wiki-viewer 1.14.1 → 2.0.0

package/.next/standalone/src/lib/auth/server.ts

@@ -1,215 +0,0 @@
-/**
- * Better Auth server instance.
- * Supports: email+password, Google OAuth (optional).
- * DB: SQLite at ~/.wiki-viewer/auth.db (WAL mode).
- */
-import { betterAuth } from "better-auth";
-import { nextCookies } from "better-auth/next-js";
-import Database from "better-sqlite3";
-import path from "node:path";
-import os from "node:os";
-import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync } from "node:fs";
-import { randomBytes } from "node:crypto";
-import { AsyncLocalStorage } from "node:async_hooks";
-import { isEmailAllowed } from "./allowlist";
-
-// When an admin creates a user, the signup allowlist must not apply (the admin
-// is the gate). We mark that context with an AsyncLocalStorage flag so the
-// user-create hook can skip the allowlist check for that one call only.
-const adminCreateContext = new AsyncLocalStorage<boolean>();
-
-/** Run `fn` with the signup allowlist bypassed (admin-initiated user creation). */
-export function withAdminUserCreate<T>(fn: () => Promise<T>): Promise<T> {
-	return adminCreateContext.run(true, fn);
-}
-
-// Guard runs at server startup, not during next build (NEXT_PHASE=phase-production-build).
-// Set WIKI_ALLOW_INSECURE=1 to bypass the https requirement (development / CI / smoke tests).
-if (
-	process.env.NODE_ENV === "production" &&
-	process.env.NEXT_PHASE !== "phase-production-build" &&
-	process.env.WIKI_ALLOW_INSECURE !== "1"
-) {
-	const url = process.env.BETTER_AUTH_URL ?? "";
-	if (!url) {
-		throw new Error(
-			"BETTER_AUTH_URL is required in production. Set it to https://your-domain so cookies and OAuth callbacks resolve correctly. Set WIKI_ALLOW_INSECURE=1 to bypass (development only).",
-		);
-	}
-	if (!url.startsWith("https://")) {
-		throw new Error(
-			`BETTER_AUTH_URL must be https:// in production (got: ${url}). Set WIKI_ALLOW_INSECURE=1 to bypass (development only).`,
-		);
-	}
-}
-
-const DATA_DIR = path.join(process.env.HOME ?? os.homedir(), ".wiki-viewer");
-mkdirSync(DATA_DIR, { recursive: true });
-const DB_PATH = path.join(DATA_DIR, "auth.db");
-const SECRET_PATH = path.join(DATA_DIR, "auth.secret");
-
-function resolveSecret(): string {
-	if (process.env.BETTER_AUTH_SECRET) return process.env.BETTER_AUTH_SECRET;
-	if (existsSync(SECRET_PATH)) {
-		return readFileSync(SECRET_PATH, "utf-8").trim();
-	}
-	const fresh = randomBytes(32).toString("base64");
-	writeFileSync(SECRET_PATH, fresh, { mode: 0o600 });
-	try {
-		chmodSync(SECRET_PATH, 0o600);
-	} catch {
-		// chmod best-effort on platforms that support it
-	}
-	return fresh;
-}
-
-export const db = new Database(DB_PATH);
-db.pragma("journal_mode = WAL");
-
-function getTrustedOrigins(): string[] {
-	const extra = (process.env.WIKI_OWNER_HOSTS ?? "")
-		.split(",")
-		.map((h) => h.trim())
-		.filter(Boolean);
-	const ports = ["", ":3000", ":3003"];
-	const base = ["http://localhost:3000", "http://localhost:3003"];
-	const extras = extra.flatMap((h) =>
-		ports.flatMap((p) => [`http://${h}${p}`, `https://${h}${p}`]),
-	);
-	return Array.from(new Set([...base, ...extras]));
-}
-
-const socialProviders: Record<string, unknown> = {};
-if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
-	socialProviders.google = {
-		clientId: process.env.GOOGLE_CLIENT_ID,
-		clientSecret: process.env.GOOGLE_CLIENT_SECRET,
-	};
-}
-const hasSocialProvider = Object.keys(socialProviders).length > 0;
-
-// Email/password can be turned off (AUTH_DISABLE_PASSWORD=1) so an operator can
-// require Google sign-in only. Guard against locking everyone out: if no social
-// provider is configured, password auth stays on regardless, otherwise there
-// would be no way to sign in at all.
-const passwordDisabled =
-	process.env.AUTH_DISABLE_PASSWORD === "1" || process.env.AUTH_DISABLE_PASSWORD === "true";
-export const passwordAuthEnabled = !(passwordDisabled && hasSocialProvider);
-if (passwordDisabled && !hasSocialProvider) {
-	console.warn(
-		"[wiki-viewer] AUTH_DISABLE_PASSWORD is set but no social provider is configured. " +
-			"Keeping email/password enabled so you are not locked out. Configure GOOGLE_CLIENT_ID/" +
-			"GOOGLE_CLIENT_SECRET to disable password auth.",
-	);
-}
-
-// Forced account linking. By default Better Auth only auto-links a social
-// login to an existing account when BOTH sides are email-verified. Two
-// separate checks gate this (see better-auth oauth2/link-account):
-//   1. the provider must report the email verified, OR the provider is trusted
-//   2. the existing local account must be email-verified, unless
-//      requireLocalEmailVerified is false
-// A pre-existing password account with emailVerified=0 fails check 2 even when
-// the provider is trusted. So listing a provider in AUTH_TRUSTED_PROVIDERS also
-// turns off requireLocalEmailVerified, otherwise Google sign-in still returns
-// account_not_linked. This trades a little account-takeover risk for the
-// ability to consolidate onto Google sign-in, so it is opt-in.
-const trustedProviders = (process.env.AUTH_TRUSTED_PROVIDERS ?? "")
-	.split(",")
-	.map((p) => p.trim())
-	.filter(Boolean);
-
-export const auth = betterAuth({
-	database: db,
-	secret: resolveSecret(),
-	baseURL: process.env.BETTER_AUTH_URL,
-	account: {
-		accountLinking: {
-			enabled: true,
-			...(trustedProviders.length
-				? { trustedProviders, requireLocalEmailVerified: false }
-				: {}),
-		} as Record<string, unknown>,
-	},
-	emailAndPassword: {
-		enabled: passwordAuthEnabled,
-		requireEmailVerification: false,
-		autoSignIn: true,
-	},
-	// Loosen Better Auth's default 3-per-10-seconds limit on /sign-in/email
-	// so a single bad password doesn't lock the user out for the window.
-	// Per-user lockout is not implemented (Better Auth rate-limits by IP).
-	rateLimit: {
-		enabled: process.env.NODE_ENV === "production",
-		window: 60,
-		max: 100,
-		customRules: {
-			"/sign-in/email": { window: 60, max: 20 },
-			"/sign-up/email": { window: 60, max: 10 },
-		},
-	},
-	socialProviders,
-	databaseHooks: {
-		user: {
-			create: {
-				before: async (user: { email: string }) => {
-					if (!adminCreateContext.getStore() && !(await isEmailAllowed(user.email))) {
-						throw new Error("SIGNUP_NOT_ALLOWED");
-					}
-					return { data: user };
-				},
-			},
-		},
-	},
-	plugins: [nextCookies()],
-	trustedOrigins: getTrustedOrigins(),
-});
-
-// Auto-migrate tables on first import. Idempotent: re-runs are no-ops once schema matches.
-// Exposed as a Promise so consumers can await readiness before issuing auth calls.
-const MIGRATED_PROMISE_KEY = Symbol.for("wiki-viewer.better-auth.migration-promise");
-interface GlobalWithPromise {
-	[k: symbol]: Promise<void> | undefined;
-}
-const g = globalThis as unknown as GlobalWithPromise;
-if (!g[MIGRATED_PROMISE_KEY]) {
-	g[MIGRATED_PROMISE_KEY] = (async () => {
-		const mod = (await import("better-auth/db/migration")) as {
-			getMigrations: (opts: unknown) => Promise<{ runMigrations: () => Promise<void> }>;
-		};
-		const { runMigrations } = await mod.getMigrations(
-			(auth as unknown as { options: unknown }).options,
-		);
-		await runMigrations();
-	})();
-}
-
-/** Await this in tests / one-shot scripts before calling auth.api.*. */
-export function authReady(): Promise<void> {
-	return g[MIGRATED_PROMISE_KEY] ?? Promise.resolve();
-}
-
-export interface SessionUser {
-	id: string;
-	email: string;
-	name: string;
-}
-
-export async function getSessionFromRequest(req: Request) {
-	return auth.api.getSession({ headers: req.headers });
-}
-
-export async function requireUser(
-	req: Request,
-): Promise<{ ok: true; user: SessionUser } | { ok: false }> {
-	const session = await getSessionFromRequest(req);
-	if (!session?.user) return { ok: false };
-	return {
-		ok: true,
-		user: {
-			id: session.user.id,
-			email: session.user.email,
-			name: session.user.name,
-		},
-	};
-}

package/.next/standalone/src/lib/cabinets/tree.ts

@@ -1,75 +0,0 @@
-import type { TreeNode } from "@/types";
-
-function pathMatchesNode(targetPath: string, nodePath: string): boolean {
-	return targetPath === nodePath || targetPath.startsWith(`${nodePath}/`);
-}
-
-export function findRootCabinetNode(nodes: TreeNode[]): TreeNode | null {
-	const root = nodes[0];
-	return root?.type === "cabinet" && root.path === "." ? root : null;
-}
-
-export function findNodeByPath(
-	nodes: TreeNode[],
-	path: string,
-): TreeNode | null {
-	for (const node of nodes) {
-		if (node.path === path) return node;
-		if (node.children) {
-			const found = findNodeByPath(node.children, path);
-			if (found) return found;
-		}
-	}
-
-	return null;
-}
-
-export function findDeepestCabinetNode(
-	nodes: TreeNode[],
-	targetPath: string,
-): TreeNode | null {
-	let match: TreeNode | null = null;
-
-	for (const node of nodes) {
-		if (!pathMatchesNode(targetPath, node.path)) continue;
-
-		if (node.type === "cabinet") {
-			match = node;
-		}
-
-		if (node.children) {
-			const childMatch = findDeepestCabinetNode(node.children, targetPath);
-			if (childMatch) {
-				match = childMatch;
-			}
-		}
-	}
-
-	return match;
-}
-
-export function findParentCabinetNode(
-	nodes: TreeNode[],
-	cabinetPath: string,
-	cabinetAncestor: TreeNode | null = null,
-): TreeNode | null {
-	for (const node of nodes) {
-		const nextCabinetAncestor =
-			node.type === "cabinet" ? node : cabinetAncestor;
-
-		if (node.path === cabinetPath) {
-			return node.type === "cabinet" ? cabinetAncestor : null;
-		}
-
-		if (node.children) {
-			const found = findParentCabinetNode(
-				node.children,
-				cabinetPath,
-				nextCabinetAncestor,
-			);
-			if (found) return found;
-		}
-	}
-
-	return null;
-}

package/.next/standalone/src/lib/config.ts

@@ -1,114 +0,0 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-
-// Workspace type is defined in workspaces.ts; we use a forward-compatible
-// inline shape here to avoid a circular import between config ↔ workspaces.
-export interface WorkspaceGitEntry {
-	remoteUrl: string;
-	branch?: string;
-	tokenRef?: string;
-	username?: string;
-	lastPulledAt?: string;
-	lastSha?: string;
-	lastError?: string;
-	/** Sparse-checkout cone path (e.g. "docs"). rootDir points here inside the clone. */
-	subpath?: string;
-	/** Absolute path of the clone root. rootDir may differ when subpath is set. */
-	cloneRoot?: string;
-}
-
-export interface WorkspaceEntry {
-	id: string;
-	name: string;
-	rootDir: string;
-	createdAt: string;
-	lastOpenedAt?: string;
-	pinnedPaths?: string[];
-	createdBy?: string;
-	allowedUserIds?: string[];
-	readOnly?: boolean;
-	git?: WorkspaceGitEntry;
-}
-
-export interface WikiViewerConfig {
-	pinnedPaths?: string[];
-	lastOpenedPath?: string;
-	/** Email allowlist for signup. Empty/undefined = no email restriction. */
-	allowedEmails?: string[];
-	/** Domain allowlist for signup. Empty/undefined = no domain restriction. */
-	allowedDomains?: string[];
-	/** Registered workspaces (replaces flat lastOpenedPath/pinnedPaths over time). */
-	workspaces?: WorkspaceEntry[];
-	/** User IDs with admin privileges. Empty = no admins yet (bootstrap on first request). */
-	adminUserIds?: string[];
-	/** Git-backed workspace host policy. */
-	git?: {
-		allowedHosts?: string[];
-		allowInsecureHttp?: boolean;
-	};
-}
-
-function configPath() {
-	return path.join(os.homedir(), ".wiki-viewer", "config.json");
-}
-
-/** Absolute path to the managed git clone directory. */
-export function reposDir(): string {
-	return path.join(os.homedir(), ".wiki-viewer", "repos");
-}
-
-async function ensureDir() {
-	await mkdir(path.join(os.homedir(), ".wiki-viewer"), { recursive: true });
-}
-
-export async function readConfig(): Promise<WikiViewerConfig> {
-	try {
-		const raw = await readFile(configPath(), "utf8");
-		return JSON.parse(raw) as WikiViewerConfig;
-	} catch {
-		return {};
-	}
-}
-
-// Serialize all writes so concurrent read-modify-write callers can't lose
-// updates (workspace mutations, admin bootstrap all race on one file).
-let _writeChain: Promise<unknown> = Promise.resolve();
-
-function serialize<T>(fn: () => Promise<T>): Promise<T> {
-	const run = _writeChain.then(fn, fn);
-	// Keep the chain alive but swallow errors so one failure doesn't poison it.
-	_writeChain = run.then(
-		() => undefined,
-		() => undefined,
-	);
-	return run;
-}
-
-async function writeConfigUnsafe(next: WikiViewerConfig): Promise<void> {
-	await ensureDir();
-	await writeFile(configPath(), JSON.stringify(next, null, 2), "utf8");
-}
-
-export async function writeConfig(patch: Partial<WikiViewerConfig>): Promise<void> {
-	return serialize(async () => {
-		const existing = await readConfig();
-		await writeConfigUnsafe({ ...existing, ...patch });
-	});
-}
-
-/**
- * Atomic read-modify-write. The mutator receives a fresh copy of the config
- * (read inside the lock) and returns the next config. Serialized against all
- * other writeConfig/updateConfig callers so updates are never lost.
- */
-export async function updateConfig(
-	mutator: (cfg: WikiViewerConfig) => WikiViewerConfig,
-): Promise<WikiViewerConfig> {
-	return serialize(async () => {
-		const existing = await readConfig();
-		const next = mutator({ ...existing });
-		await writeConfigUnsafe(next);
-		return next;
-	});
-}

package/.next/standalone/src/lib/embeds/detect.ts

@@ -1,142 +0,0 @@
-export type EmbedProvider =
-	| "youtube"
-	| "vimeo"
-	| "loom"
-	| "twitter"
-	| "facebook"
-	| "instagram"
-	| "tiktok"
-	| "spotify"
-	| "video"
-	| "iframe";
-
-export interface DetectedEmbed {
-	provider: EmbedProvider;
-	embedUrl: string;
-	originalUrl: string;
-	/** Aspect ratio as width/height, e.g. 16/9 = 1.777… */
-	aspectRatio?: number;
-}
-
-const YT_ID =
-	/(?:youtube\.com\/(?:watch\?v=|shorts\/|embed\/|v\/)|youtu\.be\/)([A-Za-z0-9_-]{6,})/;
-const VIMEO_ID = /vimeo\.com\/(?:video\/)?(\d+)/;
-const LOOM_ID = /loom\.com\/share\/([A-Za-z0-9]+)/;
-const TWITTER = /^https?:\/\/(?:twitter\.com|x\.com)\/[^/]+\/status\/(\d+)/;
-const FACEBOOK = /^https?:\/\/(?:www\.)?facebook\.com\/.+/;
-const INSTAGRAM =
-	/^https?:\/\/(?:www\.)?instagram\.com\/(?:p|reel|tv)\/([^/?#]+)/;
-const TIKTOK = /^https?:\/\/(?:www\.)?tiktok\.com\/@[^/]+\/video\/(\d+)/;
-const SPOTIFY =
-	/^https?:\/\/open\.spotify\.com\/(track|album|playlist|episode|show)\/([A-Za-z0-9]+)/;
-const VIDEO_FILE = /\.(mp4|webm|ogg|mov|m4v)(\?|$)/i;
-
-export function detectEmbed(raw: string): DetectedEmbed | null {
-	const url = raw.trim();
-	if (!url) return null;
-
-	const yt = url.match(YT_ID);
-	if (yt) {
-		return {
-			provider: "youtube",
-			embedUrl: `https://www.youtube.com/embed/${yt[1]}`,
-			originalUrl: url,
-			aspectRatio: 16 / 9,
-		};
-	}
-
-	const vi = url.match(VIMEO_ID);
-	if (vi) {
-		return {
-			provider: "vimeo",
-			embedUrl: `https://player.vimeo.com/video/${vi[1]}`,
-			originalUrl: url,
-			aspectRatio: 16 / 9,
-		};
-	}
-
-	const lo = url.match(LOOM_ID);
-	if (lo) {
-		return {
-			provider: "loom",
-			embedUrl: `https://www.loom.com/embed/${lo[1]}`,
-			originalUrl: url,
-			aspectRatio: 16 / 9,
-		};
-	}
-
-	if (TWITTER.test(url)) {
-		return { provider: "twitter", embedUrl: url, originalUrl: url };
-	}
-
-	if (INSTAGRAM.test(url)) {
-		return {
-			provider: "instagram",
-			embedUrl: url.replace(/\/?(\?.*)?$/, "/embed"),
-			originalUrl: url,
-		};
-	}
-
-	const tt = url.match(TIKTOK);
-	if (tt) {
-		return {
-			provider: "tiktok",
-			embedUrl: `https://www.tiktok.com/embed/v2/${tt[1]}`,
-			originalUrl: url,
-			aspectRatio: 9 / 16,
-		};
-	}
-
-	const sp = url.match(SPOTIFY);
-	if (sp) {
-		return {
-			provider: "spotify",
-			embedUrl: `https://open.spotify.com/embed/${sp[1]}/${sp[2]}`,
-			originalUrl: url,
-		};
-	}
-
-	if (FACEBOOK.test(url)) {
-		return {
-			provider: "facebook",
-			embedUrl: `https://www.facebook.com/plugins/post.php?href=${encodeURIComponent(url)}&show_text=true`,
-			originalUrl: url,
-		};
-	}
-
-	if (VIDEO_FILE.test(url) || url.startsWith("/api/assets/")) {
-		return { provider: "video", embedUrl: url, originalUrl: url };
-	}
-
-	// Fallback: any http(s) URL can be embedded as a generic iframe.
-	if (/^https?:\/\//.test(url)) {
-		return { provider: "iframe", embedUrl: url, originalUrl: url };
-	}
-
-	return null;
-}
-
-export function providerLabel(p: EmbedProvider): string {
-	switch (p) {
-		case "youtube":
-			return "YouTube";
-		case "vimeo":
-			return "Vimeo";
-		case "loom":
-			return "Loom";
-		case "twitter":
-			return "X / Twitter";
-		case "facebook":
-			return "Facebook";
-		case "instagram":
-			return "Instagram";
-		case "tiktok":
-			return "TikTok";
-		case "spotify":
-			return "Spotify";
-		case "video":
-			return "Video file";
-		case "iframe":
-			return "Web page";
-	}
-}

package/.next/standalone/src/lib/git-secrets.ts

@@ -1,65 +0,0 @@
-/**
- * Secure store for git remote tokens (PATs, deploy keys, etc.).
- * Tokens live in ~/.wiki-viewer/git-secrets.json at mode 0600.
- * They NEVER appear in config.json, logs, or API responses.
- */
-import { readFileSync, writeFileSync, existsSync, chmodSync } from "node:fs";
-import { mkdir } from "node:fs/promises";
-import { randomBytes } from "node:crypto";
-import path from "node:path";
-import os from "node:os";
-
-function dataDir(): string {
-	return path.join(process.env.HOME ?? os.homedir(), ".wiki-viewer");
-}
-
-function secretsPath(): string {
-	return path.join(dataDir(), "git-secrets.json");
-}
-
-function readStore(): Record<string, string> {
-	const p = secretsPath();
-	if (!existsSync(p)) return {};
-	try {
-		return JSON.parse(readFileSync(p, "utf-8")) as Record<string, string>;
-	} catch {
-		return {};
-	}
-}
-
-function writeStore(store: Record<string, string>): void {
-	const p = secretsPath();
-	writeFileSync(p, JSON.stringify(store), { mode: 0o600 });
-	try {
-		chmodSync(p, 0o600);
-	} catch {
-		// chmod is best-effort
-	}
-}
-
-/** Generate a unique reference key for a stored token. */
-export function genTokenRef(): string {
-	return "git_" + randomBytes(9).toString("base64url");
-}
-
-/** Store a token under the given ref. Creates the file if absent. */
-export async function setToken(ref: string, token: string): Promise<void> {
-	await mkdir(dataDir(), { recursive: true });
-	const store = readStore();
-	store[ref] = token;
-	writeStore(store);
-}
-
-/** Retrieve a token by ref. Returns null if ref or file is absent. */
-export async function getToken(ref: string): Promise<string | null> {
-	const store = readStore();
-	return store[ref] ?? null;
-}
-
-/** Remove a token. No-op if ref does not exist. */
-export async function deleteToken(ref: string): Promise<void> {
-	const store = readStore();
-	if (!(ref in store)) return;
-	delete store[ref];
-	writeStore(store);
-}