texlite 0.7.8 → 0.8.1

package/dist/server/latexSpellMask.js

@@ -0,0 +1,257 @@
+// This intentionally recognizes only the parts of LaTeX that are clearly not
+// prose. It is a single-pass lexer, not a parser: malformed delimiters remain
+// narrow, so they never hide the rest of a document or cause backtracking.
+const nonProseEnvironments = new Set([
+    "math", "displaymath", "equation", "equation*", "align", "align*", "alignat", "alignat*", "gather", "gather*", "multline", "multline*", "flalign", "flalign*",
+    "tikzpicture", "axis", "scope", "pgfonlayer", "pgfpicture",
+    "tabular", "tabularx", "tabulary", "longtable", "array", "matrix", "pmatrix", "bmatrix", "vmatrix",
+    "verbatim", "lstlisting", "minted", "comment", "algorithmic"
+]);
+const opaqueArgumentCommands = new Set([
+    "documentclass", "usepackage", "requirepackage", "includegraphics", "tikzset", "pgfplotsset", "hypersetup", "lstset",
+    "label", "hypertarget", "ref", "pageref", "autoref", "nameref", "hyperref", "index", "gls", "glspl",
+    "bibliography", "addbibresource", "input", "include", "url", "path", "setlength", "setcounter", "color", "textcolor", "colorbox", "pagecolor"
+]);
+function addRange(ranges, from, to) {
+    if (to > from)
+        ranges.push({ from, to });
+}
+function isWhitespace(character) {
+    return character === " " || character === "\t" || character === "\r" || character === "\n";
+}
+function isCommandNameCharacter(character) {
+    if (!character)
+        return false;
+    const code = character.charCodeAt(0);
+    return (code >= 65 && code <= 90) || (code >= 97 && code <= 122) || (code >= 48 && code <= 57)
+        || character === "@" || character === ":" || character === "_";
+}
+function balancedArgument(source, start, open, close) {
+    if (source[start] !== open)
+        return null;
+    let depth = 1;
+    for (let index = start + 1; index < source.length; index += 1) {
+        if (source[index] === "\\") {
+            index += 1;
+            continue;
+        }
+        if (source[index] === open)
+            depth += 1;
+        else if (source[index] === close && --depth === 0)
+            return { from: start, to: index + 1 };
+    }
+    return null;
+}
+function skipWhitespace(source, start) {
+    let index = start;
+    while (index < source.length && isWhitespace(source[index]))
+        index += 1;
+    return index;
+}
+function readCommand(source, start) {
+    let end = start + 1;
+    if (isCommandNameCharacter(source[end]))
+        while (isCommandNameCharacter(source[end]))
+            end += 1;
+    else if (end < source.length)
+        end += 1;
+    const name = source.slice(start + 1, end);
+    if (source[end] === "*")
+        end += 1;
+    return { name, end };
+}
+function isCitationCommand(name) {
+    const normalized = name.toLocaleLowerCase("en-US");
+    return normalized === "cite" || normalized.startsWith("cite") || normalized.endsWith("cite");
+}
+function masksOpaqueArguments(name) {
+    const normalized = name.toLocaleLowerCase("en-US");
+    return opaqueArgumentCommands.has(normalized) || isCitationCommand(normalized) || normalized === "definecolor" || normalized === "colorlet" || normalized === "href";
+}
+function maskOpaqueArguments(source, start, name, ranges) {
+    let cursor = start;
+    const normalized = name.toLocaleLowerCase("en-US");
+    const count = normalized === "definecolor" || normalized === "colorlet" ? 3 : 1;
+    for (let index = 0; index < count; index += 1) {
+        const argument = balancedArgument(source, cursor, "{", "}");
+        if (!argument)
+            break;
+        addRange(ranges, argument.from, argument.to);
+        cursor = skipWhitespace(source, argument.to);
+    }
+    return cursor;
+}
+function rawUrlEnd(source, start) {
+    const first = source[start];
+    if (first !== "h" && first !== "H" && first !== "f" && first !== "F")
+        return null;
+    for (const prefix of ["http://", "https://", "ftp://"]) {
+        if (source.slice(start, start + prefix.length).toLowerCase() !== prefix)
+            continue;
+        let end = start + prefix.length;
+        while (end < source.length && !isWhitespace(source[end]))
+            end += 1;
+        return end;
+    }
+    return null;
+}
+function mergeOrderedRanges(ranges) {
+    const merged = [];
+    for (const range of ranges) {
+        const previous = merged.at(-1);
+        if (previous && range.from <= previous.to)
+            previous.to = Math.max(previous.to, range.to);
+        else
+            merged.push({ ...range });
+    }
+    return merged;
+}
+/** Return ordered source spans that should not be sent to a prose checker. */
+export function ignoredLatexRanges(source) {
+    const ranges = [];
+    // Each non-prose environment installs its span at \begin and extends it at
+    // \end. This preserves source order, so final merging stays linear.
+    const nonProseStack = [];
+    // The same technique keeps unmatched $ / \[ delimiters cheap and local.
+    let pendingMath = null;
+    for (let index = 0; index < source.length;) {
+        if (pendingMath?.close.startsWith("\\") && source.startsWith(pendingMath.close, index)) {
+            pendingMath.range.to = index + pendingMath.close.length;
+            index += pendingMath.close.length;
+            pendingMath = null;
+            continue;
+        }
+        if (source[index] === "%") {
+            const end = source.indexOf("\n", index);
+            addRange(ranges, index, end < 0 ? source.length : end);
+            index = end < 0 ? source.length : end + 1;
+            continue;
+        }
+        if (source[index] === "$") {
+            if (pendingMath) {
+                if (pendingMath.close === "$" || (pendingMath.close === "$$" && source.startsWith("$$", index))) {
+                    pendingMath.range.to = index + pendingMath.close.length;
+                    index += pendingMath.close.length;
+                    pendingMath = null;
+                }
+                else {
+                    index += 1;
+                }
+            }
+            else {
+                const delimiter = source[index + 1] === "$" ? "$$" : "$";
+                const range = { from: index, to: index + delimiter.length };
+                ranges.push(range);
+                pendingMath = { close: delimiter, range };
+                index += delimiter.length;
+            }
+            continue;
+        }
+        const urlEnd = rawUrlEnd(source, index);
+        if (urlEnd !== null) {
+            addRange(ranges, index, urlEnd);
+            index = urlEnd;
+            continue;
+        }
+        if (source[index] !== "\\") {
+            index += 1;
+            continue;
+        }
+        const commandStart = index;
+        if (source[index + 1] === "(" || source[index + 1] === "[") {
+            if (pendingMath) {
+                addRange(ranges, commandStart, index + 2);
+            }
+            else {
+                const range = { from: commandStart, to: index + 2 };
+                ranges.push(range);
+                pendingMath = { close: source[index + 1] === "(" ? "\\)" : "\\]", range };
+            }
+            index += 2;
+            continue;
+        }
+        const command = readCommand(source, commandStart);
+        let cursor = skipWhitespace(source, command.end);
+        if (command.name === "verb") {
+            addRange(ranges, commandStart, command.end);
+            const delimiter = source[cursor];
+            if (delimiter && !isWhitespace(delimiter)) {
+                const end = source.indexOf(delimiter, cursor + 1);
+                if (end >= 0) {
+                    addRange(ranges, cursor, end + 1);
+                    cursor = end + 1;
+                }
+            }
+            index = Math.max(command.end, cursor);
+            continue;
+        }
+        if (command.name === "begin" || command.name === "end") {
+            const environment = balancedArgument(source, cursor, "{", "}");
+            if (!environment) {
+                addRange(ranges, commandStart, command.end);
+                index = command.end;
+                continue;
+            }
+            const environmentName = source.slice(environment.from + 1, environment.to - 1).trim().toLocaleLowerCase("en-US");
+            cursor = skipWhitespace(source, environment.to);
+            let options = null;
+            if (command.name === "begin") {
+                options = balancedArgument(source, cursor, "[", "]");
+                if (options)
+                    cursor = skipWhitespace(source, options.to);
+                if (nonProseEnvironments.has(environmentName)) {
+                    const range = { from: commandStart, to: cursor };
+                    ranges.push(range);
+                    nonProseStack.push({ name: environmentName, range });
+                }
+                else {
+                    addRange(ranges, commandStart, command.end);
+                    addRange(ranges, environment.from, environment.to);
+                    if (options)
+                        addRange(ranges, options.from, options.to);
+                }
+            }
+            else {
+                const open = nonProseStack.at(-1);
+                if (open?.name === environmentName) {
+                    nonProseStack.pop();
+                    open.range.to = cursor;
+                }
+                else {
+                    addRange(ranges, commandStart, command.end);
+                    addRange(ranges, environment.from, environment.to);
+                }
+            }
+            index = Math.max(command.end, cursor);
+            continue;
+        }
+        addRange(ranges, commandStart, command.end);
+        const options = balancedArgument(source, cursor, "[", "]");
+        if (options) {
+            addRange(ranges, options.from, options.to);
+            cursor = skipWhitespace(source, options.to);
+        }
+        if (masksOpaqueArguments(command.name))
+            cursor = maskOpaqueArguments(source, cursor, command.name, ranges);
+        index = Math.max(command.end, cursor);
+    }
+    return mergeOrderedRanges(ranges);
+}
+/** Replace syntax with spaces while retaining Unicode-scalar offsets and line breaks. */
+export function maskLatexSource(source) {
+    const ranges = ignoredLatexRanges(source);
+    const chars = [];
+    let offset = 0;
+    let rangeIndex = 0;
+    for (const character of source) {
+        while (rangeIndex < ranges.length && ranges[rangeIndex].to <= offset)
+            rangeIndex += 1;
+        const range = ranges[rangeIndex];
+        const masked = range && range.from <= offset && offset < range.to && character !== "\n" && character !== "\r";
+        // `harper-cli` reports Unicode scalar positions. One space for every
+        // source scalar keeps diagnostics aligned after masked astral characters.
+        chars.push(masked ? " " : character);
+        offset += character.length;
+    }
+    return chars.join("");
+}

package/dist/server/projects.js

@@ -1,16 +1,4 @@
 export function accessibleProject(db, projectId, user) {
-    if (user.role === "admin") {
-        const row = db.prepare(`
-      SELECT p.*, 'owner' AS permission, owner.username AS owner_username,
-        owner.display_name AS owner_display_name,
-        modifier.username AS last_modified_username, modifier.display_name AS last_modified_display_name
-      FROM projects p
-      JOIN users owner ON owner.id = p.owner_id
-      LEFT JOIN users modifier ON modifier.id = p.last_modified_by
-      WHERE p.id = ?
-    `).get(projectId);
-        return row ?? null;
-    }
     const row = db.prepare(`
     SELECT p.*,
       CASE WHEN p.owner_id = ? THEN 'owner' ELSE pm.permission END AS permission,

package/dist/server/routes/projectShared.js

@@ -129,7 +129,7 @@ export function requireEditableProject(db, projectId, user) {
         throw httpError(403, "PROJECT_EDIT_FORBIDDEN");
     return project;
 }
-/** Owner permission includes an administrator's effective owner access. */
+/** Owner permission is granted only to the stored project owner. */
 export function requireProjectOwnerPermission(db, projectId, user) {
     requireActiveUser(db, user);
     const project = accessibleProject(db, projectId, user);

package/dist/server/routes/projects.js

@@ -9,6 +9,7 @@ import { isMainDocumentCandidate } from "../latexRoot.js";
 import { accessibleProject, canEdit } from "../projects.js";
 import { writeProjectArchive } from "../archive.js";
 import { extractProjectZip, ZipValidationError } from "../zip.js";
+import { HarperUnavailableError } from "../harper.js";
 import { commentsSummaryForProject, commentsSummaryForProjects, dictionaryWord, escapeLikePattern, now, projectJson, requireProjectOwnerPermission, tagColors, tagsForProject, tagsForProjects, text } from "./projectShared.js";
 /** Register project catalog, metadata, archive, dictionary, tag, export, and deletion routes. */
 export function registerProjectCatalogRoutes(app, context) {
@@ -50,14 +51,11 @@ export function registerProjectCatalogRoutes(app, context) {
         const archiveCondition = archivedOnly
             ? "EXISTS (SELECT 1 FROM user_project_archives archive WHERE archive.project_id = p.id AND archive.user_id = :userId)"
             : "NOT EXISTS (SELECT 1 FROM user_project_archives archive WHERE archive.project_id = p.id AND archive.user_id = :userId)";
-        const from = user.role === "admin"
-            ? `FROM projects p JOIN users owner ON owner.id = p.owner_id
-          LEFT JOIN users modifier ON modifier.id = p.last_modified_by`
-            : `FROM projects p JOIN users owner ON owner.id = p.owner_id
-          LEFT JOIN users modifier ON modifier.id = p.last_modified_by
-          LEFT JOIN project_members pm ON pm.project_id = p.id AND pm.user_id = :userId`;
+        const from = `FROM projects p JOIN users owner ON owner.id = p.owner_id
+      LEFT JOIN users modifier ON modifier.id = p.last_modified_by
+      LEFT JOIN project_members pm ON pm.project_id = p.id AND pm.user_id = :userId`;
         const conditions = [
-            ...(user.role === "admin" ? [] : ["(p.owner_id = :userId OR pm.user_id = :userId)"]),
+            "(p.owner_id = :userId OR pm.user_id = :userId)",
             archiveCondition
         ];
         const params = { userId: user.id };
@@ -79,14 +77,10 @@ export function registerProjectCatalogRoutes(app, context) {
         const totalPages = Math.ceil(total / pageSize);
         const currentPage = totalPages === 0 ? 1 : Math.min(page, totalPages);
         const rowsParams = { ...params, limit: pageSize, offset: (currentPage - 1) * pageSize };
-        const select = user.role === "admin"
-            ? `SELECT p.*, 'owner' AS permission, owner.username AS owner_username,
-          owner.display_name AS owner_display_name,
-          modifier.username AS last_modified_username, modifier.display_name AS last_modified_display_name`
-            : `SELECT DISTINCT p.*,
-          CASE WHEN p.owner_id = :userId THEN 'owner' ELSE pm.permission END AS permission,
-          owner.username AS owner_username, owner.display_name AS owner_display_name,
-          modifier.username AS last_modified_username, modifier.display_name AS last_modified_display_name`;
+        const select = `SELECT DISTINCT p.*,
+      CASE WHEN p.owner_id = :userId THEN 'owner' ELSE pm.permission END AS permission,
+      owner.username AS owner_username, owner.display_name AS owner_display_name,
+      modifier.username AS last_modified_username, modifier.display_name AS last_modified_display_name`;
         const rows = db.prepare(`${select} ${from} ${where}
       ORDER BY ${sortColumn} DESC, p.name COLLATE NOCASE ASC
       LIMIT :limit OFFSET :offset`).all(rowsParams);
@@ -259,16 +253,21 @@ export function registerProjectCatalogRoutes(app, context) {
         if (!accessibleProject(db, id, user))
             return apiError(reply, 404, "PROJECT_NOT_FOUND");
         const body = request.body;
-        if (typeof body?.source !== "string")
+        if (typeof body?.source !== "string" || typeof body.path !== "string")
             return apiError(reply, 400, "SPELLCHECK_SOURCE_INVALID");
         if (Buffer.byteLength(body.source, "utf8") > maxCollaborativeFileBytes(config)) {
             return apiError(reply, 413, "SPELLCHECK_SOURCE_TOO_LARGE");
         }
         try {
-            return { lints: await harper.lint(body.source) };
+            return { lints: await harper.lint(body.source, body.path) };
         }
         catch (error) {
-            request.log.error({ err: error, projectId: id }, "Harper writing check failed");
+            // A missing optional command is an expected fallback condition. Keep it
+            // out of normal logs while preserving diagnostics for an actual failure.
+            if (error instanceof HarperUnavailableError)
+                request.log.debug({ projectId: id }, "Host Harper CLI unavailable; using browser fallback");
+            else
+                request.log.error({ err: error, projectId: id }, "Harper writing check failed");
             return apiError(reply, 503, "HARPER_UNAVAILABLE");
         }
     });
@@ -459,7 +458,9 @@ export function registerProjectCatalogRoutes(app, context) {
             return;
         const { id } = request.params;
         const project = accessibleProject(db, id, user);
-        if (!project || project.permission !== "owner")
+        if (!project)
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        if (project.permission !== "owner")
             return apiError(reply, 403, "PROJECT_DELETE_FORBIDDEN");
         return await projectMutations.runExclusive(id, "project deletion", () => {
             collaboration.resetProject(id);

package/dist/server/routes/wordCount.js

@@ -0,0 +1,83 @@
+import { requireUser } from "../auth.js";
+import { maxCollaborativeFileBytes } from "../collaboration.js";
+import { compileMainFile } from "../compileArtifacts.js";
+import { assertNoSourceSymlinks, safeRelativePath, sourceRoot } from "../files.js";
+import { apiError, httpError } from "../http.js";
+import { accessibleProject } from "../projects.js";
+import { TexcountExecutionError, TexcountUnavailableError } from "../texcount.js";
+/** Register host TeXcount-backed full-document and editor-selection counts. */
+export function registerWordCountRoutes(app, context) {
+    const { config, db, projectMutations, texcount } = context;
+    app.post("/api/projects/:id/word-count", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        const project = accessibleProject(db, id, user);
+        if (!project)
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        const body = (request.body ?? {});
+        const mode = body.mode;
+        if (mode !== "full" && mode !== "selection")
+            return apiError(reply, 400, "WORD_COUNT_SOURCE_INVALID");
+        try {
+            if (mode === "selection") {
+                return await countSelection(config, id, body, texcount);
+            }
+            return await countDocument(config, db, projectMutations, texcount, id, user, body.mainFile);
+        }
+        catch (error) {
+            if (error instanceof TexcountUnavailableError)
+                return apiError(reply, 503, "WORD_COUNT_UNAVAILABLE");
+            if (error instanceof TexcountExecutionError)
+                return apiError(reply, 422, "WORD_COUNT_FAILED");
+            throw error;
+        }
+    });
+}
+async function countSelection(config, projectId, body, texcount) {
+    if (typeof body.path !== "string" || typeof body.source !== "string") {
+        throw httpError(400, "WORD_COUNT_SOURCE_INVALID");
+    }
+    let filePath;
+    try {
+        filePath = safeRelativePath(body.path);
+    }
+    catch {
+        throw httpError(400, "WORD_COUNT_SOURCE_INVALID");
+    }
+    // TeXcount's stdin parser is intended for TeX-like source. Keep BibTeX and
+    // binary resources out of this endpoint while allowing .sty/.cls snippets.
+    if (!/\.(?:tex|sty|cls)$/i.test(filePath) || !body.source.trim()) {
+        throw httpError(400, "WORD_COUNT_SOURCE_INVALID");
+    }
+    if (Buffer.byteLength(body.source, "utf8") > maxCollaborativeFileBytes(config)) {
+        throw httpError(413, "WORD_COUNT_SOURCE_TOO_LARGE");
+    }
+    const counts = await texcount.countSource(sourceRoot(config, projectId), body.source);
+    return { mode: "selection", path: filePath, ...counts };
+}
+async function countDocument(config, db, projectMutations, texcount, projectId, user, requestedMainFile) {
+    const initialProject = accessibleProject(db, projectId, user);
+    if (!initialProject)
+        throw httpError(404, "PROJECT_NOT_FOUND");
+    const mainFile = compileMainFile(config, projectId, initialProject.main_file, requestedMainFile);
+    if (!mainFile)
+        throw httpError(400, "MAIN_DOCUMENT_INVALID");
+    return await projectMutations.runConsistentRead(projectId, async () => {
+        // TeXcount follows \input/\include paths. Reject links before handing it
+        // the source root so a checked-out link cannot expose files outside it.
+        assertNoSourceSymlinks(config, projectId);
+        const counts = await texcount.countFile(sourceRoot(config, projectId), mainFile);
+        return { mode: "full", path: mainFile, ...counts };
+    }, {
+        preflight: () => {
+            const current = accessibleProject(db, projectId, user);
+            if (!current)
+                throw httpError(404, "PROJECT_NOT_FOUND");
+            const selected = compileMainFile(config, projectId, current.main_file, requestedMainFile);
+            if (!selected || selected !== mainFile)
+                throw httpError(400, "MAIN_DOCUMENT_INVALID");
+        }
+    });
+}