restaurant-kit 0.1.0

package/scripts/bootstrap-site.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+// One-shot provisioning for a restaurant-kit site (or one of its wrangler envs).
+//
+//   npx restaurant-kit-bootstrap --bucket demo-menu-staging --env staging --seed-from demo-menu
+//   npx restaurant-kit-bootstrap --bucket demo-menu --restaurant demo
+//   npx restaurant-kit-bootstrap --dev-vars            # writes .dev.vars for `wrangler dev`
+//
+// Steps (each skippable with --skip-<step>): bucket, seed, secrets, dry-run. Run from the site
+// directory (where wrangler.toml lives). Needs `wrangler login` done first.
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { hashPassword, randomSessionSecret, readPassword } from "./lib/password.mjs";
+
+const args = parseArgs(process.argv.slice(2));
+if (args.help) {
+  console.log(readFileSync(new URL(import.meta.url)).toString().split("\n").slice(1, 9).map((line) => line.replace(/^\/\/ ?/, "")).join("\n"));
+  process.exit(0);
+}
+
+const envFlag = args.env ? ["--env", args.env] : [];
+const restaurantId = args.restaurant ?? readRestaurantIdFromToml(args.env);
+const label = args.env ? `env "${args.env}"` : "production";
+
+function wrangler(cmdArgs, options = {}) {
+  const result = spawnSync("npx", ["wrangler", ...cmdArgs], {
+    stdio: options.input === undefined ? "inherit" : ["pipe", "inherit", "inherit"],
+    input: options.input,
+    encoding: "utf8",
+  });
+  if (result.status !== 0 && !options.allowFailure) {
+    console.error(`\nwrangler ${cmdArgs.join(" ")} failed (exit ${result.status}).`);
+    process.exit(result.status ?? 1);
+  }
+  return result;
+}
+
+function step(title) {
+  console.log(`\n== ${title}`);
+}
+
+if (args["dev-vars"]) {
+  step("Local .dev.vars for `wrangler dev`");
+  if (existsSync(".dev.vars") && !args.force) {
+    console.log(".dev.vars already exists; pass --force to overwrite.");
+  } else {
+    const password = await readPassword(args.password);
+    writeFileSync(".dev.vars", `ADMIN_PASSWORD_HASH="${hashPassword(password)}"\nADMIN_SESSION_SECRET="${randomSessionSecret()}"\n`, { mode: 0o600 });
+    console.log("Wrote .dev.vars (gitignored). Start the stack with:\n  npx wrangler dev            # API + built site on :8787\n  npm run dev:worker          # vite on :5173 talking to :8787");
+  }
+  process.exit(0);
+}
+
+if (!args.bucket) {
+  console.error("Missing --bucket <name>. See --help.");
+  process.exit(1);
+}
+
+if (!args["skip-bucket"]) {
+  step(`R2 bucket ${args.bucket}`);
+  const created = wrangler(["r2", "bucket", "create", args.bucket], { allowFailure: true });
+  if (created.status !== 0) console.log("(bucket create failed — it probably already exists; continuing)");
+}
+
+if (args["seed-from"] && !args["skip-seed"]) {
+  step(`Seed ${args.bucket} from ${args["seed-from"]} (published → published + draft)`);
+  const dir = mkdtempSync(join(tmpdir(), "rk-seed-"));
+  const file = join(dir, "menu.json");
+  wrangler(["r2", "object", "get", `${args["seed-from"]}/restaurants/${restaurantId}/published/menu.json`, "--file", file, "--remote"]);
+  for (const target of ["published", "draft"]) {
+    wrangler(["r2", "object", "put", `${args.bucket}/restaurants/${restaurantId}/${target}/menu.json`, "--file", file, "--content-type", "application/json", "--remote"]);
+  }
+  rmSync(dir, { recursive: true, force: true });
+} else if (!args["skip-seed"]) {
+  console.log(`\n(no --seed-from: the ${label} draft/published menu starts empty; the site shows its bundled seed until you publish)`);
+}
+
+if (!args["skip-secrets"]) {
+  step(`Admin secrets for ${label}`);
+  const password = await readPassword(args.password);
+  wrangler(["secret", "put", "ADMIN_PASSWORD_HASH", ...envFlag], { input: hashPassword(password) });
+  wrangler(["secret", "put", "ADMIN_SESSION_SECRET", ...envFlag], { input: randomSessionSecret() });
+}
+
+if (!args["skip-dry-run"]) {
+  step(`Deploy dry run (${label})`);
+  // `--env=` targets the top-level (production) config explicitly; wrangler warns when envs exist and none is named.
+  wrangler(["deploy", "--dry-run", ...(args.env ? envFlag : ["--env="])], { allowFailure: true });
+}
+
+step("Remaining manual steps");
+console.log(
+  [
+    "1. Zone: the domain must be on this Cloudflare account (registrar nameservers → Cloudflare).",
+    "2. DNS: a hostname you list as `custom_domain = true` must have NO existing A/AAAA/CNAME record,",
+    "   or the deploy fails with 409. Delete the record, or use a zone route (`pattern = \"host/*\"`).",
+    "3. Old Pages project on the same hostname? Remove its custom domain first.",
+    `4. Deploy: npx wrangler deploy --env${args.env ? ` ${args.env}` : '=""'}`,
+    '5. Check: curl -s https://<host>/api/admin/session  →  {"strategy":"password",...}',
+  ].join("\n"),
+);
+
+function parseArgs(argv) {
+  const out = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!arg.startsWith("--")) continue;
+    const key = arg.slice(2);
+    const next = argv[index + 1];
+    if (next !== undefined && !next.startsWith("--")) {
+      out[key] = next;
+      index += 1;
+    } else out[key] = true;
+  }
+  return out;
+}
+
+function readRestaurantIdFromToml(env) {
+  if (!existsSync("wrangler.toml")) return "restaurant";
+  const toml = readFileSync("wrangler.toml", "utf8");
+  const section = env ? toml.split(`[env.${env}.vars]`)[1] : undefined;
+  const match = section?.match(/RESTAURANT_ID\s*=\s*"([^"]+)"/) ?? toml.match(/RESTAURANT_ID\s*=\s*"([^"]+)"/);
+  return match?.[1] ?? "restaurant";
+}

package/scripts/hash-admin-password.mjs

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+// Prints the ADMIN_PASSWORD_HASH value for the restaurant-kit Worker.
+//
+//   npx restaurant-kit-hash-password            # prompts (input hidden)
+//   echo -n 'pass' | npx restaurant-kit-hash-password
+//   npx restaurant-kit-hash-password 'pass'     # lands in shell history; avoid
+import { hashPassword, readPassword } from "./lib/password.mjs";
+
+const password = await readPassword(process.argv[2]);
+console.log(hashPassword(password));
+console.error("\nStore it on the Worker (never in wrangler.toml):\n  wrangler secret put ADMIN_PASSWORD_HASH\n  wrangler secret put ADMIN_SESSION_SECRET   # e.g. openssl rand -base64 32");

package/scripts/lib/password.mjs

@@ -0,0 +1,72 @@
+import { pbkdf2Sync, randomBytes } from "node:crypto";
+
+// Workers Free plan caps PBKDF2 at 100k iterations.
+export const defaultIterations = Number(process.env.PBKDF2_ITERATIONS ?? 100_000);
+
+const CTRL_C = "\u0003";
+const BACKSPACE = "\u007f";
+
+/** Same format the Worker verifies: pbkdf2-sha256$<iterations>$<salt>$<hash>. */
+export function hashPassword(password, iterations = defaultIterations) {
+  const salt = randomBytes(16);
+  const hash = pbkdf2Sync(password, salt, iterations, 32, "sha256");
+  return ["pbkdf2-sha256", String(iterations), salt.toString("base64url"), hash.toString("base64url")].join("$");
+}
+
+export function randomSessionSecret() {
+  return randomBytes(32).toString("base64");
+}
+
+export function readHidden(prompt) {
+  return new Promise((resolve) => {
+    const { stdin, stderr } = process;
+    let value = "";
+    stderr.write(prompt);
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    const onData = (chunk) => {
+      for (const char of chunk) {
+        if (char === CTRL_C) process.exit(130);
+        if (char === "\r" || char === "\n") {
+          stdin.setRawMode(false);
+          stdin.pause();
+          stdin.off("data", onData);
+          stderr.write("\n");
+          resolve(value);
+          return;
+        }
+        if (char === BACKSPACE || char === "\b") value = value.slice(0, -1);
+        else value += char;
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+
+async function readStdin() {
+  let data = "";
+  for await (const chunk of process.stdin) data += chunk;
+  return data.replace(/\r?\n$/, "");
+}
+
+/** argv value, else piped stdin, else a hidden double prompt on a TTY. Exits on mismatch/empty. */
+export async function readPassword(argValue) {
+  let password;
+  if (argValue) password = argValue;
+  else if (!process.stdin.isTTY) password = await readStdin();
+  else {
+    const first = await readHidden("Admin password: ");
+    const second = await readHidden("Repeat password: ");
+    if (first !== second) {
+      console.error("Passwords do not match.");
+      process.exit(1);
+    }
+    password = first;
+  }
+  if (!password) {
+    console.error("Password must not be empty.");
+    process.exit(1);
+  }
+  return password;
+}