qarpeo 0.0.0-alpha.10

package/dist/runtime/server/durable-objects/room.d.ts

@@ -0,0 +1,34 @@
+import type { DurableObjectState } from "../../../types";
+/**
+ * Cloudflare Durable Object implementing the WebSocket Hibernation API for Qarpeo Realtime rooms.
+ * Provides zero idle compute billing, instant peer-to-peer pub/sub, live presence tracking,
+ * and synchronized room state.
+ */
+export declare class QarpeoRoomDO {
+    ctx: DurableObjectState;
+    env: Record<string, any>;
+    private history;
+    private historyLoaded;
+    private historyLimit;
+    private lastSeq;
+    private roomState;
+    private stateLoaded;
+    constructor(ctx: DurableObjectState, env: Record<string, any>);
+    private loadHistory;
+    private recordHistory;
+    private loadState;
+    private saveState;
+    fetch(request: Request): Promise<Response>;
+    /** Upgrades incoming HTTP request to a hibernated WebSocket connection. */
+    private handleWebSocketUpgrade;
+    /** Receives incoming WebSocket message from a hibernated client. */
+    webSocketMessage(ws: any, message: string | ArrayBuffer): Promise<void>;
+    /** Triggered when a hibernated WebSocket connection closes. */
+    webSocketClose(ws: any, _code: number, _reason: string, _wasClean: boolean): Promise<void>;
+    /** Triggered when a WebSocket encounters an unrecoverable error. */
+    webSocketError(ws: any, _error: unknown): Promise<void>;
+    /** Broadcasts a message to all connected WebSockets in the room. */
+    private broadcast;
+    /** Returns current active users list in the room. */
+    private getPresenceList;
+}

package/dist/runtime/server/durable-objects/room.mjs

@@ -0,0 +1,514 @@
+const attachmentFallback = /* @__PURE__ */ new WeakMap();
+function setAttachment(ws, data) {
+  if (typeof ws.serializeAttachment === "function") {
+    try {
+      ws.serializeAttachment(data);
+      return;
+    } catch {
+    }
+  }
+  attachmentFallback.set(ws, data);
+}
+function getAttachment(ws) {
+  if (typeof ws.deserializeAttachment === "function") {
+    try {
+      const data = ws.deserializeAttachment();
+      if (data !== void 0 && data !== null) return data;
+    } catch {
+    }
+  }
+  return attachmentFallback.get(ws);
+}
+const MAX_CONNECTIONS_PER_ROOM = 100;
+export class QarpeoRoomDO {
+  ctx;
+  env;
+  history = [];
+  historyLoaded = false;
+  historyLimit = 50;
+  lastSeq = 0;
+  roomState = {};
+  stateLoaded = false;
+  constructor(ctx, env) {
+    this.ctx = ctx;
+    this.env = env;
+    this.historyLimit = Number(env?.REALTIME_HISTORY_LIMIT || env?.historyLimit || 50);
+  }
+  async loadHistory() {
+    if (this.historyLoaded) return this.history;
+    if (this.ctx.storage && typeof this.ctx.storage.get === "function") {
+      try {
+        const [stored, storedSeq] = await Promise.all([
+          this.ctx.storage.get("history"),
+          this.ctx.storage.get("last_seq")
+        ]);
+        this.history = stored || [];
+        this.lastSeq = storedSeq || (this.history.length > 0 ? this.history[this.history.length - 1].seq || this.history.length : 0);
+      } catch {
+      }
+    }
+    this.historyLoaded = true;
+    return this.history;
+  }
+  async recordHistory(msg) {
+    if (msg.type !== "message") return;
+    await this.loadHistory();
+    this.history.push(msg);
+    if (this.history.length > this.historyLimit) {
+      this.history = this.history.slice(-this.historyLimit);
+    }
+    if (this.ctx.storage && typeof this.ctx.storage.put === "function") {
+      try {
+        await Promise.all([
+          this.ctx.storage.put("history", this.history),
+          this.ctx.storage.put("last_seq", this.lastSeq)
+        ]);
+      } catch {
+      }
+    }
+  }
+  async loadState() {
+    if (this.stateLoaded) return this.roomState;
+    if (this.ctx.storage && typeof this.ctx.storage.get === "function") {
+      try {
+        const stored = await this.ctx.storage.get("room_state") || {};
+        this.roomState = stored;
+      } catch {
+      }
+    }
+    this.stateLoaded = true;
+    return this.roomState;
+  }
+  async saveState(state) {
+    this.roomState = state;
+    if (this.ctx.storage && typeof this.ctx.storage.put === "function") {
+      try {
+        await this.ctx.storage.put("room_state", this.roomState);
+      } catch {
+      }
+    }
+  }
+  async fetch(request) {
+    const url = new URL(request.url);
+    const upgradeHeader = request.headers.get("Upgrade") || request.headers.get("upgrade");
+    if (upgradeHeader === "websocket") {
+      return this.handleWebSocketUpgrade(request, url);
+    }
+    if (url.pathname === "/broadcast" && request.method === "POST") {
+      try {
+        const body = await request.json();
+        await this.loadHistory();
+        this.lastSeq++;
+        const msg = {
+          type: "message",
+          id: `msg_${Date.now()}_${this.lastSeq}`,
+          seq: this.lastSeq,
+          event: body.event,
+          payload: body.payload,
+          sender: body.sender || "server",
+          timestamp: Date.now()
+        };
+        await this.recordHistory(msg);
+        this.broadcast(msg, body.excludePeerId);
+        return new Response(JSON.stringify({ ok: true }), {
+          headers: { "Content-Type": "application/json" }
+        });
+      } catch (err) {
+        return new Response(JSON.stringify({ error: err.message || "Invalid broadcast payload" }), {
+          status: 400,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+    }
+    if (url.pathname === "/presence" && request.method === "GET") {
+      const presence = this.getPresenceList();
+      return new Response(JSON.stringify({ presence, count: presence.length }), {
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    if (url.pathname === "/state" && request.method === "GET") {
+      const state = await this.loadState();
+      return new Response(JSON.stringify({ state }), {
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    if (url.pathname === "/state" && request.method === "POST") {
+      try {
+        const body = await request.json();
+        await this.loadState();
+        if (body.patch) {
+          this.roomState = { ...this.roomState, ...body.patch };
+        } else if (body.state) {
+          this.roomState = body.state;
+        }
+        await this.saveState(this.roomState);
+        this.broadcast({
+          type: "state:sync",
+          state: this.roomState,
+          timestamp: Date.now()
+        });
+        return new Response(JSON.stringify({ ok: true, state: this.roomState }), {
+          headers: { "Content-Type": "application/json" }
+        });
+      } catch (err) {
+        return new Response(JSON.stringify({ error: err.message || "Failed to update state" }), {
+          status: 400,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+    }
+    if (url.pathname === "/history" && request.method === "GET") {
+      const history = await this.loadHistory();
+      const limit = Number(url.searchParams.get("limit")) || this.historyLimit;
+      const sinceSeq = Number(
+        url.searchParams.get("sinceSeq") || url.searchParams.get("lastSeq") || -1
+      );
+      const sinceTime = Number(url.searchParams.get("since") || 0);
+      let filtered = history;
+      if (sinceSeq >= 0) {
+        filtered = history.filter((m) => (m.seq ?? 0) > sinceSeq);
+      } else if (sinceTime > 0) {
+        filtered = history.filter((m) => (m.timestamp ?? 0) > sinceTime);
+      }
+      if (filtered.length > limit) {
+        filtered = filtered.slice(-limit);
+      }
+      return new Response(
+        JSON.stringify({
+          history: filtered,
+          count: filtered.length,
+          lastSeq: this.lastSeq
+        }),
+        {
+          headers: { "Content-Type": "application/json" }
+        }
+      );
+    }
+    if (url.pathname === "/history" && request.method === "DELETE") {
+      this.history = [];
+      if (this.ctx.storage && typeof this.ctx.storage.delete === "function") {
+        try {
+          await this.ctx.storage.delete("history");
+        } catch {
+        }
+      }
+      return new Response(JSON.stringify({ ok: true, cleared: true }), {
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    if (url.pathname === "/disconnect" && request.method === "POST") {
+      try {
+        const { userId } = await request.json();
+        let disconnected = 0;
+        if (userId) {
+          const sockets = this.ctx.getWebSockets ? this.ctx.getWebSockets() : [];
+          for (const ws of sockets) {
+            const att = getAttachment(ws);
+            if (att?.user?.id === userId) {
+              try {
+                ws.close(1e3, "Disconnected by server");
+                disconnected++;
+              } catch {
+              }
+            }
+          }
+        }
+        return new Response(JSON.stringify({ ok: true, disconnected }), {
+          headers: { "Content-Type": "application/json" }
+        });
+      } catch (err) {
+        return new Response(JSON.stringify({ error: err.message || "Failed to disconnect" }), {
+          status: 400,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+    }
+    return new Response("Not Found", { status: 404 });
+  }
+  /** Upgrades incoming HTTP request to a hibernated WebSocket connection. */
+  handleWebSocketUpgrade(request, _url) {
+    const maxConns = Number(this.env?.MAX_CONNECTIONS_PER_ROOM || this.env?.maxConnectionsPerRoom) || MAX_CONNECTIONS_PER_ROOM;
+    const activeSockets = this.ctx.getWebSockets ? this.ctx.getWebSockets() : [];
+    if (activeSockets.length >= maxConns) {
+      return new Response(`Room connection limit reached (max: ${maxConns})`, { status: 503 });
+    }
+    const isAnonymous = request.headers.get("x-qarpeo-is-anonymous") === "1";
+    const userId = request.headers.get("x-qarpeo-user-id") || `peer_${crypto.randomUUID().replace(/-/g, "").slice(0, 12)}`;
+    const name = request.headers.get("x-qarpeo-user-name") || "Anonymous";
+    const avatar = request.headers.get("x-qarpeo-user-avatar") || null;
+    let metadata;
+    const metaHeader = request.headers.get("x-qarpeo-user-meta");
+    if (metaHeader) {
+      try {
+        metadata = JSON.parse(metaHeader);
+      } catch {
+      }
+    }
+    let initialPresence;
+    const presenceHeader = request.headers.get("x-qarpeo-user-presence");
+    if (presenceHeader) {
+      try {
+        initialPresence = JSON.parse(presenceHeader);
+      } catch {
+      }
+    }
+    const user = {
+      id: userId,
+      name,
+      avatar,
+      metadata,
+      presence: initialPresence || {},
+      joinedAt: Date.now(),
+      isAnonymous
+    };
+    const pair = new globalThis.WebSocketPair();
+    const client = pair[0] || pair.client;
+    const server = pair[1] || pair.server;
+    if (typeof this.ctx.acceptWebSocket === "function") {
+      this.ctx.acceptWebSocket(server, [userId]);
+    }
+    setAttachment(server, { user });
+    const currentRoster = this.getPresenceList();
+    try {
+      server.send(
+        JSON.stringify({
+          type: "presence:sync",
+          presence: currentRoster,
+          timestamp: Date.now()
+        })
+      );
+    } catch {
+    }
+    const lastSeq = Number(
+      _url.searchParams.get("lastSeq") || _url.searchParams.get("sinceSeq") || request.headers.get("x-qarpeo-last-seq") || -1
+    );
+    const sinceTime = Number(
+      _url.searchParams.get("since") || _url.searchParams.get("sinceTime") || request.headers.get("x-qarpeo-since") || 0
+    );
+    const lastMsgId = _url.searchParams.get("lastMessageId") || _url.searchParams.get("lastId") || request.headers.get("x-qarpeo-last-id");
+    const isReconnecting = lastSeq >= 0 || !!lastMsgId || sinceTime > 0;
+    this.loadHistory().then((history) => {
+      if (history.length > 0) {
+        let replayList = history;
+        if (lastSeq >= 0) {
+          replayList = history.filter((m) => (m.seq ?? 0) > lastSeq);
+        } else if (lastMsgId) {
+          const idx = history.findIndex((m) => m.id === lastMsgId);
+          if (idx !== -1) {
+            replayList = history.slice(idx + 1);
+          }
+        } else if (sinceTime > 0) {
+          replayList = history.filter((m) => (m.timestamp ?? 0) > sinceTime);
+        }
+        try {
+          server.send(
+            JSON.stringify({
+              type: "history:sync",
+              history: replayList,
+              replay: isReconnecting,
+              lastSeq: this.lastSeq,
+              timestamp: Date.now()
+            })
+          );
+        } catch {
+        }
+      }
+    });
+    this.loadState().then((state) => {
+      if (Object.keys(state).length > 0) {
+        try {
+          server.send(
+            JSON.stringify({
+              type: "state:sync",
+              state,
+              timestamp: Date.now()
+            })
+          );
+        } catch {
+        }
+      }
+    });
+    this.broadcast(
+      {
+        type: "presence:join",
+        user,
+        timestamp: Date.now()
+      },
+      server
+    );
+    try {
+      return new Response(null, {
+        status: 101,
+        webSocket: client
+      });
+    } catch {
+      const res = new Response(null, { status: 200 });
+      Object.defineProperty(res, "status", { value: 101 });
+      Object.defineProperty(res, "webSocket", { value: client });
+      return res;
+    }
+  }
+  /** Receives incoming WebSocket message from a hibernated client. */
+  async webSocketMessage(ws, message) {
+    try {
+      const now = Date.now();
+      const att = getAttachment(ws) || {};
+      const windowStart = att.rateLimitWindow || now;
+      let msgCount = att.msgCount || 0;
+      if (now - windowStart >= 1e4) {
+        setAttachment(ws, { ...att, rateLimitWindow: now, msgCount: 1 });
+      } else {
+        msgCount++;
+        if (msgCount > 40) {
+          setAttachment(ws, { ...att, rateLimitWindow: windowStart, msgCount });
+          try {
+            ws.close(1008, "Rate limit exceeded");
+          } catch {
+          }
+          return;
+        }
+        setAttachment(ws, { ...att, rateLimitWindow: windowStart, msgCount });
+      }
+      let text = "";
+      if (typeof message === "string") {
+        text = message;
+      } else if (message instanceof ArrayBuffer) {
+        text = new TextDecoder().decode(message);
+      } else if (ArrayBuffer.isView(message)) {
+        text = new TextDecoder().decode(message.buffer);
+      }
+      const data = JSON.parse(text);
+      if (data.type === "ping") {
+        try {
+          ws.send(JSON.stringify({ type: "pong", timestamp: Date.now() }));
+        } catch {
+        }
+        return;
+      }
+      if (data.type === "presence:update") {
+        const attachment = getAttachment(ws) || {};
+        if (attachment.user) {
+          attachment.user.presence = {
+            ...attachment.user.presence || {},
+            ...data.presence || {}
+          };
+          setAttachment(ws, attachment);
+          this.broadcast(
+            {
+              type: "presence:update",
+              user: attachment.user,
+              timestamp: Date.now()
+            },
+            ws
+            // exclude self because client already has optimistic local state
+          );
+        }
+        return;
+      }
+      if (data.type === "state:patch" && data.patch) {
+        await this.loadState();
+        this.roomState = { ...this.roomState, ...data.patch };
+        await this.saveState(this.roomState);
+        this.broadcast(
+          {
+            type: "state:patch",
+            state: this.roomState,
+            payload: data.patch,
+            sender: getAttachment(ws)?.user?.id,
+            timestamp: Date.now()
+          },
+          ws
+        );
+        return;
+      }
+      if (data.type === "state:set" && data.state) {
+        await this.saveState(data.state);
+        this.broadcast(
+          {
+            type: "state:set",
+            state: this.roomState,
+            sender: getAttachment(ws)?.user?.id,
+            timestamp: Date.now()
+          },
+          ws
+        );
+        return;
+      }
+      if (data.type === "message" && data.event) {
+        const attachment = getAttachment(ws);
+        const user = attachment?.user;
+        await this.loadHistory();
+        this.lastSeq++;
+        const outbound = {
+          type: "message",
+          id: data.id || `msg_${Date.now()}_${this.lastSeq}`,
+          seq: this.lastSeq,
+          event: data.event,
+          payload: data.payload,
+          sender: user?.id,
+          user,
+          timestamp: Date.now()
+        };
+        await this.recordHistory(outbound);
+        this.broadcast(outbound, data.self === false ? ws : void 0);
+      }
+    } catch {
+    }
+  }
+  /** Triggered when a hibernated WebSocket connection closes. */
+  async webSocketClose(ws, _code, _reason, _wasClean) {
+    const attachment = getAttachment(ws);
+    if (attachment?.user) {
+      this.broadcast(
+        {
+          type: "presence:leave",
+          user: attachment.user,
+          timestamp: Date.now()
+        },
+        ws
+      );
+    }
+  }
+  /** Triggered when a WebSocket encounters an unrecoverable error. */
+  async webSocketError(ws, _error) {
+    try {
+      ws.close(1011, "WebSocket error");
+    } catch {
+    }
+  }
+  /** Broadcasts a message to all connected WebSockets in the room. */
+  broadcast(message, exclude) {
+    this.recordHistory(message);
+    const sockets = this.ctx.getWebSockets ? this.ctx.getWebSockets() : [];
+    const serialized = JSON.stringify(message);
+    for (const ws of sockets) {
+      if (exclude) {
+        if (typeof exclude === "string") {
+          const att = getAttachment(ws);
+          if (att?.user?.id === exclude) continue;
+        } else if (ws === exclude) {
+          continue;
+        }
+      }
+      try {
+        ws.send(serialized);
+      } catch {
+      }
+    }
+  }
+  /** Returns current active users list in the room. */
+  getPresenceList() {
+    const sockets = this.ctx.getWebSockets ? this.ctx.getWebSockets() : [];
+    const users = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const ws of sockets) {
+      const att = getAttachment(ws);
+      const user = att?.user;
+      if (user?.id && !seen.has(user.id)) {
+        seen.add(user.id);
+        users.push(user);
+      }
+    }
+    return users;
+  }
+}

package/dist/runtime/server/middleware/auth.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<string | undefined>>;
+export default _default;

package/dist/runtime/server/middleware/auth.mjs

@@ -0,0 +1,108 @@
+import {
+  defineEventHandler,
+  getRequestURL,
+  sendRedirect,
+  createError,
+  getRequestHeader
+} from "nuxt/server";
+import { getQarpeoConfig } from "../utils/config.mjs";
+import { getAuthContext } from "../utils/context.mjs";
+import { verifyKVSession, touchDeviceSession, clearAuthSession } from "../utils/session.mjs";
+import { resolveTenant } from "../utils/tenant.mjs";
+function matchRouteRule(path, rules) {
+  for (const [pattern, rule] of Object.entries(rules)) {
+    if (!rule) continue;
+    const regexPattern = "^" + pattern.replace(/:[a-zA-Z0-9_]+/g, "[^/]+").replace(/\/\*\*/g, "(/.*)?").replace(/\/\*/g, "/[^/]+") + "$";
+    if (new RegExp(regexPattern).test(path)) {
+      return rule;
+    }
+  }
+  return null;
+}
+export default defineEventHandler(async (event) => {
+  const url = getRequestURL(event);
+  const pathname = url.pathname;
+  const authConfig = getQarpeoConfig(event).auth;
+  const rules = authConfig.rules || {};
+  const rule = matchRouteRule(pathname, rules);
+  if (!rule) return;
+  const authCtx = await getAuthContext(event);
+  let user = authCtx?.user;
+  const session = authCtx?.session;
+  if (user && session?.sessionId && authConfig.session?.backend === "kv") {
+    const isSessionActive = await verifyKVSession(event, session.sessionId);
+    if (!isSessionActive) {
+      await clearAuthSession(event);
+      user = void 0;
+    }
+  }
+  if (user && session?.tenantId) {
+    const reqTenant = event.context?.tenant || await resolveTenant(event);
+    if (reqTenant?.id && session.tenantId !== reqTenant.id) {
+      user = void 0;
+    }
+  }
+  if (user && session?.sessionId && authConfig.session?.trackDevice !== false) {
+    await touchDeviceSession(event, session);
+  }
+  event.context.auth = authCtx;
+  if (!user) {
+    const isApi = pathname.startsWith("/api/") || getRequestHeader(event, "accept")?.includes("application/json");
+    if (isApi) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: "Unauthorized",
+        message: "Authentication required"
+      });
+    }
+    const loginPath = typeof rule === "object" && rule.redirect || authConfig.redirect?.login || "/login";
+    return sendRedirect(
+      event,
+      `${loginPath}?redirect=${encodeURIComponent(url.pathname + url.search)}`
+    );
+  }
+  if (typeof rule === "object" && rule.role) {
+    const allowedRoles = Array.isArray(rule.role) ? rule.role : [rule.role];
+    const userRole = user.role || "user";
+    if (!allowedRoles.includes(userRole)) {
+      const isApi = pathname.startsWith("/api/") || getRequestHeader(event, "accept")?.includes("application/json");
+      if (isApi) {
+        throw createError({
+          statusCode: 403,
+          statusMessage: "Forbidden",
+          message: "Insufficient permissions"
+        });
+      }
+      throw createError({
+        statusCode: 403,
+        statusMessage: "Forbidden",
+        message: "Access denied"
+      });
+    }
+  }
+  if (typeof rule === "object" && rule.organization) {
+    const currentOrgId = authCtx?.organization?.id || session?.currentOrganizationId;
+    if (!currentOrgId) {
+      const isApi = pathname.startsWith("/api/") || getRequestHeader(event, "accept")?.includes("application/json");
+      if (isApi) {
+        throw createError({
+          statusCode: 403,
+          statusMessage: "Forbidden",
+          message: "Active organization required"
+        });
+      }
+      const redirectPath = rule.redirect || "/org-select";
+      return sendRedirect(event, redirectPath);
+    }
+  }
+  if (typeof rule === "object" && rule.scope && authCtx?.token) {
+    const requiredScope = rule.scope;
+    if (!authCtx.hasScope(requiredScope)) {
+      throw createError({
+        statusCode: 403,
+        statusMessage: "Forbidden",
+        message: `Token missing required scope: ${requiredScope}`
+      });
+    }
+  }
+});

package/dist/runtime/server/middleware/devtools.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<void>>;
+export default _default;