wiki-viewer 1.9.0 → 1.10.1

package/.next/standalone/src/app/api/share/[token]/route.ts

@@ -0,0 +1,269 @@
+import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
+import { getWorkspace } from "@/lib/workspaces";
+import { safeAbsPath } from "@/lib/proof/raw-fs";
+import { checkAndConsume } from "@/lib/proof/rate-limit";
+import {
+	getShareByToken,
+	verifyPassword,
+	revokeShare,
+	isExpired,
+	incrementViewCount,
+} from "@/lib/shared-docs/db";
+
+const MAX_DISPLAY_SIZE = 1 * 1024 * 1024; // 1MB
+
+// ── Shared helper: read file content for a resolved share ────────────────────
+
+async function resolveContent(
+	token: string,
+): Promise<
+	| { ok: true; content: string; filename: string; viewCount: number }
+	| { ok: false; response: NextResponse }
+> {
+	const share = getShareByToken(token);
+	if (!share) {
+		return {
+			ok: false,
+			response: NextResponse.json(
+				{ error: "not_found", message: "Share link not found" },
+				{ status: 404 },
+			),
+		};
+	}
+
+	if (share.isRevoked) {
+		return {
+			ok: false,
+			response: NextResponse.json(
+				{ error: "revoked", message: "Share link has been revoked" },
+				{ status: 410 },
+			),
+		};
+	}
+
+	if (isExpired(share)) {
+		return {
+			ok: false,
+			response: NextResponse.json(
+				{ error: "expired", message: "Share link has expired" },
+				{ status: 410 },
+			),
+		};
+	}
+
+	const ws = await getWorkspace(share.workspaceId);
+	if (!ws) {
+		return {
+			ok: false,
+			response: NextResponse.json(
+				{ error: "workspace_gone", message: "Workspace no longer exists" },
+				{ status: 410 },
+			),
+		};
+	}
+
+	const absPath = await safeAbsPath(ws.rootDir, share.filePath);
+	if (!absPath) {
+		return {
+			ok: false,
+			response: NextResponse.json(
+				{ error: "path_invalid", message: "Invalid file path" },
+				{ status: 400 },
+			),
+		};
+	}
+
+	const { readFile, stat } = await import("node:fs/promises");
+	try {
+		const info = await stat(absPath);
+		if (info.size > MAX_DISPLAY_SIZE) {
+			return {
+				ok: false,
+				response: NextResponse.json(
+					{ error: "too_large", message: "File too large to share (max 1MB)" },
+					{ status: 413 },
+				),
+			};
+		}
+	} catch {
+		return {
+			ok: false,
+			response: NextResponse.json(
+				{ error: "file_gone", message: "File no longer exists" },
+				{ status: 410 },
+			),
+		};
+	}
+
+	let content: string;
+	try {
+		const buffer = await readFile(absPath);
+		content = buffer.toString("utf-8");
+	} catch (err: unknown) {
+		const detail = err instanceof Error ? err.message : String(err);
+		console.error("[share] readFile(%s) %s", absPath, detail);
+		return {
+			ok: false,
+			response: NextResponse.json(
+				{ error: "read_error", message: "Failed to read file" },
+				{ status: 500 },
+			),
+		};
+	}
+
+	incrementViewCount(token);
+	const filename = share.filePath.split("/").pop() ?? share.filePath;
+
+	return { ok: true, content, filename, viewCount: share.viewCount + 1 };
+}
+
+// ── GET: Resolve a share link (public) ───────────────────────────────────────
+
+export async function GET(
+	request: Request,
+	{ params }: { params: Promise<{ token: string }> },
+) {
+	const { token } = await params;
+
+	const rl = checkAndConsume(`share:${token}`, 1);
+	if (!rl.ok) {
+		return NextResponse.json(
+			{ error: "rate_limited", message: "Too many requests" },
+			{
+				status: 429,
+				headers: { "Retry-After": String(Math.ceil(rl.retryAfterMs / 1000)) },
+			},
+		);
+	}
+
+	const share = getShareByToken(token);
+	if (!share) {
+		return NextResponse.json(
+			{ error: "not_found", message: "Share link not found" },
+			{ status: 404 },
+		);
+	}
+
+	if (share.isRevoked) {
+		return NextResponse.json(
+			{ error: "revoked", message: "Share link has been revoked" },
+			{ status: 410 },
+		);
+	}
+
+	if (isExpired(share)) {
+		return NextResponse.json(
+			{ error: "expired", message: "Share link has expired" },
+			{ status: 410 },
+		);
+	}
+
+	// Password-protected: tell client to POST to /unlock instead
+	if (share.passwordHash) {
+		return NextResponse.json(
+			{ protected: true, message: "This document is password-protected" },
+			{ status: 401 },
+		);
+	}
+
+	const result = await resolveContent(token);
+	if (!result.ok) return result.response;
+
+	return NextResponse.json({
+		content: result.content,
+		filename: result.filename,
+		viewCount: result.viewCount,
+	});
+}
+
+// ── POST: Unlock a password-protected share ───────────────────────────────────
+
+export async function POST(
+	request: Request,
+	{ params }: { params: Promise<{ token: string }> },
+) {
+	const { token } = await params;
+
+	const share = getShareByToken(token);
+	if (!share) {
+		return NextResponse.json({ error: "not_found" }, { status: 404 });
+	}
+	if (share.isRevoked) {
+		return NextResponse.json({ error: "revoked" }, { status: 410 });
+	}
+	if (isExpired(share)) {
+		return NextResponse.json({ error: "expired" }, { status: 410 });
+	}
+	if (!share.passwordHash) {
+		return NextResponse.json({ error: "not_protected" }, { status: 400 });
+	}
+
+	// Rate limit password attempts
+	const rl = checkAndConsume(`share-pwd:${token}`, 1);
+	if (!rl.ok) {
+		return NextResponse.json(
+			{ error: "rate_limited", message: "Too many attempts. Try again later." },
+			{
+				status: 429,
+				headers: { "Retry-After": String(Math.ceil(rl.retryAfterMs / 1000)) },
+			},
+		);
+	}
+
+	const body: { password?: string } = await request.json();
+	if (!body.password || typeof body.password !== "string") {
+		return NextResponse.json({ error: "missing_password" }, { status: 400 });
+	}
+
+	if (!verifyPassword(body.password, share.passwordHash)) {
+		return NextResponse.json(
+			{ error: "wrong_password", message: "Incorrect password" },
+			{ status: 403 },
+		);
+	}
+
+	const result = await resolveContent(token);
+	if (!result.ok) return result.response;
+
+	return NextResponse.json({
+		content: result.content,
+		filename: result.filename,
+		viewCount: result.viewCount,
+	});
+}
+
+// ── DELETE: Revoke a share link (auth required) ───────────────────────────────
+
+export async function DELETE(
+	request: Request,
+	{ params }: { params: Promise<{ token: string }> },
+) {
+	const { token } = await params;
+
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const auth = await requireUser(request);
+	if (!auth.ok) {
+		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	}
+
+	const share = getShareByToken(token);
+	if (!share) {
+		return NextResponse.json({ error: "not_found" }, { status: 404 });
+	}
+
+	if (share.createdBy !== auth.user.id) {
+		const { isAdmin } = await import("@/lib/auth/admin");
+		const admin = await isAdmin(auth.user.id, auth.user.email);
+		if (!admin) {
+			return NextResponse.json({ error: "FORBIDDEN" }, { status: 403 });
+		}
+	}
+
+	revokeShare(share.id);
+
+	return NextResponse.json({ ok: true });
+}

package/.next/standalone/src/app/api/share/route.ts

@@ -0,0 +1,127 @@
+import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeAbsPath } from "@/lib/proof/raw-fs";
+import {
+	createShare,
+	listSharesForFile,
+} from "@/lib/shared-docs/db";
+
+// ── POST: Create a share link ─────────────────────────────────────────────────
+
+export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	// Must be signed in
+	const auth = await requireUser(request);
+	if (!auth.ok) {
+		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	}
+
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) {
+		return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	}
+
+	const body: {
+		path?: string;
+		password?: string;
+		expiresAt?: string;
+	} = await request.json();
+
+	const relPath = body.path;
+	if (!relPath || typeof relPath !== "string") {
+		return NextResponse.json({ error: "Missing path" }, { status: 400 });
+	}
+
+	// Verify the file exists and belongs to this workspace
+	const absPath = await safeAbsPath(ctx.rootDir, relPath);
+	if (!absPath) {
+		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
+	}
+
+	const { stat } = await import("node:fs/promises");
+	try {
+		await stat(absPath);
+	} catch {
+		return NextResponse.json({ error: "File not found" }, { status: 404 });
+	}
+
+	// Validate optional params
+	if (body.password !== undefined && typeof body.password !== "string") {
+		return NextResponse.json({ error: "Invalid password" }, { status: 400 });
+	}
+	if (
+		body.expiresAt !== undefined &&
+		body.expiresAt !== null &&
+		typeof body.expiresAt !== "string"
+	) {
+		return NextResponse.json({ error: "Invalid expiresAt" }, { status: 400 });
+	}
+	// Reject invalid or already-expired dates
+	if (body.expiresAt) {
+		const d = new Date(body.expiresAt);
+		if (isNaN(d.getTime())) {
+			return NextResponse.json({ error: "Invalid date" }, { status: 400 });
+		}
+		if (d.getTime() < Date.now()) {
+			return NextResponse.json({ error: "Date is in the past" }, { status: 400 });
+		}
+	}
+
+	const share = createShare({
+		workspaceId: ctx.ws.id,
+		filePath: relPath,
+		password: body.password && body.password.length > 0 ? body.password : undefined,
+		expiresAt: body.expiresAt || undefined,
+		createdBy: auth.user.id,
+	});
+
+	return NextResponse.json({
+		token: share.token,
+		url: `/s/${share.token}`,
+		hasPassword: !!share.passwordHash,
+		expiresAt: share.expiresAt,
+		createdAt: share.createdAt,
+	});
+}
+
+// ── GET: List share links for a file ──────────────────────────────────────────
+
+export async function GET(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const auth = await requireUser(request);
+	if (!auth.ok) {
+		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	}
+
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) {
+		return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	}
+
+	const { searchParams } = new URL(request.url);
+	const relPath = searchParams.get("path");
+	if (!relPath) {
+		return NextResponse.json({ error: "Missing path" }, { status: 400 });
+	}
+
+	const shares = listSharesForFile(ctx.ws.id, relPath);
+
+	return NextResponse.json({
+		shares: shares.map((s) => ({
+			id: s.id,
+			token: s.token,
+			url: `/s/${s.token}`,
+			hasPassword: !!s.passwordHash,
+			expiresAt: s.expiresAt,
+			createdAt: s.createdAt,
+			viewCount: s.viewCount,
+			isExpired: s.expiresAt ? new Date(s.expiresAt) < new Date() : false,
+		})),
+	});
+}

package/.next/standalone/src/app/globals.css

@@ -31,6 +31,7 @@
   --warning-ink: #a16207;
   --border: #e7e5e4;
   --input: #d6d3d1;
+  --switch-checked: #292524;
   --ring: #292524;
   --radius: 8px;
 
@@ -127,6 +128,7 @@
   --warning-ink: #fbbf24;
   --border: #292524;
   --input: #292524;
+  --switch-checked: #f5f5f5;
   --ring: #ffffff;
 
   --chart-1: #ffffff;

package/.next/standalone/src/app/page.tsx

@@ -26,7 +26,12 @@ import {
 	Pin,
 	Plus,
 	RefreshCw,
+	Search,
 	Settings,
+	Share,
+	Slash,
+	SortAsc,
+	Sparkles,
 	Star,
 	Terminal,
 	Trash2,
@@ -62,6 +67,7 @@ import { getActiveWorkspaceId, withWs, wsFetch } from "@/lib/workspace-client";
 import { markdownToHtml } from "@/lib/markdown/to-html";
 import { ThemeToggle } from "@/components/theme-toggle";
 import { AuthSettingsSheet } from "@/components/auth-settings-sheet";
+import { ShareDialog } from "@/components/share-dialog";
 import { Button } from "@/components/ui/button";
 import { Card } from "@/components/ui/card";
 
@@ -367,6 +373,7 @@ export default function Page() {
 	const [appKey, setAppKey] = useState(0);
 	const [sidebarCollapsed, setSidebarCollapsed] = useState(false);
 	const [settingsOpen, setSettingsOpen] = useState(false);
+const [shareDialogOpen, setShareDialogOpen] = useState(false);
 	const [fileContent, setFileContent] = useState<string | null>(null);
 	const [fileRevision, setFileRevision] = useState(0);
 	const [fileLoading, setFileLoading] = useState(false);
@@ -2108,6 +2115,15 @@ export default function Page() {
 								</div>
 								<div className="flex items-center gap-1 shrink-0">
 									{renderCopyMenu(openFile)}
+									<Button
+										size="sm"
+										variant="ghost"
+										className="h-7 w-7 p-0"
+										title="Share"
+										onClick={() => setShareDialogOpen(true)}
+									>
+										<Share className="h-3.5 w-3.5" />
+									</Button>
 									{isText(openFile.name) &&
 										!editing &&
 										(fileContent !== null || isMarkdown(openFile.name)) && (
@@ -2296,6 +2312,11 @@ export default function Page() {
 				)}
 			</div>
 
+			<ShareDialog
+				open={shareDialogOpen}
+				onOpenChange={setShareDialogOpen}
+				filePath={openFile?.path ?? ""}
+			/>
 			<AuthSettingsSheet open={settingsOpen} onOpenChange={setSettingsOpen} />
 			<AIPanel currentPath={openFile?.path} />
 			<input