papilot 0.0.0-stage → 0.1.0

package/src/server/review.ts

@@ -0,0 +1,53 @@
+import { pathToFileURL } from 'node:url';
+import path from 'node:path';
+import { ENGINE } from './paths.ts';
+import type { Task } from '../shared.ts';
+
+export interface ReviewClient { url: string; token: string; get<T = any>(route: string): Promise<T>; post<T = any>(route: string, body?: unknown): Promise<T> }
+let modulePromise: Promise<{ connect: (root: string) => Promise<ReviewClient> }> | null = null;
+export function reviewClient(root: string): Promise<ReviewClient> {
+  modulePromise ??= import(pathToFileURL(path.join(ENGINE, 'src/client.ts')).href);
+  return modulePromise!.then(module => module.connect(root));
+}
+export const taskRoute = (name: string) => `/api/tasks/${encodeURIComponent(name)}`;
+
+export function confirmedReviewResponse(status: number, value: unknown, task: string): boolean {
+  if (!value || typeof value !== 'object') return false;
+  const result = value as Record<string, unknown>;
+  if (status === 400 || status === 409) return typeof result.error === 'string';
+  return status >= 200 && status < 300 && result.task === task && typeof result.csrf === 'string' && typeof result.closed === 'boolean'
+    && result.decisions !== null && typeof result.decisions === 'object' && !Array.isArray(result.decisions);
+}
+
+/** Add current workspace availability to viewer state; standalone engine state stays unchanged. */
+export function annotateReviewState(value: unknown, tasks: readonly Task[]): unknown {
+  if (!value || typeof value !== 'object' || typeof (value as any).task !== 'string'
+    || !confirmedReviewResponse(200, value, (value as any).task)) return value;
+  const state = value as Record<string, unknown>;
+  const task = tasks.find(task => task.name === state.task);
+  let decisionLock: string | null = null;
+  let commentLock: string | null = null;
+  if (!task) decisionLock = commentLock = 'This task is no longer available in Papilot. Return to the workspace.';
+  else if (state.closed) decisionLock = commentLock = 'This review is finished. Accepted changes are in your manuscript.';
+  else if (task.status === 'deleting') decisionLock = commentLock = 'This task is being deleted. Review actions and comments are unavailable.';
+  else if (task.status === 'uncertain') decisionLock = 'Select Check status in Papilot before accepting, rejecting, or undoing changes. You can still add comments.';
+  else if (task.status === 'building') decisionLock = 'Wait for the PDF build before accepting, rejecting, or undoing changes. You can still add comments.';
+  else if (['running', 'waiting_input', 'queued'].includes(task.status)) decisionLock = 'Pause this task in Papilot before accepting, rejecting, or undoing changes. You can still add comments.';
+  else if (task.pendingReview) decisionLock = 'Wait for the current review action before accepting, rejecting, or undoing changes. You can still add comments.';
+  return { ...state, decisionLock, commentLock };
+}
+
+export function allowedReviewRoute(route: string, method: string): boolean {
+  if (route.includes('..') || route.includes('\\')) return false;
+  if (method === 'GET') return route === '/' || /^\/(assets|fonts)\/[\w./-]+$/.test(route) || /^\/files\/[a-z0-9-]+\/\d+\/[\w.-]+\.(svg|png)$/.test(route) || /^\/api\/tasks(?:\/[a-z0-9-]+(?:\/(?:state|rounds\/\d+))?)?$/.test(route);
+  return method === 'POST' && /^\/api\/tasks\/[a-z0-9-]+\/(decide|undo|note)$/.test(route);
+}
+export function rewriteReviewJson(value: any, prefix: string): any {
+  if (Array.isArray(value)) return value.map(v => rewriteReviewJson(v, prefix));
+  if (value && typeof value === 'object') return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, k === 'url' && typeof v === 'string' && /^http:\/\/(127\.0\.0\.1|localhost):\d+\//.test(v) ? prefix + new URL(v).pathname + new URL(v).search : rewriteReviewJson(v, prefix)]));
+  return typeof value === 'string' && value.startsWith('/files/') ? prefix + value : value;
+}
+export function rewriteReviewHtml(html: string, prefix: string): string {
+  const script = `<script>(()=>{const prefix=${JSON.stringify(prefix)};if(!crypto.randomUUID)crypto.randomUUID=()=>Array.from(crypto.getRandomValues(new Uint8Array(20)),b=>b.toString(16).padStart(2,'0')).join('');const original=window.fetch;window.fetch=(input,init)=>{if(typeof input==='string'&&input.startsWith('/api/'))input=prefix+input;return original.call(window,input,init)};})();</script>`;
+  return html.replace(/(src|href)="\/(?!\/)/g, `$1="${prefix}/`).replace('<head>', '<head>' + script);
+}

package/src/server/security.ts

@@ -0,0 +1,15 @@
+import type { IncomingHttpHeaders } from 'node:http';
+export function authorize(headers: IncomingHttpHeaders, remoteAddress: string | undefined, port: number, publicOrigin: string, owner: string): string | null {
+  if (!['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(remoteAddress || '')) return 'Papilot only accepts local or Tailscale Serve connections.';
+  const local = new Set([`localhost:${port}`, `127.0.0.1:${port}`]);
+  const host = headers.host || '';
+  const remoteHost = publicOrigin ? new URL(publicOrigin).host : '';
+  if ((headers['x-forwarded-for'] || headers['tailscale-user-login']) && (!owner || headers['tailscale-user-login'] !== owner)) return 'This Tailscale account does not have access.';
+  if (local.has(host)) {
+    if (headers.origin && ![`http://localhost:${port}`, `http://127.0.0.1:${port}`].includes(headers.origin)) return 'The request origin does not match.';
+    return null;
+  }
+  if (host !== remoteHost || !owner || headers['tailscale-user-login'] !== owner) return 'Use your authorized Tailscale account to access Papilot.';
+  if (headers.origin && headers.origin !== publicOrigin) return 'The request origin does not match.';
+  return null;
+}

package/src/server/store.ts

@@ -0,0 +1,60 @@
+import { DatabaseSync } from 'node:sqlite';
+import { EventEmitter } from 'node:events';
+import fs from 'node:fs';
+import path from 'node:path';
+import type { Annotation, Project, Task, Run, TimelineItem } from '../shared.ts';
+
+export class Store extends EventEmitter {
+  db: DatabaseSync;
+  constructor(file: string) {
+    super();
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    this.db = new DatabaseSync(file);
+    this.db.exec(`PRAGMA journal_mode=WAL; PRAGMA busy_timeout=5000;
+      CREATE TABLE IF NOT EXISTS projects(id TEXT PRIMARY KEY, path TEXT UNIQUE NOT NULL, data TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS tasks(id TEXT PRIMARY KEY, project_id TEXT NOT NULL, data TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS runs(id TEXT PRIMARY KEY, task_id TEXT NOT NULL, request_key TEXT UNIQUE NOT NULL, status TEXT NOT NULL, data TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS items(id TEXT PRIMARY KEY, task_id TEXT NOT NULL, created INTEGER NOT NULL, data TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS deleted_tasks(id TEXT PRIMARY KEY, deleted INTEGER NOT NULL);
+      CREATE TABLE IF NOT EXISTS annotations(id TEXT PRIMARY KEY, project_id TEXT NOT NULL, data TEXT NOT NULL);
+      CREATE INDEX IF NOT EXISTS task_items ON items(task_id,created);
+      CREATE INDEX IF NOT EXISTS task_runs ON runs(task_id,status);`);
+  }
+  private rows<T>(table: string): T[] { return (this.db.prepare(`SELECT data FROM ${table} ORDER BY rowid`).all() as { data: string }[]).map(r => JSON.parse(r.data)); }
+  projects() { return this.rows<Project>('projects'); }
+  tasks() { return this.rows<Task>('tasks'); }
+  runs() { return this.rows<Run>('runs'); }
+  project(id: string) { const v = this.projects().find(p => p.id === id); if (!v) throw new Error('Paper project not found.'); return v; }
+  task(id: string) { const row = this.db.prepare('SELECT data FROM tasks WHERE id=?').get(id) as { data: string } | undefined; if (!row) throw new Error('Task not found.'); return JSON.parse(row.data) as Task; }
+  projectByPath(p: string) { return this.projects().find(project => project.path === p); }
+  saveProject(p: Project) { this.db.prepare('INSERT INTO projects VALUES(?,?,?) ON CONFLICT(id) DO UPDATE SET path=excluded.path,data=excluded.data').run(p.id, p.path, JSON.stringify(p)); this.emit('change'); }
+  saveTask(t: Task) { t.updatedAt = Date.now(); this.db.prepare('INSERT INTO tasks VALUES(?,?,?) ON CONFLICT(id) DO UPDATE SET data=excluded.data').run(t.id, t.projectId, JSON.stringify(t)); this.emit('change'); return t; }
+  updateTask(id: string, update: Partial<Task>) { return this.saveTask({ ...this.task(id), ...update }); }
+  saveRun(r: Run) { this.db.prepare('INSERT INTO runs VALUES(?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET status=excluded.status,data=excluded.data').run(r.id, r.taskId, r.requestKey, r.status, JSON.stringify(r)); this.emit('change'); }
+  runByKey(key: string) { const row = this.db.prepare('SELECT data FROM runs WHERE request_key=?').get(key) as { data: string } | undefined; return row ? JSON.parse(row.data) as Run : undefined; }
+  items(taskId: string) { return (this.db.prepare('SELECT data FROM items WHERE task_id=? ORDER BY created,rowid').all(taskId) as { data: string }[]).map(r => JSON.parse(r.data) as TimelineItem); }
+  saveItem(item: TimelineItem) { this.db.prepare('INSERT INTO items VALUES(?,?,?,?) ON CONFLICT(id) DO UPDATE SET data=excluded.data').run(item.id, item.taskId, item.createdAt, JSON.stringify(item)); this.emit('change'); }
+  annotations(projectId: string) { return (this.db.prepare('SELECT data FROM annotations WHERE project_id=? ORDER BY rowid').all(projectId) as { data: string }[]).map(r => JSON.parse(r.data) as Annotation); }
+  saveAnnotation(a: Annotation) { this.db.prepare('INSERT INTO annotations VALUES(?,?,?) ON CONFLICT(id) DO UPDATE SET data=excluded.data').run(a.id, a.projectId, JSON.stringify(a)); this.emit('change'); return a; }
+  deleteAnnotation(projectId: string, id: string) { this.db.prepare('DELETE FROM annotations WHERE id=? AND project_id=?').run(id, projectId); this.emit('change'); }
+  taskDeleted(id: string) { return Boolean(this.db.prepare('SELECT 1 FROM deleted_tasks WHERE id=?').get(id)); }
+  deleteTask(id: string) {
+    this.transaction(() => {
+      this.db.prepare('INSERT INTO deleted_tasks VALUES(?,?) ON CONFLICT(id) DO NOTHING').run(id, Date.now());
+      this.db.prepare('DELETE FROM items WHERE task_id=?').run(id);
+      this.db.prepare('DELETE FROM runs WHERE task_id=?').run(id);
+      this.db.prepare('DELETE FROM tasks WHERE id=?').run(id);
+    });
+    this.emit('change');
+  }
+  transaction<T>(fn: () => T): T { this.db.exec('BEGIN IMMEDIATE'); try { const result = fn(); this.db.exec('COMMIT'); return result; } catch (e) { this.db.exec('ROLLBACK'); throw e; } }
+  recover() {
+    this.transaction(() => {
+      for (const t of this.tasks().filter(t => t.status === 'deleting')) this.updateTask(t.id, { error: 'The server restarted during deletion. Retry deletion to confirm cleanup.' });
+      for (const t of this.tasks().filter(t => t.pendingReview)) this.updateTask(t.id, { status: 'uncertain', error: 'The server restarted before a review action was confirmed. Select Check status before continuing.' });
+      for (const r of this.runs().filter(r => r.status === 'running')) this.saveRun({ ...r, status: 'interrupted', finishedAt: Date.now() });
+      for (const t of this.tasks().filter(t => ['running', 'waiting_input'].includes(t.status))) this.updateTask(t.id, { status: 'interrupted', turnId: null, error: 'The server restarted and interrupted the previous turn. Continue in the same conversation.' });
+    });
+  }
+  close() { this.db.close(); }
+}