remove projects and apps end to end
deletes the last of the projects/apps cluster: the published-app store (/api/apps + /api/app-serve), the project dev-server and its websocket proxy (/api/dev-server + /api/dev-server-proxy), the shared html-rewrite they were the only consumers of, and their frontend — the Preview panel, the UserApp panel/header, useUserApps and the /settings/apps screen. also drops getUserProjectsDir and getUserAppsDir, the ProjectType and ProjectDefinition types, and the 'dev-server' websocket provider from server.tsx. nothing on disk is touched. 1440 deletions, 31 insertions. tsgo clean.
This commit is contained in:
@@ -1,46 +0,0 @@
|
||||
// Injected into proxied HTML to intercept fetch/XHR/WebSocket so absolute paths
|
||||
// go through the proxy instead of hitting the host server directly.
|
||||
// Also injects JWT auth headers from localStorage for authenticated requests.
|
||||
export const proxyOverrideScript = (base: string) =>
|
||||
`<script>(function(){` +
|
||||
`var b=${JSON.stringify(base)},o=location.origin;` +
|
||||
`function gt(){try{return localStorage.getItem("BEARER_TOKEN")||localStorage.getItem("PERTENTO_EDITOR_AUTH_TOKEN")}catch(e){return null}}` +
|
||||
`function rw(u){` +
|
||||
`if(typeof u==="string"){` +
|
||||
`if(u.startsWith("/")&&!u.startsWith("//")&&!u.startsWith(b))return b+u;` +
|
||||
`if(u.startsWith(o+"/")&&!u.startsWith(o+b))return o+b+u.slice(o.length);` +
|
||||
`return u}` +
|
||||
`if(u instanceof URL&&u.origin===o&&!u.pathname.startsWith(b))` +
|
||||
`return new URL(o+b+u.pathname+u.search+u.hash);` +
|
||||
`if(u instanceof Request){var p=new URL(u.url);` +
|
||||
`if(p.origin===o&&!p.pathname.startsWith(b))` +
|
||||
`return new Request(o+b+p.pathname+p.search+p.hash,u)}` +
|
||||
`return u}` +
|
||||
`var F=window.fetch;window.fetch=function(i,n){` +
|
||||
`var t=gt();if(t){n=n||{};var h=new Headers(n.headers||{});` +
|
||||
`if(!h.has("Authorization"))h.set("Authorization","Bearer "+t);n.headers=h}` +
|
||||
`return F.call(this,rw(i),n)};` +
|
||||
`var XO=XMLHttpRequest.prototype.open,XS=XMLHttpRequest.prototype.send;` +
|
||||
`XMLHttpRequest.prototype.open=function(){arguments[1]=rw(arguments[1]);this._authSet=false;return XO.apply(this,arguments)};` +
|
||||
`XMLHttpRequest.prototype.send=function(d){` +
|
||||
`if(!this._authSet){var t=gt();if(t)try{this.setRequestHeader("Authorization","Bearer "+t)}catch(e){}}` +
|
||||
`return XS.call(this,d)};` +
|
||||
`var NWS=window.WebSocket;window.WebSocket=function(u,p){` +
|
||||
`if(typeof u==="string"&&(u.startsWith("ws://"+location.host)||u.startsWith("wss://"+location.host)||u.startsWith("/"))){` +
|
||||
`var t=gt();if(t){var sep=u.indexOf("?")>-1?"&":"?";u=u+sep+"token="+encodeURIComponent(t)}}` +
|
||||
`return p!==undefined?new NWS(u,p):new NWS(u)};` +
|
||||
`window.WebSocket.prototype=NWS.prototype;window.WebSocket.CONNECTING=NWS.CONNECTING;` +
|
||||
`window.WebSocket.OPEN=NWS.OPEN;window.WebSocket.CLOSING=NWS.CLOSING;window.WebSocket.CLOSED=NWS.CLOSED;` +
|
||||
`})()</script>`;
|
||||
|
||||
// HTML: rewrite src/href/action attributes with absolute paths + inject fetch/XHR override
|
||||
export const rewriteHtml = (html: string, base: string) =>
|
||||
html
|
||||
.replace(/<head([^>]*)>/i, `<head$1>${proxyOverrideScript(base)}`)
|
||||
.replace(/(href|src|action)="\/(?!\/)/g, `$1="${base}/`)
|
||||
.replace(/(href|src|action)='\/(?!\/)/g, `$1='${base}/`)
|
||||
.replace(/url\(\//g, `url(${base}/`);
|
||||
|
||||
// JS/CSS: only rewrite /_bun/ asset paths (Bun dev server specific)
|
||||
export const rewriteAssetPaths = (text: string, base: string) =>
|
||||
text.replace(/\/_bun\//g, `${base}/_bun/`);
|
||||
@@ -1,2 +0,0 @@
|
||||
export { appsRouter, appServeRouter } from './router';
|
||||
export type { AppManifest } from './router';
|
||||
@@ -1,298 +0,0 @@
|
||||
import type { Context } from 'hono';
|
||||
import { join } from 'node:path';
|
||||
import { existsSync } from 'node:fs';
|
||||
import { readdir, cp, rm, mkdir } from 'node:fs/promises';
|
||||
import { createRouter } from '@@/create-router';
|
||||
import type { HonoVariables } from '@@/create-router';
|
||||
import { getUserAppsDir, getUserProjectsDir } from '@@/data-path';
|
||||
import * as errors from '@@/custom-errors';
|
||||
import { verify } from '@@/jwt';
|
||||
import { isTokenBlacklisted } from 'officerdb';
|
||||
import { rewriteHtml, rewriteAssetPaths } from '../_shared/html-rewrite';
|
||||
|
||||
export type AppManifest = {
|
||||
slug: string;
|
||||
name: string;
|
||||
version: string;
|
||||
icon: string;
|
||||
description: string;
|
||||
sourceProject: string;
|
||||
commitHash: string;
|
||||
publishedAt: string;
|
||||
buildDir: string;
|
||||
};
|
||||
|
||||
// ── Protected routes (inside protectedRouter) ──
|
||||
|
||||
export const appsRouter = createRouter();
|
||||
|
||||
appsRouter.get('/', async (ctx) => {
|
||||
const user = ctx.get('user');
|
||||
const appsDir = getUserAppsDir(user.email);
|
||||
|
||||
if (!existsSync(appsDir)) return ctx.json({ apps: [] });
|
||||
|
||||
const entries = await readdir(appsDir, { withFileTypes: true });
|
||||
const apps: AppManifest[] = [];
|
||||
|
||||
for (const entry of entries) {
|
||||
if (!entry.isDirectory()) continue;
|
||||
const manifestPath = join(appsDir, entry.name, 'manifest.json');
|
||||
if (!existsSync(manifestPath)) continue;
|
||||
try {
|
||||
const manifest = JSON.parse(await Bun.file(manifestPath).text()) as AppManifest;
|
||||
apps.push(manifest);
|
||||
} catch {
|
||||
// skip malformed manifests
|
||||
}
|
||||
}
|
||||
|
||||
return ctx.json({ apps });
|
||||
});
|
||||
|
||||
appsRouter.post('/publish', async (ctx) => {
|
||||
const user = ctx.get('user');
|
||||
const body = ctx.get('body') as { projectSlug: string; name?: string; icon?: string; description?: string };
|
||||
const { projectSlug, name, icon, description } = body;
|
||||
|
||||
if (!projectSlug) throw errors.BAD_REQUEST('Missing projectSlug');
|
||||
|
||||
const projectDir = join(getUserProjectsDir(user.email), projectSlug);
|
||||
if (!existsSync(projectDir)) throw errors.BAD_REQUEST(`Project not found: ${projectSlug}`);
|
||||
|
||||
const pkgPath = join(projectDir, 'package.json');
|
||||
if (!existsSync(pkgPath)) throw errors.BAD_REQUEST('No package.json found in project');
|
||||
|
||||
let pkgJson: { name?: string; version?: string; scripts?: Record<string, string> };
|
||||
try {
|
||||
pkgJson = JSON.parse(await Bun.file(pkgPath).text());
|
||||
} catch {
|
||||
throw errors.BAD_REQUEST('Failed to read package.json');
|
||||
}
|
||||
|
||||
if (!pkgJson.scripts?.build) throw errors.BAD_REQUEST('No "build" script in package.json');
|
||||
|
||||
const version = pkgJson.version ?? '0.1.0';
|
||||
const appSlug = projectSlug;
|
||||
const appName = name ?? pkgJson.name ?? projectSlug;
|
||||
|
||||
// Read .officerdev/meta.json for fallback description
|
||||
let metaDescription = '';
|
||||
const metaPath = join(projectDir, '.officerdev', 'meta.json');
|
||||
if (existsSync(metaPath)) {
|
||||
try {
|
||||
const meta = JSON.parse(await Bun.file(metaPath).text());
|
||||
metaDescription = meta.description ?? '';
|
||||
} catch {
|
||||
// ignore
|
||||
}
|
||||
}
|
||||
|
||||
// Get git commit hash
|
||||
let commitHash = 'unknown';
|
||||
try {
|
||||
const proc = Bun.spawn(['git', 'rev-parse', '--short', 'HEAD'], { cwd: projectDir, stdout: 'pipe', stderr: 'pipe' });
|
||||
await proc.exited;
|
||||
if (proc.exitCode === 0) {
|
||||
commitHash = (await new Response(proc.stdout).text()).trim();
|
||||
}
|
||||
} catch {
|
||||
// no git — that's fine
|
||||
}
|
||||
|
||||
// Run build
|
||||
const buildProc = Bun.spawn(['bun', 'run', 'build'], {
|
||||
cwd: projectDir,
|
||||
stdout: 'pipe',
|
||||
stderr: 'pipe',
|
||||
env: { ...process.env, NODE_ENV: 'production' },
|
||||
});
|
||||
|
||||
const buildTimeout = setTimeout(() => buildProc.kill(), 60_000);
|
||||
const exitCode = await buildProc.exited;
|
||||
clearTimeout(buildTimeout);
|
||||
|
||||
if (exitCode !== 0) {
|
||||
const stderr = await new Response(buildProc.stderr).text();
|
||||
throw errors.BAD_REQUEST(`Build failed (exit ${exitCode}):\n${stderr.slice(-500)}`);
|
||||
}
|
||||
|
||||
// Verify dist output
|
||||
const distDir = join(projectDir, 'dist');
|
||||
if (!existsSync(distDir)) throw errors.BAD_REQUEST('Build did not produce a dist/ directory');
|
||||
|
||||
const distFiles = await readdir(distDir);
|
||||
const hasHtml = distFiles.some((f) => f.endsWith('.html'));
|
||||
if (!hasHtml) throw errors.BAD_REQUEST('Build output has no HTML files');
|
||||
|
||||
// Copy to versioned directory
|
||||
const appsDir = getUserAppsDir(user.email);
|
||||
const appDir = join(appsDir, appSlug);
|
||||
const versionDir = join(appDir, 'v', version);
|
||||
|
||||
await mkdir(versionDir, { recursive: true });
|
||||
await cp(distDir, versionDir, { recursive: true });
|
||||
|
||||
// Write manifest
|
||||
const manifest: AppManifest = {
|
||||
slug: appSlug,
|
||||
name: appName,
|
||||
version,
|
||||
icon: icon ?? 'Box',
|
||||
description: description ?? metaDescription,
|
||||
sourceProject: projectSlug,
|
||||
commitHash,
|
||||
publishedAt: new Date().toISOString(),
|
||||
buildDir: `v/${version}`,
|
||||
};
|
||||
|
||||
await Bun.write(join(appDir, 'manifest.json'), JSON.stringify(manifest, null, 2));
|
||||
|
||||
return ctx.json(manifest);
|
||||
});
|
||||
|
||||
appsRouter.delete('/:slug', async (ctx) => {
|
||||
const user = ctx.get('user');
|
||||
const slug = ctx.req.param('slug');
|
||||
if (!slug) throw errors.BAD_REQUEST('Missing slug');
|
||||
|
||||
const appDir = join(getUserAppsDir(user.email), slug);
|
||||
if (!existsSync(appDir)) throw errors.NOT_FOUND('App not found');
|
||||
|
||||
await rm(appDir, { recursive: true, force: true });
|
||||
return ctx.json({ ok: true });
|
||||
});
|
||||
|
||||
// ── Static serving (outside protectedRouter) ──
|
||||
|
||||
export const appServeRouter = createRouter();
|
||||
|
||||
const MIME_TYPES: Record<string, string> = {
|
||||
'.html': 'text/html; charset=utf-8',
|
||||
'.js': 'application/javascript; charset=utf-8',
|
||||
'.mjs': 'application/javascript; charset=utf-8',
|
||||
'.css': 'text/css; charset=utf-8',
|
||||
'.json': 'application/json; charset=utf-8',
|
||||
'.svg': 'image/svg+xml',
|
||||
'.png': 'image/png',
|
||||
'.jpg': 'image/jpeg',
|
||||
'.jpeg': 'image/jpeg',
|
||||
'.gif': 'image/gif',
|
||||
'.ico': 'image/x-icon',
|
||||
'.webp': 'image/webp',
|
||||
'.woff': 'font/woff',
|
||||
'.woff2': 'font/woff2',
|
||||
'.ttf': 'font/ttf',
|
||||
'.eot': 'application/vnd.ms-fontobject',
|
||||
'.map': 'application/json',
|
||||
};
|
||||
|
||||
const getMimeType = (filePath: string): string => {
|
||||
const ext = filePath.slice(filePath.lastIndexOf('.'));
|
||||
return MIME_TYPES[ext] ?? 'application/octet-stream';
|
||||
};
|
||||
|
||||
type ValidateResult = { email: string } | null;
|
||||
|
||||
async function validateToken(req: Request): Promise<ValidateResult> {
|
||||
const authHeader = req.headers.get('authorization');
|
||||
const token = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : new URL(req.url).searchParams.get('token');
|
||||
if (!token) return null;
|
||||
try {
|
||||
const payload = await verify(token);
|
||||
if (!payload?.email) return null;
|
||||
if (payload.jti && (await isTokenBlacklisted(payload.jti))) return null;
|
||||
return { email: payload.email };
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
appServeRouter.all('/:slug/*', async (ctx) => {
|
||||
const slug = ctx.req.param('slug');
|
||||
if (!slug) return ctx.text('Not found', 404);
|
||||
|
||||
// Validate auth — HTML requests require token, assets check referer
|
||||
const pathname = new URL(ctx.req.url).pathname;
|
||||
const isHtml =
|
||||
ctx.req.header('accept')?.includes('text/html') ||
|
||||
pathname.endsWith('.html') ||
|
||||
!pathname.slice(pathname.lastIndexOf('/') + 1).includes('.');
|
||||
|
||||
const validated = await validateToken(ctx.req.raw);
|
||||
|
||||
if (!validated) {
|
||||
// For non-HTML assets, try referer-based resolution
|
||||
if (!isHtml) {
|
||||
const referer = ctx.req.header('referer');
|
||||
if (referer) {
|
||||
const match = referer.match(/\/api\/app-serve\/([^/?]+)/);
|
||||
if (match) {
|
||||
// Extract token from referer URL if present
|
||||
try {
|
||||
const refUrl = new URL(referer);
|
||||
const refToken = refUrl.searchParams.get('token');
|
||||
if (refToken) {
|
||||
const payload = await verify(refToken);
|
||||
if (payload?.email) {
|
||||
if (!payload.jti || !(await isTokenBlacklisted(payload.jti))) {
|
||||
return serveFile(ctx, payload.email, slug);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
// fall through
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return ctx.text('Unauthorized', 401);
|
||||
}
|
||||
|
||||
return serveFile(ctx, validated.email, slug);
|
||||
});
|
||||
|
||||
async function serveFile(ctx: Context<{ Variables: HonoVariables }>, email: string, slug: string) {
|
||||
const appDir = join(getUserAppsDir(email), slug);
|
||||
const manifestPath = join(appDir, 'manifest.json');
|
||||
|
||||
if (!existsSync(manifestPath)) return ctx.text('App not found', 404);
|
||||
|
||||
let manifest: AppManifest;
|
||||
try {
|
||||
manifest = JSON.parse(await Bun.file(manifestPath).text());
|
||||
} catch {
|
||||
return ctx.text('Invalid manifest', 500);
|
||||
}
|
||||
|
||||
const buildDir = join(appDir, manifest.buildDir);
|
||||
const prefix = `/api/app-serve/${slug}`;
|
||||
|
||||
const url = new URL(ctx.req.url);
|
||||
let filePath = url.pathname.replace(prefix, '') || '/';
|
||||
if (filePath === '/') filePath = '/index.html';
|
||||
|
||||
const fullPath = join(buildDir, filePath);
|
||||
|
||||
// Security: prevent directory traversal
|
||||
if (!fullPath.startsWith(buildDir)) return ctx.text('Forbidden', 403);
|
||||
|
||||
// If file doesn't exist, serve index.html for SPA routing
|
||||
const targetPath = existsSync(fullPath) ? fullPath : join(buildDir, 'index.html');
|
||||
if (!existsSync(targetPath)) return ctx.text('Not found', 404);
|
||||
|
||||
const file = Bun.file(targetPath);
|
||||
const mimeType = getMimeType(targetPath);
|
||||
const needsRewrite =
|
||||
mimeType.includes('text/html') || mimeType.includes('javascript') || mimeType.includes('text/css');
|
||||
|
||||
if (needsRewrite) {
|
||||
const content = await file.text();
|
||||
const rewritten = mimeType.includes('text/html')
|
||||
? rewriteHtml(content, prefix)
|
||||
: rewriteAssetPaths(content, prefix);
|
||||
return new Response(rewritten, { headers: { 'content-type': mimeType } });
|
||||
}
|
||||
|
||||
return new Response(file, { headers: { 'content-type': mimeType } });
|
||||
}
|
||||
@@ -1,314 +0,0 @@
|
||||
import type { Subprocess } from 'bun';
|
||||
import { join } from 'node:path';
|
||||
import { existsSync } from 'node:fs';
|
||||
import { createServer } from 'node:net';
|
||||
import { createRouter } from '@@/create-router';
|
||||
import { getUserProjectsDir } from '@@/data-path';
|
||||
import { CustomError } from '@@/custom-errors';
|
||||
import * as errors from '@@/custom-errors';
|
||||
import { verify } from '@@/jwt';
|
||||
import { isTokenBlacklisted } from 'officerdb';
|
||||
import { rewriteHtml, rewriteAssetPaths } from '../_shared/html-rewrite';
|
||||
|
||||
export const devServerRouter = createRouter();
|
||||
export const devServerProxyRouter = createRouter();
|
||||
|
||||
export type ServerEntry = { proc: Subprocess; port: number; slug: string; proxyId: string; logs: string[]; idleTimer: Timer | null };
|
||||
|
||||
const IDLE_TIMEOUT_MS = 5 * 60 * 1000;
|
||||
|
||||
const servers = new Map<string, ServerEntry>();
|
||||
const proxyIdIndex = new Map<string, ServerEntry>();
|
||||
const pendingStarts = new Set<string>();
|
||||
|
||||
const serverKey = (email: string, slug: string) => `${email}:${slug}`;
|
||||
|
||||
export const findEntryByProxyId = (proxyId: string): ServerEntry | undefined => proxyIdIndex.get(proxyId);
|
||||
|
||||
export const touchEntry = (entry: ServerEntry) => {
|
||||
if (entry.idleTimer) clearTimeout(entry.idleTimer);
|
||||
entry.idleTimer = setTimeout(() => {
|
||||
console.log(`[dev-server] ${entry.slug} idle for 5m, stopping`);
|
||||
entry.proc.kill();
|
||||
}, IDLE_TIMEOUT_MS);
|
||||
};
|
||||
|
||||
const killEntry = (entry: ServerEntry, key: string) => {
|
||||
if (entry.idleTimer) clearTimeout(entry.idleTimer);
|
||||
entry.proc.kill();
|
||||
proxyIdIndex.delete(entry.proxyId);
|
||||
servers.delete(key);
|
||||
};
|
||||
|
||||
const findFreePort = (): Promise<number> =>
|
||||
new Promise((resolve, reject) => {
|
||||
const server = createServer();
|
||||
server.listen(0, '127.0.0.1', () => {
|
||||
const addr = server.address();
|
||||
const port = typeof addr === 'object' && addr ? addr.port : 0;
|
||||
server.close(() => resolve(port));
|
||||
});
|
||||
server.on('error', reject);
|
||||
});
|
||||
|
||||
const collectLogs = (entry: ServerEntry, stream: ReadableStream<Uint8Array> | null, prefix: string) => {
|
||||
if (!stream) return;
|
||||
const reader = stream.getReader();
|
||||
const decoder = new TextDecoder();
|
||||
const pump = async () => {
|
||||
while (true) {
|
||||
const { done, value } = await reader.read();
|
||||
if (done) break;
|
||||
const text = decoder.decode(value, { stream: true });
|
||||
for (const line of text.split('\n').filter(Boolean)) {
|
||||
entry.logs.push(`[${prefix}] ${line}`);
|
||||
if (entry.logs.length > 200) entry.logs.shift();
|
||||
}
|
||||
}
|
||||
};
|
||||
pump().catch(() => {});
|
||||
};
|
||||
|
||||
const waitForPort = async (port: number, timeoutMs = 8000) => {
|
||||
const start = Date.now();
|
||||
while (Date.now() - start < timeoutMs) {
|
||||
try {
|
||||
const res = await fetch(`http://localhost:${port}`, { signal: AbortSignal.timeout(500) });
|
||||
await res.arrayBuffer();
|
||||
return true;
|
||||
} catch {
|
||||
await Bun.sleep(300);
|
||||
}
|
||||
}
|
||||
return false;
|
||||
};
|
||||
|
||||
devServerRouter.post('/start', async (ctx) => {
|
||||
const user = ctx.get('user');
|
||||
const { slug } = ctx.get('body') as { slug: string };
|
||||
|
||||
if (!slug) throw errors.BAD_REQUEST('Missing slug');
|
||||
|
||||
const key = serverKey(user.email, slug);
|
||||
|
||||
const existing = servers.get(key);
|
||||
if (existing) {
|
||||
touchEntry(existing);
|
||||
return ctx.json({ url: `/api/dev-server-proxy/${existing.proxyId}/`, port: existing.port });
|
||||
}
|
||||
|
||||
if (pendingStarts.has(key)) throw errors.BAD_REQUEST('Server is already starting');
|
||||
pendingStarts.add(key);
|
||||
|
||||
try {
|
||||
const projectDir = join(getUserProjectsDir(user.email), slug);
|
||||
if (!existsSync(projectDir)) throw errors.BAD_REQUEST(`Project directory not found: ${slug}`);
|
||||
|
||||
const pkgPath = join(projectDir, 'package.json');
|
||||
if (!existsSync(pkgPath)) throw errors.BAD_REQUEST('No package.json found in project');
|
||||
try {
|
||||
const pkg = JSON.parse(await Bun.file(pkgPath).text());
|
||||
if (!pkg.scripts?.dev) throw errors.BAD_REQUEST('No "dev" script in package.json');
|
||||
} catch (err) {
|
||||
if (err instanceof CustomError) throw err;
|
||||
throw errors.BAD_REQUEST('Failed to read package.json');
|
||||
}
|
||||
|
||||
const port = await findFreePort();
|
||||
const proxyId = crypto.randomUUID();
|
||||
|
||||
const proc = Bun.spawn(['bun', 'dev'], {
|
||||
cwd: projectDir,
|
||||
env: { ...process.env, PORT: String(port) },
|
||||
stdout: 'pipe',
|
||||
stderr: 'pipe',
|
||||
});
|
||||
console.log(`[dev-server] started ${slug} on port ${port} (pid ${proc.pid}) proxyId=${proxyId}`);
|
||||
|
||||
const entry: ServerEntry = { proc, port, slug, proxyId, logs: [], idleTimer: null };
|
||||
servers.set(key, entry);
|
||||
proxyIdIndex.set(proxyId, entry);
|
||||
touchEntry(entry);
|
||||
|
||||
collectLogs(entry, proc.stdout, 'stdout');
|
||||
collectLogs(entry, proc.stderr, 'stderr');
|
||||
|
||||
proc.exited.then((code) => {
|
||||
console.log(`[dev-server] ${slug} exited with code ${code}`);
|
||||
entry.logs.push(`[system] Process exited with code ${code}`);
|
||||
if (entry.idleTimer) clearTimeout(entry.idleTimer);
|
||||
proxyIdIndex.delete(entry.proxyId);
|
||||
servers.delete(key);
|
||||
});
|
||||
|
||||
const ready = await waitForPort(port);
|
||||
if (!ready) {
|
||||
const exitCode = proc.exitCode;
|
||||
if (exitCode !== null) {
|
||||
if (entry.idleTimer) clearTimeout(entry.idleTimer);
|
||||
proxyIdIndex.delete(entry.proxyId);
|
||||
servers.delete(key);
|
||||
throw errors.BAD_REQUEST(`Dev server exited with code ${exitCode}. Logs:\n${entry.logs.slice(-20).join('\n')}`);
|
||||
}
|
||||
}
|
||||
|
||||
return ctx.json({ url: `/api/dev-server-proxy/${proxyId}/`, port });
|
||||
} finally {
|
||||
pendingStarts.delete(key);
|
||||
}
|
||||
});
|
||||
|
||||
devServerRouter.post('/stop', async (ctx) => {
|
||||
const user = ctx.get('user');
|
||||
const { slug } = ctx.get('body') as { slug: string };
|
||||
|
||||
if (!slug) throw errors.BAD_REQUEST('Missing slug');
|
||||
|
||||
const key = serverKey(user.email, slug);
|
||||
const entry = servers.get(key);
|
||||
|
||||
if (entry) killEntry(entry, key);
|
||||
|
||||
return ctx.json({ ok: true });
|
||||
});
|
||||
|
||||
devServerRouter.get('/status', async (ctx) => {
|
||||
const user = ctx.get('user');
|
||||
const slug = ctx.req.query('slug');
|
||||
|
||||
if (!slug) throw errors.BAD_REQUEST('Missing slug');
|
||||
|
||||
const key = serverKey(user.email, slug);
|
||||
const entry = servers.get(key);
|
||||
|
||||
if (entry) {
|
||||
return ctx.json({ running: true, url: `/api/dev-server-proxy/${entry.proxyId}/`, port: entry.port });
|
||||
}
|
||||
|
||||
return ctx.json({ running: false });
|
||||
});
|
||||
|
||||
devServerRouter.get('/logs', async (ctx) => {
|
||||
const user = ctx.get('user');
|
||||
const slug = ctx.req.query('slug');
|
||||
|
||||
if (!slug) throw errors.BAD_REQUEST('Missing slug');
|
||||
|
||||
const key = serverKey(user.email, slug);
|
||||
const entry = servers.get(key);
|
||||
|
||||
if (!entry) return ctx.json({ logs: [] });
|
||||
|
||||
return ctx.json({ logs: entry.logs.slice(-100) });
|
||||
});
|
||||
|
||||
// Proxy router — mounted outside protected router (no auth needed for sub-resources).
|
||||
// Security: only proxies to ports that were started via authenticated /start calls.
|
||||
|
||||
type ProxyParams = { entry: ServerEntry; proxyId: string; proxyPath: string; search: string; method: string; rawReq: Request };
|
||||
|
||||
async function proxyRequest({ entry, proxyId, proxyPath, search, method, rawReq }: ProxyParams): Promise<Response> {
|
||||
const prefix = `/api/dev-server-proxy/${proxyId}`;
|
||||
const targetUrl = `http://localhost:${entry.port}${proxyPath}${search}`;
|
||||
|
||||
touchEntry(entry);
|
||||
|
||||
try {
|
||||
const headers = new Headers(rawReq.headers);
|
||||
headers.delete('host');
|
||||
headers.delete('authorization');
|
||||
|
||||
const res = await fetch(targetUrl, {
|
||||
method,
|
||||
headers,
|
||||
body: method !== 'GET' && method !== 'HEAD' ? rawReq.body : undefined,
|
||||
redirect: 'manual',
|
||||
});
|
||||
|
||||
const contentType = res.headers.get('content-type') ?? '';
|
||||
const needsRewrite =
|
||||
contentType.includes('text/html') ||
|
||||
contentType.includes('javascript') ||
|
||||
contentType.includes('text/css');
|
||||
|
||||
if (needsRewrite) {
|
||||
const text = await res.text();
|
||||
const rewritten = contentType.includes('text/html')
|
||||
? rewriteHtml(text, prefix)
|
||||
: rewriteAssetPaths(text, prefix);
|
||||
const newHeaders = new Headers(res.headers);
|
||||
newHeaders.delete('content-length');
|
||||
newHeaders.delete('content-encoding');
|
||||
return new Response(rewritten, { status: res.status, headers: newHeaders });
|
||||
}
|
||||
|
||||
return new Response(res.body, { status: res.status, headers: res.headers });
|
||||
} catch {
|
||||
return new Response('Dev server not reachable', { status: 502 });
|
||||
}
|
||||
}
|
||||
|
||||
const isLikelyHtmlRequest = (req: Request): boolean => {
|
||||
const accept = req.headers.get('accept') ?? '';
|
||||
return accept.includes('text/html');
|
||||
};
|
||||
|
||||
const stripTokenParam = (search: string): string => {
|
||||
if (!search) return search;
|
||||
const params = new URLSearchParams(search);
|
||||
params.delete('token');
|
||||
const result = params.toString();
|
||||
return result ? `?${result}` : '';
|
||||
};
|
||||
|
||||
async function validateJwt(req: Request): Promise<boolean> {
|
||||
const authHeader = req.headers.get('authorization');
|
||||
const token = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : new URL(req.url).searchParams.get('token');
|
||||
if (!token) return false;
|
||||
try {
|
||||
const payload = await verify(token);
|
||||
if (!payload) return false;
|
||||
if (payload.jti && await isTokenBlacklisted(payload.jti)) return false;
|
||||
return true;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// Proxy handler: tries proxyId from URL first, falls back to Referer for misrouted
|
||||
// chunk requests caused by relative imports resolving at wrong path depth.
|
||||
devServerProxyRouter.all('/:proxyId/*', async (ctx) => {
|
||||
const proxyId = ctx.req.param('proxyId');
|
||||
if (!proxyId) return ctx.text('Not found', 404);
|
||||
|
||||
const originalUrl = new URL(ctx.req.url);
|
||||
const entry = proxyIdIndex.get(proxyId);
|
||||
if (entry) {
|
||||
if (isLikelyHtmlRequest(ctx.req.raw)) {
|
||||
const valid = await validateJwt(ctx.req.raw);
|
||||
if (!valid) return ctx.text('Unauthorized', 401);
|
||||
}
|
||||
const prefix = `/api/dev-server-proxy/${proxyId}`;
|
||||
const proxyPath = originalUrl.pathname.replace(prefix, '') || '/';
|
||||
const search = stripTokenParam(originalUrl.search);
|
||||
return proxyRequest({ entry, proxyId, proxyPath, search, method: ctx.req.method, rawReq: ctx.req.raw });
|
||||
}
|
||||
|
||||
// proxyId didn't match — check Referer for the real proxyId
|
||||
const referer = ctx.req.header('referer');
|
||||
if (referer) {
|
||||
const match = referer.match(/\/api\/dev-server-proxy\/([^/]+)/);
|
||||
if (match) {
|
||||
const realProxyId = match[1]!;
|
||||
const realEntry = proxyIdIndex.get(realProxyId);
|
||||
if (realEntry) {
|
||||
const proxyPath = originalUrl.pathname.replace('/api/dev-server-proxy', '') || '/';
|
||||
const search = stripTokenParam(originalUrl.search);
|
||||
return proxyRequest({ entry: realEntry, proxyId: realProxyId, proxyPath, search, method: ctx.req.method, rawReq: ctx.req.raw });
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return ctx.text('No dev server running', 404);
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user