slidev-theme-practicum 0.1.0 → 0.1.2

package/scripts/test-architecture-policy.mjs

@@ -0,0 +1,245 @@
+import ts from 'typescript'
+
+const allowedRawExtensions = new Set(['.css', '.md'])
+const projectReaderModules = new Set([
+  './helpers/project-root.cjs',
+  '../tests/helpers/project-root.cjs',
+])
+const fileSystemModules = new Set(['fs', 'fs/promises', 'node:fs', 'node:fs/promises'])
+const fileSystemReaders = new Set(['readFile', 'readFileSync'])
+
+function moduleKind(specifier) {
+  if (projectReaderModules.has(specifier) || specifier.endsWith('/helpers/project-root.cjs'))
+    return 'project'
+  if (fileSystemModules.has(specifier))
+    return 'fs'
+  return undefined
+}
+
+function requireSpecifier(node) {
+  return (
+    ts.isCallExpression(node)
+    && ts.isIdentifier(node.expression)
+    && node.expression.text === 'require'
+    && node.arguments.length === 1
+    && ts.isStringLiteral(node.arguments[0])
+  )
+    ? node.arguments[0].text
+    : undefined
+}
+
+function readerNameAllowed(kind, name) {
+  return kind === 'project'
+    ? name === 'readProjectFile'
+    : kind === 'fs' && fileSystemReaders.has(name)
+}
+
+function memberAccess(node) {
+  if (ts.isPropertyAccessExpression(node))
+    return { object: node.expression, name: node.name.text }
+  if (
+    ts.isElementAccessExpression(node)
+    && node.argumentExpression
+    && ts.isStringLiteralLike(node.argumentExpression)
+  ) {
+    return { object: node.expression, name: node.argumentExpression.text }
+  }
+  return undefined
+}
+
+function collectBindings(sourceFile) {
+  const directReaders = new Set()
+  const namespaces = new Map()
+  const initializers = new Map()
+  const declarations = []
+
+  for (const statement of sourceFile.statements) {
+    if (ts.isImportDeclaration(statement) && ts.isStringLiteral(statement.moduleSpecifier)) {
+      const kind = moduleKind(statement.moduleSpecifier.text)
+      if (!kind)
+        continue
+
+      const clause = statement.importClause
+      if (clause?.name)
+        namespaces.set(clause.name.text, kind)
+      if (clause?.namedBindings && ts.isNamespaceImport(clause.namedBindings))
+        namespaces.set(clause.namedBindings.name.text, kind)
+      if (clause?.namedBindings && ts.isNamedImports(clause.namedBindings)) {
+        for (const element of clause.namedBindings.elements) {
+          const importedName = element.propertyName?.text ?? element.name.text
+          if (readerNameAllowed(kind, importedName))
+            directReaders.add(element.name.text)
+        }
+      }
+    }
+  }
+
+  function visitDeclarations(node) {
+    if (ts.isVariableDeclaration(node)) {
+      declarations.push(node)
+      if (ts.isIdentifier(node.name) && node.initializer)
+        initializers.set(node.name.text, node.initializer)
+
+      const specifier = node.initializer
+        ? requireSpecifier(node.initializer)
+        : undefined
+      const kind = specifier ? moduleKind(specifier) : undefined
+
+      if (kind && ts.isIdentifier(node.name))
+        namespaces.set(node.name.text, kind)
+      if (kind && ts.isObjectBindingPattern(node.name)) {
+        for (const element of node.name.elements) {
+          if (!ts.isIdentifier(element.name))
+            continue
+
+          const importedName = element.propertyName && ts.isIdentifier(element.propertyName)
+            ? element.propertyName.text
+            : element.name.text
+          if (readerNameAllowed(kind, importedName))
+            directReaders.add(element.name.text)
+        }
+      }
+    }
+
+    ts.forEachChild(node, visitDeclarations)
+  }
+
+  visitDeclarations(sourceFile)
+
+  let changed = true
+  while (changed) {
+    changed = false
+
+    for (const declaration of declarations) {
+      if (!declaration.initializer)
+        continue
+
+      if (
+        ts.isObjectBindingPattern(declaration.name)
+        && ts.isIdentifier(declaration.initializer)
+      ) {
+        const kind = namespaces.get(declaration.initializer.text)
+        if (!kind)
+          continue
+
+        for (const element of declaration.name.elements) {
+          if (!ts.isIdentifier(element.name))
+            continue
+
+          const importedName = element.propertyName && ts.isIdentifier(element.propertyName)
+            ? element.propertyName.text
+            : element.name.text
+          if (readerNameAllowed(kind, importedName) && !directReaders.has(element.name.text)) {
+            directReaders.add(element.name.text)
+            changed = true
+          }
+        }
+        continue
+      }
+
+      if (!ts.isIdentifier(declaration.name))
+        continue
+
+      const localName = declaration.name.text
+      if (directReaders.has(localName))
+        continue
+
+      if (
+        ts.isIdentifier(declaration.initializer)
+        && directReaders.has(declaration.initializer.text)
+      ) {
+        directReaders.add(localName)
+        changed = true
+        continue
+      }
+
+      const access = memberAccess(declaration.initializer)
+      if (access) {
+        const namespaceKind = ts.isIdentifier(access.object)
+          ? namespaces.get(access.object.text)
+          : undefined
+        const requiredModule = requireSpecifier(access.object)
+        const requiredKind = requiredModule ? moduleKind(requiredModule) : undefined
+        const kind = namespaceKind ?? requiredKind
+
+        if (kind && readerNameAllowed(kind, access.name)) {
+          directReaders.add(localName)
+          changed = true
+        }
+      }
+    }
+  }
+
+  return { directReaders, initializers, namespaces }
+}
+
+function collectPathCandidates(node, initializers, seen = new Set()) {
+  if (ts.isStringLiteralLike(node))
+    return [node.text]
+
+  if (ts.isIdentifier(node) && initializers.has(node.text) && !seen.has(node.text)) {
+    seen.add(node.text)
+    return collectPathCandidates(initializers.get(node.text), initializers, seen)
+  }
+
+  const candidates = []
+  ts.forEachChild(node, child =>
+    candidates.push(...collectPathCandidates(child, initializers, new Set(seen))))
+  return candidates
+}
+
+function extensionOf(path) {
+  const match = path.toLowerCase().match(/(\.[a-z0-9]+)$/u)
+  return match?.[1]
+}
+
+function rawReaderKind(call, bindings) {
+  if (ts.isIdentifier(call.expression) && bindings.directReaders.has(call.expression.text))
+    return true
+
+  const access = memberAccess(call.expression)
+  if (!access)
+    return false
+
+  const namespaceKind = ts.isIdentifier(access.object)
+    ? bindings.namespaces.get(access.object.text)
+    : undefined
+  const requiredModule = requireSpecifier(access.object)
+  const requiredKind = requiredModule ? moduleKind(requiredModule) : undefined
+  const kind = namespaceKind ?? requiredKind
+
+  return Boolean(kind && readerNameAllowed(kind, access.name))
+}
+
+export function findDisallowedRawSourceReads(source, relativeFile = 'test.cjs') {
+  const sourceFile = ts.createSourceFile(
+    relativeFile,
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.JS,
+  )
+  const bindings = collectBindings(sourceFile)
+  const violations = []
+
+  function visit(node) {
+    if (ts.isCallExpression(node) && rawReaderKind(node, bindings)) {
+      const candidates = node.arguments[0]
+        ? collectPathCandidates(node.arguments[0], bindings.initializers)
+        : []
+      const pathCandidates = candidates.filter(candidate => extensionOf(candidate))
+      const disallowedPath = pathCandidates.find(path =>
+        !allowedRawExtensions.has(extensionOf(path)))
+
+      if (disallowedPath || pathCandidates.length === 0) {
+        const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1
+        violations.push(`${disallowedPath ?? '<динамический путь>'}:${line}`)
+      }
+    }
+
+    ts.forEachChild(node, visit)
+  }
+
+  visit(sourceFile)
+  return violations
+}

package/scripts/theme-asset-inventory.mjs

@@ -0,0 +1,83 @@
+import { lstat, readdir } from 'node:fs/promises'
+import { join } from 'node:path'
+
+export const EXPECTED_THEME_PHOTOS = Object.freeze(
+  Array.from({ length: 30 }, (_, index) => `photos/photo-${index + 1}.webp`),
+)
+
+export const EXPECTED_THEME_DECORS = Object.freeze([
+  'decor/decor-1.svg',
+  'decor/decor-2.png',
+  'decor/decor-3.svg',
+  'decor/decor-4.svg',
+  'decor/decor-5.png',
+  'decor/decor-6.png',
+  'decor/decor-7.png',
+  'decor/decor-8.svg',
+  'decor/decor-9.svg',
+  'decor/decor-10.svg',
+  'decor/decor-11.svg',
+  'decor/decor-12.svg',
+  'decor/decor-13.svg',
+  'decor/decor-14.svg',
+  'decor/decor-15.svg',
+  'decor/decor-16.svg',
+  'decor/decor-17.png',
+  'decor/decor-18.png',
+  'decor/decor-19.svg',
+])
+
+export const EXPECTED_THEME_ASSETS = Object.freeze([
+  'favicon.svg',
+  ...EXPECTED_THEME_DECORS,
+  ...EXPECTED_THEME_PHOTOS,
+])
+
+/**
+ * @param {string} path
+ */
+export function toPosixPath(path) {
+  return String(path).replaceAll('\\', '/')
+}
+
+/**
+ * @param {string} directory
+ * @param {readonly string[]} expectedNames
+ */
+export async function validateAssetDirectory(directory, expectedNames) {
+  const directoryStat = await lstat(directory)
+
+  if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory())
+    throw new Error(`source inventory должен быть обычной директорией: ${directory}`)
+
+  const names = await readdir(directory)
+  const actual = new Set(names)
+  const expected = new Set(expectedNames)
+  const errors = []
+
+  if (expected.size !== expectedNames.length)
+    errors.push('ожидаемый inventory содержит дубли')
+
+  const missing = expectedNames.filter(name => !actual.has(name))
+  const unexpected = names.filter(name => !expected.has(name))
+
+  if (missing.length > 0)
+    errors.push(`отсутствуют файлы: ${missing.join(', ')}`)
+
+  if (unexpected.length > 0)
+    errors.push(`неожиданные файлы: ${unexpected.join(', ')}`)
+
+  await Promise.all(names.map(async (name) => {
+    const fileStat = await lstat(join(directory, name))
+
+    if (fileStat.isSymbolicLink())
+      errors.push(`файл не должен быть symlink: ${name}`)
+    else if (!fileStat.isFile())
+      errors.push(`должен быть обычным файлом: ${name}`)
+  }))
+
+  if (errors.length > 0)
+    throw new Error(`source inventory не прошёл проверку: ${errors.join('; ')}`)
+
+  return names.sort((left, right) => left.localeCompare(right, 'en', { numeric: true }))
+}

package/scripts/validate-deck.cjs

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+const { resolve } = require('node:path')
+const { formatDeckLayoutIssues, validateDeckLayouts } = require('../composables/validate-deck-layouts.cjs')
+
+const deckPath = resolve(process.argv[2] ?? 'example.md')
+
+validateDeckLayouts(deckPath).then((issues) => {
+  if (!issues.length) {
+    console.log(`OK: ${deckPath} — контракты layout/markdown соблюдены.`)
+    process.exit(0)
+  }
+
+  console.error(formatDeckLayoutIssues(issues, deckPath))
+  process.exit(1)
+}).catch((error) => {
+  console.error(error)
+  process.exit(1)
+})

package/setup/decor-save-middleware.ts

@@ -0,0 +1,244 @@
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import type { DecorStore, DecorVariant } from '../composables/decor-store'
+
+type Next = () => void
+
+type DecorSaveMiddlewareOptions = {
+  store: DecorStore
+  expectedOrigin?: string
+  maxBytes?: number
+}
+
+export const MAX_DECOR_SAVE_BYTES = 1024 * 1024
+const SAVE_PATH = '/__decor-library/save'
+
+class RequestBodyTooLargeError extends Error {}
+
+function drainRequest(req: IncomingMessage) {
+  const cleanup = () => {
+    req.off('error', cleanup)
+    req.off('end', cleanup)
+    req.off('close', cleanup)
+  }
+
+  req.once('error', cleanup)
+  req.once('end', cleanup)
+  req.once('close', cleanup)
+  req.resume()
+}
+
+function readJsonBody(req: IncomingMessage, maxBytes: number): Promise<unknown> {
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = []
+    let bytes = 0
+
+    const cleanup = () => {
+      req.off('data', onData)
+      req.off('end', onEnd)
+      req.off('error', onError)
+      req.off('aborted', onAborted)
+    }
+    const fail = (error: Error) => {
+      cleanup()
+      reject(error)
+    }
+    const onData = (chunk: Buffer | string) => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+      bytes += buffer.byteLength
+
+      if (bytes > maxBytes) {
+        chunks.length = 0
+        cleanup()
+        drainRequest(req)
+        reject(new RequestBodyTooLargeError('Request body exceeds 1 MiB'))
+        return
+      }
+
+      chunks.push(buffer)
+    }
+    const onEnd = () => {
+      cleanup()
+
+      try {
+        resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')) as unknown)
+      }
+      catch (error) {
+        reject(error)
+      }
+    }
+    const onError = (error: Error) => fail(error)
+    const onAborted = () => fail(new Error('Request aborted'))
+
+    req.on('end', onEnd)
+    req.on('error', onError)
+    req.on('aborted', onAborted)
+    req.on('data', onData)
+  })
+}
+
+function sendJson(res: ServerResponse, status: number, data: unknown) {
+  res.statusCode = status
+  res.setHeader('content-type', 'application/json')
+  res.end(JSON.stringify(data))
+}
+
+function sendError(res: ServerResponse, status: number, error: string) {
+  sendJson(res, status, { ok: false, error })
+}
+
+function sendInternalError(res: ServerResponse, error: unknown) {
+  sendError(
+    res,
+    500,
+    error instanceof Error ? error.message : 'Unknown save error',
+  )
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function getHeader(req: IncomingMessage, name: string) {
+  const value = req.headers[name.toLowerCase()]
+
+  return Array.isArray(value) ? value[0] : value
+}
+
+function isJsonRequest(req: IncomingMessage) {
+  const contentType = getHeader(req, 'content-type')
+
+  return contentType?.split(';', 1)[0]?.trim().toLowerCase() === 'application/json'
+}
+
+function normalizeOrigin(value: string) {
+  const url = new URL(value)
+
+  if (
+    url.origin === 'null'
+    || url.username
+    || url.password
+    || url.pathname !== '/'
+    || url.search
+    || url.hash
+  ) {
+    return null
+  }
+
+  return url.origin
+}
+
+function readRequestOrigin(req: IncomingMessage) {
+  const host = getHeader(req, 'host')
+  if (!host)
+    return null
+
+  const protocol = (req.socket as { encrypted?: boolean } | undefined)?.encrypted
+    ? 'https'
+    : 'http'
+
+  try {
+    return normalizeOrigin(`${protocol}://${host}`)
+  }
+  catch {
+    return null
+  }
+}
+
+function isSameOriginRequest(req: IncomingMessage, expectedOrigin?: string) {
+  const origin = getHeader(req, 'origin')
+  if (!origin)
+    return false
+
+  try {
+    const normalizedOrigin = normalizeOrigin(origin)
+    const normalizedExpectedOrigin = expectedOrigin == null
+      ? readRequestOrigin(req)
+      : normalizeOrigin(expectedOrigin)
+
+    return normalizedOrigin !== null && normalizedOrigin === normalizedExpectedOrigin
+  }
+  catch {
+    return false
+  }
+}
+
+function isCrossSiteRequest(req: IncomingMessage) {
+  return getHeader(req, 'sec-fetch-site') === 'cross-site'
+}
+
+function parseRequestPathname(req: IncomingMessage) {
+  try {
+    return new URL(req.url ?? '/', 'http://localhost').pathname
+  }
+  catch {
+    return null
+  }
+}
+
+export function createDecorSaveMiddleware({
+  store,
+  expectedOrigin,
+  maxBytes = MAX_DECOR_SAVE_BYTES,
+}: DecorSaveMiddlewareOptions) {
+  return async (req: IncomingMessage, res: ServerResponse, next: Next): Promise<void> => {
+    const pathname = parseRequestPathname(req)
+
+    if (pathname === null) {
+      sendError(res, 400, 'Invalid request URL')
+      return
+    }
+
+    if (pathname !== SAVE_PATH) {
+      next()
+      return
+    }
+
+    if (req.method !== 'POST') {
+      sendError(res, 405, 'Method not allowed')
+      return
+    }
+
+    if (!isJsonRequest(req)) {
+      sendError(res, 415, 'Expected application/json')
+      return
+    }
+
+    if (!isSameOriginRequest(req, expectedOrigin) || isCrossSiteRequest(req)) {
+      sendError(res, 403, 'Forbidden origin')
+      return
+    }
+
+    let payload: unknown
+
+    try {
+      payload = await readJsonBody(req, maxBytes)
+    }
+    catch (error) {
+      if (error instanceof RequestBodyTooLargeError) {
+        sendError(res, 413, error.message)
+        return
+      }
+
+      if (error instanceof SyntaxError) {
+        sendError(res, 400, 'Invalid JSON')
+        return
+      }
+
+      sendInternalError(res, error)
+      return
+    }
+
+    const overrides = isRecord(payload) ? payload.overrides : null
+    if (!Array.isArray(overrides)) {
+      sendError(res, 400, 'Expected overrides array')
+      return
+    }
+
+    try {
+      sendJson(res, 200, await store.save(overrides as DecorVariant[]))
+    }
+    catch (error) {
+      sendInternalError(res, error)
+    }
+  }
+}

package/setup/vite-plugins.ts

@@ -1,67 +1,24 @@
 import { resolve } from 'node:path'
-import type { IncomingMessage, ServerResponse } from 'node:http'
+import type { ResolvedSlidevOptions } from '@slidev/types'
 import type { Plugin } from 'vite'
 import { createFileDecorStore } from '../composables/decor-file-store'
-import type { DecorVariant } from '../composables/decor-store'
-
-type JsonValue = string | number | boolean | null | JsonValue[] | { [key: string]: JsonValue }
+import { createDecorSaveMiddleware } from './decor-save-middleware'
 
 const OUTPUT_PATH = resolve(process.cwd(), 'composables/decor-tuning-overrides.mjs')
-const SAVE_PATH = '/__decor-library/save'
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value)
-}
-
-function getHeader(req: IncomingMessage, name: string) {
-  const value = req.headers[name.toLowerCase()]
-
-  return Array.isArray(value) ? value[0] : value
-}
 
-function isJsonRequest(req: IncomingMessage) {
-  const contentType = getHeader(req, 'content-type')
+type DecorLibraryVitePluginContext = Pick<ResolvedSlidevOptions, 'data'>
 
-  return contentType?.split(';', 1)[0]?.trim().toLowerCase() === 'application/json'
-}
-
-function isSameOriginRequest(req: IncomingMessage) {
-  const origin = getHeader(req, 'origin')
-  if (!origin)
-    return true
-
-  const host = getHeader(req, 'host')
-  if (!host)
-    return false
+function readExpectedOrigin(options?: DecorLibraryVitePluginContext) {
+  const value = options?.data.config.themeConfig.decorSaveOrigin
 
-  try {
-    return new URL(origin).host === host
-  }
-  catch {
-    return false
-  }
+  return typeof value === 'string' && value.trim() ? value : undefined
 }
 
-function isCrossSiteRequest(req: IncomingMessage) {
-  return getHeader(req, 'sec-fetch-site') === 'cross-site'
-}
-
-async function readJsonBody(req: IncomingMessage) {
-  let body = ''
-
-  for await (const chunk of req)
-    body += chunk
+export default function decorLibraryVitePlugins(
+  options?: DecorLibraryVitePluginContext,
+): Plugin[] {
+  const expectedOrigin = readExpectedOrigin(options)
 
-  return JSON.parse(body)
-}
-
-function sendJson(res: ServerResponse, status: number, data: JsonValue) {
-  res.statusCode = status
-  res.setHeader('content-type', 'application/json')
-  res.end(JSON.stringify(data))
-}
-
-export default function decorLibraryVitePlugins(): Plugin[] {
   return [
     {
       name: 'practicum:decor-library-save',
@@ -69,37 +26,10 @@ export default function decorLibraryVitePlugins(): Plugin[] {
       configureServer(server) {
         const store = createFileDecorStore({ output: OUTPUT_PATH })
 
-        server.middlewares.use(async (req, res, next) => {
-          const url = new URL(req.url ?? '/', 'http://localhost')
-
-          if (url.pathname !== SAVE_PATH)
-            return next()
-
-          if (req.method !== 'POST')
-            return sendJson(res, 405, { ok: false, error: 'Method not allowed' })
-
-          if (!isJsonRequest(req))
-            return sendJson(res, 415, { ok: false, error: 'Expected application/json' })
-
-          if (!isSameOriginRequest(req) || isCrossSiteRequest(req))
-            return sendJson(res, 403, { ok: false, error: 'Forbidden origin' })
-
-          try {
-            const payload = await readJsonBody(req)
-            const overrides = isRecord(payload) ? payload.overrides : null
-
-            if (!Array.isArray(overrides))
-              return sendJson(res, 400, { ok: false, error: 'Expected overrides array' })
-
-            sendJson(res, 200, await store.save(overrides as DecorVariant[]))
-          }
-          catch (error) {
-            sendJson(res, 500, {
-              ok: false,
-              error: error instanceof Error ? error.message : 'Unknown save error',
-            })
-          }
-        })
+        server.middlewares.use(createDecorSaveMiddleware({
+          expectedOrigin,
+          store,
+        }))
       },
     },
   ]