wiki-viewer 1.14.1 → 1.14.2

package/.next/standalone/src/components/wiki/frontmatter-header.tsx

@@ -1,164 +0,0 @@
-"use client";
-import { ChevronDown, ChevronRight } from "lucide-react";
-import { Fragment, useState } from "react";
-import { Badge } from "@/components/ui/badge";
-
-type FmValue =
-	| string
-	| number
-	| boolean
-	| string[]
-	| Record<string, unknown>
-	| null;
-
-interface Props {
-	data: Record<string, FmValue>;
-}
-
-const KNOWN_KEYS = new Set([
-	"title",
-	"type",
-	"status",
-	"created",
-	"updated",
-	"date",
-	"tags",
-	"sources",
-	"private",
-	"supersedes",
-	"superseded_by",
-]);
-
-function fmt(v: unknown): string {
-	if (v === null || v === undefined) return "";
-	if (typeof v === "string") return v;
-	if (typeof v === "number" || typeof v === "boolean") return String(v);
-	if (Array.isArray(v)) return v.map(fmt).join(", ");
-	try {
-		return JSON.stringify(v);
-	} catch {
-		return String(v);
-	}
-}
-
-export function FrontmatterHeader({ data }: Props) {
-	const [showRaw, setShowRaw] = useState(false);
-	const keys = Object.keys(data);
-	if (keys.length === 0) return null;
-
-	const title = typeof data.title === "string" ? data.title : null;
-	const type = typeof data.type === "string" ? data.type : null;
-	const status = typeof data.status === "string" ? data.status : null;
-	const created = typeof data.created === "string" ? data.created : null;
-	const updated = typeof data.updated === "string" ? data.updated : null;
-	const isPrivate = data.private === true;
-	const tags = Array.isArray(data.tags) ? (data.tags as string[]) : [];
-	const sources = Array.isArray(data.sources) ? (data.sources as string[]) : [];
-	const supersededBy =
-		typeof data.superseded_by === "string" ? data.superseded_by : null;
-
-	const otherKeys = keys.filter((k) => !KNOWN_KEYS.has(k));
-
-	return (
-		<div className="mb-6 rounded-sm border bg-card/40 px-4 py-3 text-xs">
-			{title && (
-				<div className="mb-2 text-base font-normal text-foreground">
-					{title}
-				</div>
-			)}
-
-			<div className="flex flex-wrap items-center gap-x-3 gap-y-1.5 text-muted-foreground">
-				{type && (
-					<Badge variant="outline" className="font-normal">
-						{type}
-					</Badge>
-				)}
-				{status && (
-					<Badge variant="outline" className="font-normal">
-						{status}
-					</Badge>
-				)}
-				{isPrivate && (
-					<Badge
-						variant="outline"
-						className="border-warning-ink/40 font-normal text-warning-ink"
-					>
-						private
-					</Badge>
-				)}
-				{supersededBy && (
-					<Badge
-						variant="outline"
-						className="border-destructive/40 font-normal text-destructive"
-					>
-						superseded → {supersededBy}
-					</Badge>
-				)}
-				{created && (
-					<span>
-						<span className="opacity-60">created</span>{" "}
-						<span className="text-foreground/80">{created}</span>
-					</span>
-				)}
-				{updated && updated !== created && (
-					<span>
-						<span className="opacity-60">updated</span>{" "}
-						<span className="text-foreground/80">{updated}</span>
-					</span>
-				)}
-			</div>
-
-			{tags.length > 0 && (
-				<div className="mt-2 flex flex-wrap gap-1">
-					{tags.map((t) => (
-						<Badge
-							key={t}
-							variant="secondary"
-							className="font-normal text-[11px]"
-						>
-							#{t}
-						</Badge>
-					))}
-				</div>
-			)}
-
-			{sources.length > 0 && (
-				<div className="mt-2">
-					<span className="opacity-60">sources:</span>{" "}
-					<span className="text-foreground/80">{sources.join(", ")}</span>
-				</div>
-			)}
-
-			{otherKeys.length > 0 && (
-				<div className="mt-2 border-t pt-2">
-					<button
-						type="button"
-						onClick={() => setShowRaw((v) => !v)}
-						className="flex items-center gap-1 text-muted-foreground hover:text-foreground"
-					>
-						{showRaw ? (
-							<ChevronDown className="h-3 w-3" />
-						) : (
-							<ChevronRight className="h-3 w-3" />
-						)}
-						<span>
-							{otherKeys.length} more field{otherKeys.length === 1 ? "" : "s"}
-						</span>
-					</button>
-					{showRaw && (
-						<dl className="mt-1.5 grid grid-cols-[max-content_1fr] gap-x-3 gap-y-0.5">
-							{otherKeys.map((k) => (
-								<Fragment key={k}>
-									<dt className="opacity-60">{k}</dt>
-									<dd className="text-foreground/80 break-words">
-										{fmt(data[k])}
-									</dd>
-								</Fragment>
-							))}
-						</dl>
-					)}
-				</div>
-			)}
-		</div>
-	);
-}

package/.next/standalone/src/hooks/use-is-mobile.ts

@@ -1,14 +0,0 @@
-"use client";
-import { useEffect, useState } from "react";
-
-export function useIsMobile(query = "(max-width: 767px)") {
-	const [isMobile, setIsMobile] = useState(false); // SSR-safe default
-	useEffect(() => {
-		const mql = window.matchMedia(query);
-		const on = () => setIsMobile(mql.matches);
-		on();
-		mql.addEventListener("change", on);
-		return () => mql.removeEventListener("change", on);
-	}, [query]);
-	return isMobile;
-}

package/.next/standalone/src/lib/app-runner.ts

@@ -1,272 +0,0 @@
-/**
- * Server-side singleton that manages child processes for node-app directories.
- * Lives as a module-level Map so it persists across requests in both dev and
- * the Next.js standalone production server.
- */
-import { spawn, type ChildProcess, execSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { createConnection, createServer } from "node:net";
-import path from "node:path";
-
-export type AppStatus = "stopped" | "installing" | "starting" | "running" | "error";
-
-interface RunningApp {
-	port: number;
-	process: ChildProcess | null;
-	status: AppStatus;
-	error?: string;
-	logs: string[];
-}
-
-// ── singleton ────────────────────────────────────────────────────────────────
-const apps = new Map<string, RunningApp>();
-
-// ── helpers ──────────────────────────────────────────────────────────────────
-
-function findFreePort(): Promise<number> {
-	return new Promise((resolve, reject) => {
-		const s = createServer();
-		s.listen(0, "127.0.0.1", () => {
-			const addr = s.address();
-			const port = typeof addr === "object" && addr ? addr.port : 0;
-			s.close(() => resolve(port));
-		});
-		s.on("error", reject);
-	});
-}
-
-function canConnect(port: number, host: string): Promise<boolean> {
-	return new Promise((resolve) => {
-		const sock = createConnection(port, host);
-		sock.setTimeout(800);
-		sock.on("connect", () => { sock.destroy(); resolve(true); });
-		sock.on("error",   () => { sock.destroy(); resolve(false); });
-		sock.on("timeout", () => { sock.destroy(); resolve(false); });
-	});
-}
-
-// Probe both IPv4 (127.0.0.1) and IPv6 (::1) — Vite binds to ::1 by default.
-async function waitForPort(port: number, timeoutMs = 30_000): Promise<boolean> {
-	const deadline = Date.now() + timeoutMs;
-	while (Date.now() < deadline) {
-		const [v4, v6] = await Promise.all([
-			canConnect(port, "127.0.0.1"),
-			canConnect(port, "::1"),
-		]);
-		if (v4 || v6) return true;
-		await new Promise((r) => setTimeout(r, 400));
-	}
-	return false;
-}
-
-type PM = "npm" | "pnpm" | "yarn";
-
-function detectPM(dir: string): PM {
-	if (existsSync(path.join(dir, "pnpm-lock.yaml"))) return "pnpm";
-	if (existsSync(path.join(dir, "yarn.lock"))) return "yarn";
-	return "npm";
-}
-
-interface Cmd {
-	bin: string;
-	args: string[];
-	isVite: boolean;
-}
-
-interface Pkg {
-	scripts?: Record<string, string>;
-	main?: string;
-	dependencies?: Record<string, string>;
-	devDependencies?: Record<string, string>;
-}
-
-function readPkg(dir: string): Pkg | null {
-	const pkgPath = path.join(dir, "package.json");
-	if (!existsSync(pkgPath)) return null;
-	try {
-		return JSON.parse(readFileSync(pkgPath, "utf-8")) as Pkg;
-	} catch {
-		return null;
-	}
-}
-
-function hasViteDep(pkg: Pkg): boolean {
-	const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-	return Object.keys(allDeps).some((k) => k === "vite" || k.includes("vite"));
-}
-
-/**
- * Default script chosen when the user doesn't pick one explicitly.
- * Priority: start > preview (built) > dev.
- */
-function defaultScript(dir: string, scripts: Record<string, string>): string | null {
-	if (scripts.start) return "start";
-	if (scripts.preview && existsSync(path.join(dir, "dist"))) return "preview";
-	if (scripts.dev) return "dev";
-	return null;
-}
-
-/**
- * List the npm scripts available to launch, plus which one is the default.
- * Returns empty scripts list when only `main` is runnable (node entry).
- */
-export function getScripts(absPath: string): { scripts: string[]; defaultScript: string | null } {
-	const pkg = readPkg(absPath);
-	if (!pkg) return { scripts: [], defaultScript: null };
-	const scripts = pkg.scripts ?? {};
-	return {
-		scripts: Object.keys(scripts),
-		defaultScript: defaultScript(absPath, scripts),
-	};
-}
-
-function detectCmd(dir: string, pm: PM, script?: string): Cmd | null {
-	const pkg = readPkg(dir);
-	if (!pkg) return null;
-
-	const scripts = pkg.scripts ?? {};
-	const hasVite = hasViteDep(pkg);
-
-	const run = (s: string, extraArgs: string[] = []): Cmd => ({
-		bin: pm,
-		args: ["run", s, ...(extraArgs.length ? ["--", ...extraArgs] : [])],
-		isVite: hasVite,
-	});
-
-	// Explicit script choice wins
-	if (script && scripts[script]) return run(script);
-
-	const def = defaultScript(dir, scripts);
-	if (def) return run(def);
-	if (pkg.main) return { bin: "node", args: [pkg.main], isVite: false };
-	return null;
-}
-
-function needsInstall(dir: string): boolean {
-	return !existsSync(path.join(dir, "node_modules"));
-}
-
-function runInstall(dir: string, pm: PM): Promise<void> {
-	return new Promise((resolve, reject) => {
-		const child = spawn(pm, ["install"], { cwd: dir, stdio: "pipe" });
-		child.on("exit", (code) => (code === 0 ? resolve() : reject(new Error(`${pm} install failed (exit ${code})`))));
-		child.on("error", reject);
-	});
-}
-
-// ── public API ───────────────────────────────────────────────────────────────
-
-export function getStatus(relPath: string): { status: AppStatus; port?: number; error?: string; logs: string[] } {
-	const app = apps.get(relPath);
-	if (!app) return { status: "stopped", logs: [] };
-	return { status: app.status, port: app.port || undefined, error: app.error, logs: app.logs };
-}
-
-export async function startApp(relPath: string, absPath: string, script?: string): Promise<{ port: number }> {
-	const existing = apps.get(relPath);
-	if (existing && existing.status !== "stopped" && existing.status !== "error") {
-		return { port: existing.port };
-	}
-
-	const port = await findFreePort();
-	const pm = detectPM(absPath);
-	const cmd = detectCmd(absPath, pm, script);
-	if (!cmd) throw new Error("No runnable script found in package.json (need start, preview, or dev)");
-
-	const entry: RunningApp = { port, process: null, status: "installing", logs: [] };
-	apps.set(relPath, entry);
-
-	const pushLog = (line: string) => {
-		entry.logs.push(line);
-		if (entry.logs.length > 200) entry.logs.shift();
-	};
-
-	// Install if needed
-	if (needsInstall(absPath)) {
-		try {
-			pushLog(`[wiki-viewer] Running ${pm} install…`);
-			await runInstall(absPath, pm);
-		} catch (e) {
-			entry.status = "error";
-			entry.error = String(e);
-			return { port };
-		}
-	}
-
-	entry.status = "starting";
-	pushLog(`[wiki-viewer] Starting on port ${port}: ${cmd.bin} ${cmd.args.join(" ")}`);
-
-	const portArgs = cmd.isVite ? ["--port", String(port)] : [];
-	const child = spawn(cmd.bin, [...cmd.args, ...portArgs], {
-		cwd: absPath,
-		stdio: "pipe",
-		env: {
-			...process.env,
-			PORT: String(port),
-			VITE_PORT: String(port),
-		},
-	});
-	entry.process = child;
-
-	const handleOutput = (data: Buffer) => {
-		for (const line of data.toString().split("\n")) {
-			if (line.trim()) pushLog(line);
-		}
-	};
-	child.stdout?.on("data", handleOutput);
-	child.stderr?.on("data", handleOutput);
-
-	child.on("exit", (code) => {
-		const a = apps.get(relPath);
-		if (a?.process === child) {
-			a.status = code === 0 || code === null ? "stopped" : "error";
-			a.error = code ? `Process exited with code ${code}` : undefined;
-		}
-	});
-
-	// Wait for port in background
-	waitForPort(port).then((ok) => {
-		const a = apps.get(relPath);
-		if (a?.process === child) {
-			a.status = ok ? "running" : "error";
-			if (!ok) a.error = "Port never became reachable (30 s timeout)";
-		}
-	});
-
-	return { port };
-}
-
-export function stopApp(relPath: string): void {
-	const app = apps.get(relPath);
-	if (!app?.process) return;
-	try {
-		app.process.kill("SIGTERM");
-	} catch {}
-	app.status = "stopped";
-}
-
-export function listApps(): Array<{ relPath: string; status: AppStatus; port?: number }> {
-	return [...apps.entries()].map(([relPath, a]) => ({
-		relPath,
-		status: a.status,
-		port: a.port || undefined,
-	}));
-}
-
-/**
- * Given URL path segments, find the longest prefix that matches a running app.
- * e.g. ["apps", "roadmap-server", "api", "specs"] → { relPath: "apps/roadmap-server", port, rest: "/api/specs" }
- */
-export function resolveByPrefix(
-	segments: string[],
-): { relPath: string; port: number; rest: string } | null {
-	for (let i = segments.length; i > 0; i--) {
-		const relPath = segments.slice(0, i).join("/");
-		const app = apps.get(relPath);
-		if (app && app.status === "running" && app.port) {
-			const rest = "/" + segments.slice(i).join("/");
-			return { relPath, port: app.port, rest };
-		}
-	}
-	return null;
-}

package/.next/standalone/src/lib/auth/admin.ts

@@ -1,120 +0,0 @@
-/**
- * Global admin role.
- *
- * Resolution order:
- *   1. WIKI_ADMIN_EMAILS env (csv, case-insensitive) — seed/override, headless-friendly.
- *   2. config.adminUserIds — persisted list managed via the admin API.
- *
- * Bootstrap: if adminUserIds is empty AND no WIKI_ADMIN_EMAILS is set,
- * the first call to ensureBootstrapAdmin(userId) writes that user as admin.
- * Called lazily on the first authenticated request (race-safe: re-read inside).
- */
-
-import { readConfig, updateConfig } from "@/lib/config";
-import { requireUser } from "@/lib/auth/server";
-
-// ── Internal helpers ───────────────────────────────────────────────────────────
-
-function adminEmailsFromEnv(): string[] {
-	return (process.env.WIKI_ADMIN_EMAILS ?? "")
-		.split(",")
-		.map((e) => e.trim().toLowerCase())
-		.filter(Boolean);
-}
-
-// ── Public API ─────────────────────────────────────────────────────────────────
-
-export async function isAdmin(userId: string, email?: string): Promise<boolean> {
-	// Env override: any matching email is admin
-	if (email) {
-		const envAdmins = adminEmailsFromEnv();
-		if (envAdmins.length > 0 && envAdmins.includes(email.toLowerCase())) {
-			return true;
-		}
-	}
-	const cfg = await readConfig();
-	return (cfg.adminUserIds ?? []).includes(userId);
-}
-
-export async function listAdmins(): Promise<string[]> {
-	const cfg = await readConfig();
-	return cfg.adminUserIds ?? [];
-}
-
-export async function addAdmin(userId: string): Promise<void> {
-	await updateConfig((cfg) => {
-		const current = cfg.adminUserIds ?? [];
-		if (current.includes(userId)) return cfg;
-		return { ...cfg, adminUserIds: [...current, userId] };
-	});
-}
-
-export async function removeAdmin(userId: string): Promise<void> {
-	const hasEnvFallback = adminEmailsFromEnv().length > 0;
-	let rejected = false;
-	await updateConfig((cfg) => {
-		const current = cfg.adminUserIds ?? [];
-		const next = current.filter((id) => id !== userId);
-		// Refuse to remove last admin if no env fallback exists
-		if (next.length === 0 && !hasEnvFallback) {
-			rejected = true;
-			return cfg;
-		}
-		return { ...cfg, adminUserIds: next };
-	});
-	if (rejected) {
-		throw new Error(
-			"LAST_ADMIN: cannot remove the last admin with no WIKI_ADMIN_EMAILS configured",
-		);
-	}
-}
-
-/**
- * If adminUserIds is empty AND no WIKI_ADMIN_EMAILS, write userId as the first
- * admin.  Safe to call concurrently: re-reads inside before writing.
- */
-export async function ensureBootstrapAdmin(userId: string): Promise<void> {
-	if (adminEmailsFromEnv().length > 0) return; // env handles it
-
-	// Fast-path read to avoid the serialized write when an admin already exists.
-	const cfg = await readConfig();
-	if ((cfg.adminUserIds ?? []).length > 0) return;
-
-	let promoted = false;
-	// Atomic: re-check inside the lock so only one concurrent caller writes.
-	await updateConfig((fresh) => {
-		if ((fresh.adminUserIds ?? []).length > 0) return fresh;
-		promoted = true;
-		return { ...fresh, adminUserIds: [userId] };
-	});
-	if (promoted) {
-		console.log(`[wiki-viewer] Bootstrap: first user ${userId} promoted to admin`);
-	}
-}
-
-/**
- * Use in route handlers.
- * Returns { ok: true, user } or { ok: false, status, code } ready for NextResponse.
- */
-export async function requireAdmin(
-	req: Request,
-): Promise<
-	| { ok: true; user: { id: string; email: string; name: string } }
-	| { ok: false; status: number; code: string }
-> {
-	// --no-auth bypass
-	if (process.env.WIKI_NO_AUTH === "1") {
-		return {
-			ok: true,
-			user: { id: "local", email: "local@localhost", name: "local" },
-		};
-	}
-
-	const auth = await requireUser(req);
-	if (!auth.ok) return { ok: false, status: 401, code: "UNAUTHORIZED" };
-
-	const admin = await isAdmin(auth.user.id, auth.user.email);
-	if (!admin) return { ok: false, status: 403, code: "ADMIN_REQUIRED" };
-
-	return { ok: true, user: auth.user };
-}

package/.next/standalone/src/lib/auth/allowlist.ts

@@ -1,50 +0,0 @@
-/**
- * Email allowlist check.
- *
- * Source of truth is ~/.wiki-viewer/config.json (allowedEmails / allowedDomains),
- * editable at runtime via the UI. Env vars AUTH_ALLOWED_EMAILS and
- * AUTH_ALLOWED_DOMAIN act as a fallback seed when config is empty, so existing
- * deployments keep working without a config file.
- *
- * If neither config nor env sets any restriction, all emails are allowed.
- */
-import { readConfig } from "@/lib/config";
-
-function splitList(raw: string | undefined): string[] {
-	return (raw ?? "")
-		.split(",")
-		.map((s) => s.trim().toLowerCase())
-		.filter(Boolean);
-}
-
-/** Resolve the effective allowlist: config wins, env is the fallback. */
-export async function getAllowlist(): Promise<{
-	emails: string[];
-	domains: string[];
-}> {
-	const config = await readConfig();
-	const emails =
-		config.allowedEmails && config.allowedEmails.length > 0
-			? config.allowedEmails.map((s) => s.trim().toLowerCase()).filter(Boolean)
-			: splitList(process.env.AUTH_ALLOWED_EMAILS);
-	const domains =
-		config.allowedDomains && config.allowedDomains.length > 0
-			? config.allowedDomains.map((s) => s.trim().toLowerCase()).filter(Boolean)
-			: splitList(process.env.AUTH_ALLOWED_DOMAIN);
-	return { emails, domains };
-}
-
-export async function isEmailAllowed(email: string): Promise<boolean> {
-	const { emails, domains } = await getAllowlist();
-
-	// No restrictions set — allow all
-	if (emails.length === 0 && domains.length === 0) return true;
-
-	const e = email.toLowerCase();
-	if (emails.includes(e)) return true;
-
-	const at = e.lastIndexOf("@");
-	if (at >= 0 && domains.includes(e.slice(at + 1))) return true;
-
-	return false;
-}

package/.next/standalone/src/lib/auth/client.ts

@@ -1,4 +0,0 @@
-"use client";
-import { createAuthClient } from "better-auth/react";
-
-export const authClient = createAuthClient();

package/.next/standalone/src/lib/auth/csrf.ts

@@ -1,68 +0,0 @@
-import { NextResponse } from "next/server";
-
-/**
- * Reject cross-origin state-changing requests that arrive with a session cookie.
- * Bearer-only requests (no Origin/Referer) pass through — they are authenticated
- * separately and are not vulnerable to CSRF.
- *
- * Returns null if the request may proceed, or a NextResponse(403) to return.
- *
- * Call at the top of every POST/PUT/DELETE/PATCH handler in /api/wiki/* and
- * /api/system/* before requireUser.
- */
-export function checkOrigin(req: Request): NextResponse | null {
-	const method = req.method.toUpperCase();
-	if (method === "GET" || method === "HEAD" || method === "OPTIONS") return null;
-
-	// Bearer-auth agents typically omit Origin/Referer — let checkAuth handle them.
-	const origin = req.headers.get("origin");
-	const referer = req.headers.get("referer");
-	if (!origin && !referer) return null;
-
-	const allowed = buildAllowedOrigins(req.headers.get("host") ?? "");
-
-	if (origin) {
-		if (allowed.has(origin)) return null;
-		return NextResponse.json(
-			{ error: "FORBIDDEN", message: "Bad origin" },
-			{ status: 403 },
-		);
-	}
-
-	if (referer) {
-		try {
-			const { protocol, host } = new URL(referer);
-			if (allowed.has(`${protocol}//${host}`)) return null;
-		} catch {
-			// malformed Referer — reject
-		}
-		return NextResponse.json(
-			{ error: "FORBIDDEN", message: "Bad referer" },
-			{ status: 403 },
-		);
-	}
-
-	return null;
-}
-
-function buildAllowedOrigins(hostHeader: string): Set<string> {
-	const hostname = hostHeader.split(":")[0];
-	const extra = (process.env.WIKI_OWNER_HOSTS ?? "")
-		.split(",")
-		.map((h) => h.trim())
-		.filter(Boolean);
-
-	const hosts = Array.from(new Set(["localhost", "127.0.0.1", hostname, ...extra]));
-	const ports = ["", ":3000", ":3003"];
-	if (hostHeader.includes(":")) ports.push(":" + hostHeader.split(":")[1]);
-
-	const allowed = new Set<string>();
-	for (const h of hosts) {
-		for (const proto of ["http", "https"]) {
-			for (const port of ports) {
-				allowed.add(`${proto}://${h}${port}`);
-			}
-		}
-	}
-	return allowed;
-}