabled;\n        if (typeof enabled !== 'boolean') {\n            throw createAppError(400, 'INVALID_MCP_ENABLED', 'enabled must be a boolean.');\n        }\n\n        await service.setEnabled(enabled);\n        const status = await service.getStatus();\n        res.status(200).json(status).end();\n    };\n};\n\nexport const createMcpAdminRotateTokenHandler = (\n    service: McpAdminControllerService = createMcpAdminService(),\n): Controller => {\n    return async (_req, res) => {\n        const result = await service.rotateToken();\n        res.status(200)\n            .json({\n                token: result.token,\n                message: 'Save this token now. It is shown only once.',\n            })\n            .end();\n    };\n};\n\nexport const createMcpAdminRevokeTokenHandler = (\n    service: McpAdminControllerService = createMcpAdminService(),\n): Controller => {\n    return async (_req, res) => {\n        await service.revokeActiveToken();\n        const status = await service.getStatus();\n        res.status(200).json(status).end();\n    };\n};\n"],"mappings":"AAAA,SAAS,sBAAsB;AAE/B,SAAS,6BAAmD;AAOrD,MAAM,8BAA8B,CACvC,UAAqC,sBAAsB,MAC9C;AACb,SAAO,OAAO,MAAM,QAAQ;AACxB,UAAM,SAAS,MAAM,QAAQ,UAAU;AACvC,QAAI,OAAO,GAAG,EAAE,KAAK,MAAM,EAAE,IAAI;AAAA,EACrC;AACJ;AAEO,MAAM,kCAAkC,CAC3C,UAAqC,sBAAsB,MAC9C;AACb,SAAO,OAAO,KAAK,QAAQ;AACvB,UAAM,UAAU,IAAI,MAAM;AAC1B,QAAI,OAAO,YAAY,WAAW;AAC9B,YAAM,eAAe,KAAK,uBAAuB,4BAA4B;AAAA,IACjF;AAEA,UAAM,QAAQ,WAAW,OAAO;AAChC,UAAM,SAAS,MAAM,QAAQ,UAAU;AACvC,QAAI,OAAO,GAAG,EAAE,KAAK,MAAM,EAAE,IAAI;AAAA,EACrC;AACJ;AAEO,MAAM,mCAAmC,CAC5C,UAAqC,sBAAsB,MAC9C;AACb,SAAO,OAAO,MAAM,QAAQ;AACxB,UAAM,SAAS,MAAM,QAAQ,YAAY;AACzC,QAAI,OAAO,GAAG,EACT,KAAK;AAAA,MACF,OAAO,OAAO;AAAA,MACd,SAAS;AAAA,IACb,CAAC,EACA,IAAI;AAAA,EACb;AACJ;AAEO,MAAM,mCAAmC,CAC5C,UAAqC,sBAAsB,MAC9C;AACb,SAAO,OAAO,MAAM,QAAQ;AACxB,UAAM,QAAQ,kBAAkB;AAChC,UAAM,SAAS,MAAM,QAAQ,UAAU;AACvC,QAAI,OAAO,GAAG,EAAE,KAAK,MAAM,EAAE,IAAI;AAAA,EACrC;AACJ;","names":[]}
+{"version":3,"sources":["../../../../src/features/mcp-admin/http/handlers.ts"],"sourcesContent":["import { getOceanBrainVersionInfo } from '~/modules/app-version.js';\nimport { createAppError } from '~/modules/error-handler.js';\nimport type { Controller } from '~/types/index.js';\nimport { createMcpAdminService, type McpAdminService } from '../service.js';\n\ntype McpAdminControllerService = Pick<\n    McpAdminService,\n    'getStatus' | 'setEnabled' | 'rotateToken' | 'revokeActiveToken'\n>;\n\nconst createMcpAdminStatusResponse = async (service: McpAdminControllerService) => {\n    const status = await service.getStatus();\n\n    return {\n        ...status,\n        server: getOceanBrainVersionInfo(),\n    };\n};\n\nexport const createMcpAdminStatusHandler = (\n    service: McpAdminControllerService = createMcpAdminService(),\n): Controller => {\n    return async (_req, res) => {\n        const status = await createMcpAdminStatusResponse(service);\n        res.status(200).json(status).end();\n    };\n};\n\nexport const createMcpAdminSetEnabledHandler = (\n    service: McpAdminControllerService = createMcpAdminService(),\n): Controller => {\n    return async (req, res) => {\n        const enabled = req.body?.enabled;\n        if (typeof enabled !== 'boolean') {\n            throw createAppError(400, 'INVALID_MCP_ENABLED', 'enabled must be a boolean.');\n        }\n\n        await service.setEnabled(enabled);\n        const status = await createMcpAdminStatusResponse(service);\n        res.status(200).json(status).end();\n    };\n};\n\nexport const createMcpAdminRotateTokenHandler = (\n    service: McpAdminControllerService = createMcpAdminService(),\n): Controller => {\n    return async (_req, res) => {\n        const result = await service.rotateToken();\n        res.status(200)\n            .json({\n                token: result.token,\n                message: 'Save this token now. It is shown only once.',\n            })\n            .end();\n    };\n};\n\nexport const createMcpAdminRevokeTokenHandler = (\n    service: McpAdminControllerService = createMcpAdminService(),\n): Controller => {\n    return async (_req, res) => {\n        await service.revokeActiveToken();\n        const status = await createMcpAdminStatusResponse(service);\n        res.status(200).json(status).end();\n    };\n};\n"],"mappings":"AAAA,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAE/B,SAAS,6BAAmD;AAO5D,MAAM,+BAA+B,OAAO,YAAuC;AAC/E,QAAM,SAAS,MAAM,QAAQ,UAAU;AAEvC,SAAO;AAAA,IACH,GAAG;AAAA,IACH,QAAQ,yBAAyB;AAAA,EACrC;AACJ;AAEO,MAAM,8BAA8B,CACvC,UAAqC,sBAAsB,MAC9C;AACb,SAAO,OAAO,MAAM,QAAQ;AACxB,UAAM,SAAS,MAAM,6BAA6B,OAAO;AACzD,QAAI,OAAO,GAAG,EAAE,KAAK,MAAM,EAAE,IAAI;AAAA,EACrC;AACJ;AAEO,MAAM,kCAAkC,CAC3C,UAAqC,sBAAsB,MAC9C;AACb,SAAO,OAAO,KAAK,QAAQ;AACvB,UAAM,UAAU,IAAI,MAAM;AAC1B,QAAI,OAAO,YAAY,WAAW;AAC9B,YAAM,eAAe,KAAK,uBAAuB,4BAA4B;AAAA,IACjF;AAEA,UAAM,QAAQ,WAAW,OAAO;AAChC,UAAM,SAAS,MAAM,6BAA6B,OAAO;AACzD,QAAI,OAAO,GAAG,EAAE,KAAK,MAAM,EAAE,IAAI;AAAA,EACrC;AACJ;AAEO,MAAM,mCAAmC,CAC5C,UAAqC,sBAAsB,MAC9C;AACb,SAAO,OAAO,MAAM,QAAQ;AACxB,UAAM,SAAS,MAAM,QAAQ,YAAY;AACzC,QAAI,OAAO,GAAG,EACT,KAAK;AAAA,MACF,OAAO,OAAO;AAAA,MACd,SAAS;AAAA,IACb,CAAC,EACA,IAAI;AAAA,EACb;AACJ;AAEO,MAAM,mCAAmC,CAC5C,UAAqC,sBAAsB,MAC9C;AACb,SAAO,OAAO,MAAM,QAAQ;AACxB,UAAM,QAAQ,kBAAkB;AAChC,UAAM,SAAS,MAAM,6BAA6B,OAAO;AACzD,QAAI,OAAO,GAAG,EAAE,KAAK,MAAM,EAAE,IAAI;AAAA,EACrC;AACJ;","names":[]}