Prefill undone.
";
- });
-
- function markPrefilled(ids, provenance) {
- for (const id of ids) {
- const el = document.querySelector(`[name="${CSS.escape(id)}"]`);
- if (!el) continue;
- el.classList.add("prefilled");
- const prov = provenance[id];
- if (prov) el.title = `from: ${prov}`;
- }
- }
- function clearPrefilledMarks() {
- for (const el of document.querySelectorAll(".prefilled")) {
- el.classList.remove("prefilled");
- el.removeAttribute("title");
- }
- }
-}
-
-function escapeHtml(s) {
- return String(s ?? "").replace(/[&<>"']/g, (c) => ({ "&": "&", "<": "<", ">": ">", '"': """, "'": "'" }[c]));
+ undoBtn.addEventListener("click", () => { if (!snapshot) return; state.plan = snapshot; snapshot = null; undoBtn.disabled = true; renderFormFromPlan(); for (const el of document.querySelectorAll(".prefilled")) { el.classList.remove("prefilled"); el.removeAttribute("title"); } recompute(); message(resultEl, "Prefill undone."); });
+ function markPrefilled(ids, provenance) { for (const id of ids) { const el=document.querySelector(`[name="${CSS.escape(id)}"]`); if(el){el.classList.add("prefilled");if(provenance[id])el.title=`from: ${provenance[id]}`;} } }
}
diff --git a/public/landing.html b/public/landing.html
new file mode 100644
index 0000000..d5f1686
--- /dev/null
+++ b/public/landing.html
@@ -0,0 +1 @@
+Roast Planner
Build, save, and revisit your coffee roast plans.
Accounts require a password of at least 12 characters.
\ No newline at end of file
diff --git a/public/sw.js b/public/sw.js
index c21dfbe..e5b265c 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -1,7 +1,7 @@
const CACHE_NAME = "roast-planner-static-v1";
const APP_SHELL = [
"/",
- "/index.html",
+ "/landing.html",
"/app.css",
"/worksheet.css",
"/manifest.webmanifest",
@@ -40,7 +40,8 @@ self.addEventListener("fetch", (event) => {
if (request.method !== "GET" || url.origin !== self.location.origin || url.pathname.startsWith("/api/")) return;
if (request.mode === "navigate") {
- event.respondWith(fetch(request).catch(() => caches.match("/index.html")));
+ // Never serve authenticated application HTML from cache after logout.
+ event.respondWith(fetch(request).catch(() => caches.match("/landing.html")));
return;
}
diff --git a/server/app.js b/server/app.js
new file mode 100644
index 0000000..7891076
--- /dev/null
+++ b/server/app.js
@@ -0,0 +1,57 @@
+import express from "express";
+import path from "node:path";
+import crypto from "node:crypto";
+import bcrypt from "bcryptjs";
+import { fetchPageText } from "./fetch-page.js";
+import { runPrefill } from "./prefill.js";
+import { parseAlog } from "./alog.js";
+import { listAlogLibrary, readAlogFromLibrary } from "./alog-library.js";
+
+const hash = (value) => crypto.createHash("sha256").update(value).digest("hex");
+const token = () => crypto.randomBytes(32).toString("base64url");
+const ADMIN_EMAIL = "snowspeeder@gmail.com";
+const emailOf = (value) => String(value || "").trim().toLowerCase();
+const PASSWORD_OK = (value) => typeof value === "string" && value.length >= 12 && value.length <= 256;
+
+/** Creates the HTTP app separately from listening, so tests can use an isolated database. */
+export function createApp({ db, root, env = process.env } = {}) {
+ const app = express();
+ const production = env.NODE_ENV === "production";
+ const cookieSecure = env.COOKIE_SECURE ? env.COOKIE_SECURE === "true" : production;
+ const origin = env.APP_ORIGIN || (production ? "https://roast.srmr.xyz" : "");
+ const buckets = new Map();
+ const rateLimit = (name, max, windowMs) => (req, res, next) => {
+ const key = `${name}:${req.ip}`; const now = Date.now(); const b = buckets.get(key) || { count: 0, reset: now + windowMs };
+ if (now > b.reset) Object.assign(b, { count: 0, reset: now + windowMs });
+ b.count++; buckets.set(key, b); res.set("RateLimit-Limit", String(max));
+ if (b.count > max) return res.status(429).json({ ok: false, code: "rate_limited" }); next();
+ };
+ app.disable("x-powered-by");
+ app.set("trust proxy", 1);
+ app.use((req, res, next) => { res.set({ "X-Content-Type-Options":"nosniff", "X-Frame-Options":"DENY", "Referrer-Policy":"strict-origin-when-cross-origin", "Permissions-Policy":"camera=(), microphone=(), geolocation=()", "Cross-Origin-Opener-Policy":"same-origin", "Content-Security-Policy":"default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; connect-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:" }); next(); });
+ app.use(express.json({ limit: "1mb" }));
+ const cookie = (req, name) => Object.fromEntries((req.headers.cookie || "").split(";").map(x => x.trim().split("=")).filter(x => x[0]))[name];
+ const setSessionCookie = (res, value, maxAge, csrfToken = "") => { res.cookie("rp_session", value, { httpOnly:true, secure:cookieSecure, sameSite:"lax", path:"/", maxAge }); res.cookie("rp_csrf", csrfToken, { httpOnly:false, secure:cookieSecure, sameSite:"lax", path:"/", maxAge }); };
+ async function session(req) { const raw = cookie(req, "rp_session"); if (!raw) return null; const r = await db.query("SELECT s.csrf_hash,u.id,u.email,u.role FROM sessions s JOIN users u ON u.id=s.user_id WHERE s.token_hash=$1 AND s.expires_at>now()", [hash(raw)]); return r.rows[0] || null; }
+ async function requireAuth(req,res,next) { try { req.user = await session(req); if (!req.user) return res.status(401).json({ok:false,code:"unauthorized"}); next(); } catch (e) { next(e); } }
+ const csrf = (req,res,next) => { if (origin && req.get("origin") && req.get("origin") !== origin) return res.status(403).json({ok:false,code:"bad_origin"}); const value=req.get("x-csrf-token"); if (!value || value !== cookie(req, "rp_csrf") || !req.user || !crypto.timingSafeEqual(Buffer.from(hash(value)), Buffer.from(req.user.csrf_hash))) return res.status(403).json({ok:false,code:"csrf_failed"}); next(); };
+ const admin = (req,res,next) => req.user.role === "admin" ? next() : res.status(403).json({ok:false,code:"forbidden"});
+ const createSession = async (user) => { const raw=token(), csrfToken=token(); await db.query("INSERT INTO sessions(token_hash,user_id,csrf_hash,expires_at) VALUES($1,$2,$3,now()+interval '14 days')",[hash(raw),user.id,hash(csrfToken)]); return {raw,csrfToken}; };
+ app.post("/api/auth/signup", rateLimit("signup", 8, 60_000), async (req,res,next) => { try { const email=emailOf(req.body.email), password=req.body.password; if (!/^\S+@\S+\.\S+$/.test(email) || !PASSWORD_OK(password)) return res.status(400).json({ok:false,code:"invalid_credentials",error:"Use a valid email and a password of at least 12 characters."}); const setting=await db.query("SELECT value FROM app_settings WHERE key='signup_enabled'"); if (setting.rows[0]?.value !== "true") return res.status(403).json({ok:false,code:"signup_disabled"}); const password_hash=await bcrypt.hash(password, 12); const user=(await db.query("INSERT INTO users(email,password_hash) VALUES($1,$2) RETURNING id,email,role",[email,password_hash])).rows[0]; const s=await createSession(user); setSessionCookie(res,s.raw,14*864e5,s.csrfToken); res.status(201).json({ok:true,user:{email:user.email,role:user.role},csrfToken:s.csrfToken}); } catch(e) { if(e.code === "23505") return res.status(409).json({ok:false,code:"email_exists"}); next(e); } });
+ app.post("/api/auth/bootstrap", rateLimit("bootstrap", 4, 60_000), async(req,res,next)=>{ try { const bootstrap=String(req.body.setupToken||""); if (!env.BOOTSTRAP_SETUP_TOKEN || bootstrap.length !== env.BOOTSTRAP_SETUP_TOKEN.length || !crypto.timingSafeEqual(Buffer.from(bootstrap),Buffer.from(env.BOOTSTRAP_SETUP_TOKEN))) return res.status(403).json({ok:false,code:"invalid_setup_token"}); if (emailOf(req.body.email)!==ADMIN_EMAIL || !PASSWORD_OK(req.body.password)) return res.status(400).json({ok:false,code:"invalid_credentials"}); const exists=await db.query("SELECT 1 FROM users WHERE email=$1",[ADMIN_EMAIL]); if(exists.rowCount) return res.status(409).json({ok:false,code:"bootstrap_used"}); const user=(await db.query("INSERT INTO users(email,password_hash,role) VALUES($1,$2,'admin') RETURNING id,email,role",[ADMIN_EMAIL,await bcrypt.hash(req.body.password,12)])).rows[0]; const s=await createSession(user); setSessionCookie(res,s.raw,14*864e5,s.csrfToken); res.status(201).json({ok:true,user:{email:user.email,role:user.role},csrfToken:s.csrfToken}); } catch(e){next(e);} });
+ app.post("/api/auth/login", rateLimit("login", 10, 60_000), async(req,res,next)=>{ try { const user=(await db.query("SELECT id,email,role,password_hash FROM users WHERE email=$1",[emailOf(req.body.email)])).rows[0]; if(!user || !(await bcrypt.compare(String(req.body.password||""),user.password_hash))) return res.status(401).json({ok:false,code:"invalid_credentials"}); const s=await createSession(user); setSessionCookie(res,s.raw,14*864e5,s.csrfToken); res.json({ok:true,user:{email:user.email,role:user.role},csrfToken:s.csrfToken}); }catch(e){next(e);} });
+ app.get("/api/auth/me", requireAuth, (req,res)=>res.json({ok:true,user:{id:req.user.id,email:req.user.email,role:req.user.role}}));
+ app.post("/api/auth/logout", requireAuth, csrf, async(req,res,next)=>{try{await db.query("DELETE FROM sessions WHERE token_hash=$1",[hash(cookie(req,"rp_session"))]); setSessionCookie(res,"",0,"");res.json({ok:true});}catch(e){next(e)}});
+ app.get("/api/plans", requireAuth, async(req,res,next)=>{try{res.json({ok:true,plans:(await db.query("SELECT id,plan,created_at,updated_at FROM roast_plans WHERE user_id=$1 ORDER BY updated_at DESC",[req.user.id])).rows});}catch(e){next(e)}});
+ app.post("/api/plans", requireAuth, csrf, async(req,res,next)=>{try{if(!req.body.plan || typeof req.body.plan!=="object") return res.status(400).json({ok:false,code:"bad_plan"}); const p=(await db.query("INSERT INTO roast_plans(user_id,plan) VALUES($1,$2) RETURNING id,plan,created_at,updated_at",[req.user.id,req.body.plan])).rows[0];res.status(201).json({ok:true,plan:p});}catch(e){next(e)}});
+ app.put("/api/plans/:id", requireAuth, csrf, async(req,res,next)=>{try{const r=await db.query("UPDATE roast_plans SET plan=$1,updated_at=now() WHERE id=$2 AND user_id=$3 RETURNING id,plan,updated_at",[req.body.plan,req.params.id,req.user.id]); if(!r.rowCount)return res.status(404).json({ok:false,code:"not_found"});res.json({ok:true,plan:r.rows[0]});}catch(e){next(e)}});
+ app.get("/api/admin/users", requireAuth, admin, async(req,res,next)=>{try{res.json({ok:true,signupEnabled:(await db.query("SELECT value FROM app_settings WHERE key='signup_enabled'")).rows[0]?.value==="true",users:(await db.query("SELECT u.id,u.email,u.role,u.created_at,count(p.id)::int AS plan_count FROM users u LEFT JOIN roast_plans p ON p.user_id=u.id GROUP BY u.id ORDER BY u.created_at")).rows});}catch(e){next(e)}});
+ app.get("/api/admin/plans", requireAuth, admin, async(req,res,next)=>{try{res.json({ok:true,plans:(await db.query("SELECT p.id,p.plan,p.updated_at,u.email FROM roast_plans p JOIN users u ON u.id=p.user_id ORDER BY p.updated_at DESC")).rows});}catch(e){next(e)}});
+ app.put("/api/admin/signup-enabled", requireAuth, csrf, admin, async(req,res,next)=>{try{if(typeof req.body.enabled!=="boolean")return res.status(400).json({ok:false,code:"bad_request"});await db.query("UPDATE app_settings SET value=$1 WHERE key='signup_enabled'",[String(req.body.enabled)]);res.json({ok:true});}catch(e){next(e)}});
+ // Existing integrations remain authenticated but CSRF-protected for writes.
+ app.post("/api/prefill", requireAuth, csrf, async(req,res)=>{const url=typeof req.body?.url==="string"?req.body.url.trim():"";if(!url)return res.status(400).json({ok:false,code:"bad_url",error:"Missing url."});try{const result=await runPrefill(await fetchPageText(url));res.json({ok:true,...result});}catch(err){const code=err.code??"prefill_failed";res.status(code==="fetch_timeout"?504:code==="bad_url"?400:code==="no_model"?503:422).json({ok:false,code,error:err.message});}});
+ app.post("/api/alog", requireAuth, csrf, (req,res)=>{try{if(typeof req.body?.content!=="string"||!req.body.content.trim())return res.status(400).json({ok:false,code:"bad_request"});res.json({ok:true,...parseAlog(req.body.content,req.body.filename??"upload.alog")});}catch(err){res.status(422).json({ok:false,code:"unparseable_alog",error:err.message});}});
+ app.get("/api/alog/library",requireAuth,async(_q,res)=>res.json({ok:true,files:await listAlogLibrary()})); app.get("/api/alog/library/:filename",requireAuth,async(req,res)=>{try{res.json({ok:true,...await readAlogFromLibrary(req.params.filename)});}catch(e){res.status(e.code==="not_found"?404:400).json({ok:false,code:e.code,error:e.message});}});
+ app.get("/",(_q,res)=>res.sendFile(path.join(root,"public","landing.html"))); app.get("/app",requireAuth,(_q,res)=>res.sendFile(path.join(root,"public","index.html"))); app.get("/admin",requireAuth,admin,(_q,res)=>res.sendFile(path.join(root,"public","admin.html"))); app.use(express.static(path.join(root,"public"))); app.use("/shared",express.static(path.join(root,"shared")));
+ app.use((err,_req,res,_next)=>{console.error(err);res.status(500).json({ok:false,code:"internal_error"});}); return app;
+}
diff --git a/server/db.js b/server/db.js
new file mode 100644
index 0000000..4e3613d
--- /dev/null
+++ b/server/db.js
@@ -0,0 +1,24 @@
+import pg from "pg";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export function createDb(connectionString = process.env.DATABASE_URL) {
+ if (!connectionString) throw new Error("DATABASE_URL is required");
+ const pool = new pg.Pool({ connectionString, max: 10, ssl: process.env.DATABASE_SSL === "true" ? { rejectUnauthorized: true } : undefined });
+ return { query: (...args) => pool.query(...args), close: () => pool.end() };
+}
+
+/** Apply each versioned SQL file once; failed migrations are not recorded. */
+export async function migrate(db) {
+ await db.query("CREATE TABLE IF NOT EXISTS schema_migrations (filename text PRIMARY KEY, applied_at timestamptz NOT NULL DEFAULT now())");
+ const directory = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "db", "migrations");
+ const files = (await fs.readdir(directory)).filter((file) => file.endsWith(".sql")).sort();
+ for (const filename of files) {
+ if ((await db.query("SELECT 1 FROM schema_migrations WHERE filename=$1", [filename])).rowCount) continue;
+ const sql = await fs.readFile(path.join(directory, filename), "utf8");
+ await db.query("BEGIN");
+ try { await db.query(sql); await db.query("INSERT INTO schema_migrations(filename) VALUES($1)", [filename]); await db.query("COMMIT"); }
+ catch (error) { await db.query("ROLLBACK"); throw error; }
+ }
+}
diff --git a/server/index.js b/server/index.js
index 0de796f..f88258a 100644
--- a/server/index.js
+++ b/server/index.js
@@ -1,77 +1,10 @@
-import express from "express";
import path from "node:path";
import { fileURLToPath } from "node:url";
-import { fetchPageText } from "./fetch-page.js";
-import { runPrefill } from "./prefill.js";
-import { parseAlog } from "./alog.js";
-import { listAlogLibrary, readAlogFromLibrary } from "./alog-library.js";
+import { createDb, migrate } from "./db.js";
+import { createApp } from "./app.js";
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ROOT = path.join(__dirname, "..");
-const PORT = Number(process.env.PORT) || 8090;
-
-const app = express();
-app.use(express.json({ limit: "2mb" }));
-
-app.use(express.static(path.join(ROOT, "public")));
-app.use("/shared", express.static(path.join(ROOT, "shared")));
-
-app.post("/api/prefill", async (req, res) => {
- const url = typeof req.body?.url === "string" ? req.body.url.trim() : "";
- if (!url) return res.status(400).json({ ok: false, code: "bad_url", error: "Missing url." });
-
- let page;
- try {
- page = await fetchPageText(url);
- } catch (err) {
- const code = err.code ?? "fetch_failed";
- const status = code === "fetch_timeout" ? 504 : code === "bad_url" ? 400 : 502;
- return res.status(status).json({ ok: false, code, error: err.message });
- }
-
- try {
- const result = await runPrefill(page);
- res.json({ ok: true, ...result });
- } catch (err) {
- console.error("prefill failed:", err);
- const code = err.code ?? "prefill_failed";
- const status = code === "no_model" ? 503 : code === "unparseable_model_output" ? 422 : 500;
- res.status(status).json({ ok: false, code, error: err.message });
- }
-});
-
-app.post("/api/alog", (req, res) => {
- const content = req.body?.content;
- if (typeof content !== "string" || content.trim() === "") {
- return res.status(400).json({ ok: false, code: "bad_request", error: "Missing .alog file content." });
- }
- try {
- const result = parseAlog(content, req.body?.filename ?? "upload.alog");
- res.json({ ok: true, ...result });
- } catch (err) {
- console.error("alog parse failed:", err);
- res.status(422).json({ ok: false, code: "unparseable_alog", error: err.message });
- }
-});
-
-app.get("/api/alog/library", async (_req, res) => {
- try {
- res.json({ ok: true, files: await listAlogLibrary() });
- } catch (err) {
- res.status(500).json({ ok: false, code: "library_failed", error: err.message });
- }
-});
-
-app.get("/api/alog/library/:filename", async (req, res) => {
- try {
- const result = await readAlogFromLibrary(req.params.filename);
- res.json({ ok: true, ...result });
- } catch (err) {
- const status = err.code === "not_found" ? 404 : err.code === "bad_filename" ? 400 : 422;
- res.status(status).json({ ok: false, code: err.code ?? "library_read_failed", error: err.message });
- }
-});
-
-app.listen(PORT, () => {
- console.log(`Roast planner webapp listening on http://localhost:${PORT}`);
-});
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
+const port = Number(process.env.PORT) || 8090;
+const db = createDb();
+await migrate(db);
+createApp({ db, root }).listen(port, () => console.log(`Roast planner listening on ${port}`));
diff --git a/test/auth.test.js b/test/auth.test.js
new file mode 100644
index 0000000..b82b10f
--- /dev/null
+++ b/test/auth.test.js
@@ -0,0 +1,15 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import request from "supertest";
+import { newDb } from "pg-mem";
+import { createApp } from "../server/app.js";
+
+async function setup() { const mem=newDb(); mem.public.registerFunction({name:"gen_random_uuid",returns:"uuid",implementation:()=>crypto.randomUUID(), impure:true}); const pg=mem.adapters.createPg(); const db=new pg.Pool(); await db.query(`CREATE TABLE users(id uuid PRIMARY KEY DEFAULT gen_random_uuid(),email text UNIQUE NOT NULL,password_hash text NOT NULL,role text NOT NULL DEFAULT 'user',created_at timestamptz DEFAULT now()); CREATE TABLE sessions(token_hash text PRIMARY KEY,user_id uuid NOT NULL REFERENCES users(id),csrf_hash text NOT NULL,expires_at timestamptz NOT NULL,created_at timestamptz DEFAULT now()); CREATE TABLE roast_plans(id uuid PRIMARY KEY DEFAULT gen_random_uuid(),user_id uuid NOT NULL REFERENCES users(id),plan jsonb NOT NULL,created_at timestamptz DEFAULT now(),updated_at timestamptz DEFAULT now()); CREATE TABLE app_settings(key text PRIMARY KEY,value text NOT NULL); INSERT INTO app_settings VALUES('signup_enabled','true')`); return request.agent(createApp({db,root:path.resolve(path.dirname(fileURLToPath(import.meta.url)),".."),env:{NODE_ENV:"test",BOOTSTRAP_SETUP_TOKEN:"a-secure-bootstrap-token"}})); }
+async function signup(agent,email) { const r=await agent.post('/api/auth/signup').send({email,password:'this is a long password'}); return {r,csrf:r.body.csrfToken}; }
+test('headers, auth, csrf, ownership, admin and signup toggle',async()=>{const a=await setup(), b=await setup(); const root=await a.get('/'); assert.equal(root.status,200);assert.match(root.headers['content-security-policy'],/default-src 'self'/); assert.equal((await a.get('/api/plans')).status,401); assert.match((await a.get('/sw.js')).text, /Never serve authenticated/); assert.equal((await a.get('/app')).status,401);
+ const one=await signup(a,'one@example.com'); assert.equal(one.r.status,201); const plan=await a.post('/api/plans').set('x-csrf-token',one.csrf).send({plan:{fields:{'0.1':'Private'}}});assert.equal(plan.status,201); assert.equal((await a.put(`/api/plans/${plan.body.plan.id}`).send({plan:{}})).status,403);
+ const other=await signup(b,'two@example.com'); assert.equal((await b.put(`/api/plans/${plan.body.plan.id}`).set('x-csrf-token',other.csrf).send({plan:{}})).status,404);
+ const admin=await a.post('/api/auth/bootstrap').send({email:'snowspeeder@gmail.com',password:'this is an admin password',setupToken:'a-secure-bootstrap-token'}); assert.equal(admin.status,201); const c=admin.body.csrfToken; assert.equal((await a.put('/api/admin/signup-enabled').set('x-csrf-token',c).send({enabled:false})).status,200); assert.equal((await a.post('/api/auth/signup').send({email:'blocked@example.com',password:'this is a long password'})).status,403); assert.equal((await a.get('/api/admin/users')).status,200);});
+test('bootstrap rejects invalid token and cannot be reused',async()=>{const a=await setup();assert.equal((await a.post('/api/auth/bootstrap').send({email:'snowspeeder@gmail.com',password:'this is an admin password',setupToken:'wrong'})).status,403);const r=await a.post('/api/auth/bootstrap').send({email:'snowspeeder@gmail.com',password:'this is an admin password',setupToken:'a-secure-bootstrap-token'});assert.equal(r.status,201);assert.equal((await a.post('/api/auth/bootstrap').send({email:'snowspeeder@gmail.com',password:'this is an admin password',setupToken:'a-secure-bootstrap-token'})).status,409);});