Claude Opus 4.8
d4ebcfcfbe
All checks were successful
CD / Build and push images (push) Successful in 2m45s
CI / Lint, typecheck, test (push) Successful in 1m56s
CI / Auth e2e pack (push) Successful in 2m1s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m9s
CD / Promote to Int (push) Successful in 12s
The api mints a short-lived (60 s) HS256 JWT per page open after an interim
permission check; the collab server authenticates every connection with it
(ADR 0003/0007 — the only JWTs in the system).
- packages/shared: browser-safe token schema/types in `collab-token`, and the
Node `crypto` sign/verify in `token-crypto` behind its own subpath export
(`@dorfteich/shared/token-crypto`) so the web bundle never pulls in
`node:crypto`. Only HS256 is produced/accepted; the signature is checked in
constant time before any untrusted field is read.
- api: `GET /pages/:id/collab-token` (auth-required) returns
{token, mode, expiresInSeconds}; `mode` is rw/ro via the interim access
service; issuance is logged at debug level without the token value.
- collab: `onAuthenticate` verifies the token, checks the pageId matches the
document name, stores {userId, mode} context, and enforces `ro` via
Hocuspocus' read-only connection flag. Hocuspocus' own signal handling is
disabled so index.ts remains the single shutdown owner.
- Shared COLLAB_TOKEN_SECRET env for api + collab (compose, dev overlay,
.env.example, stage docs); a dev default keeps native dev/test/CI running.
Tests: shared token round-trip/rejection; api endpoint e2e (auth required,
claims, 404 for non-members/unknown ids); collab integration via
HocuspocusProvider (valid token connects; expired/tampered/mismatched-page/
wrong-secret rejected; read-only writes dropped, verified with two clients).
Closes #34
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
54 lines
1.4 KiB
JSON
54 lines
1.4 KiB
JSON
{
|
|
"name": "@dorfteich/shared",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"description": "Types, schemas, and logic shared between web, api, and collab",
|
|
"license": "MIT",
|
|
"main": "./dist/index.js",
|
|
"module": "./dist/index.mjs",
|
|
"types": "./dist/index.d.ts",
|
|
"exports": {
|
|
".": {
|
|
"types": "./dist/index.d.ts",
|
|
"import": "./dist/index.mjs",
|
|
"require": "./dist/index.js"
|
|
},
|
|
"./token-crypto": {
|
|
"types": "./dist/token-crypto.d.ts",
|
|
"import": "./dist/token-crypto.mjs",
|
|
"require": "./dist/token-crypto.js"
|
|
},
|
|
"./i18n/*": "./i18n/*"
|
|
},
|
|
"//": "typesVersions maps the ./token-crypto subpath for the api, which uses classic (node10) module resolution that ignores the exports field.",
|
|
"typesVersions": {
|
|
"*": {
|
|
"token-crypto": [
|
|
"./dist/token-crypto.d.ts"
|
|
]
|
|
}
|
|
},
|
|
"files": [
|
|
"dist",
|
|
"i18n"
|
|
],
|
|
"scripts": {
|
|
"build": "tsup src/index.ts src/token-crypto.ts --format esm,cjs --dts --clean",
|
|
"typecheck": "tsc --noEmit",
|
|
"test": "vitest run --passWithNoTests"
|
|
},
|
|
"dependencies": {
|
|
"markdown-it": "^14.3.0",
|
|
"prosemirror-markdown": "^1.13.4",
|
|
"prosemirror-model": "^1.25.9",
|
|
"prosemirror-tables": "^1.8.5",
|
|
"zod": "^3.24.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/markdown-it": "^14.1.2",
|
|
"@types/node": "^26.1.0",
|
|
"tsup": "^8.3.0",
|
|
"vitest": "^3.0.0"
|
|
}
|
|
}
|