import type { NodeOAuthClient } from '@atproto/oauth-client-node'
import { createLogger } from '@wispplace/observability'
import { PRIVATE_ACCESS_PAGE_STYLES } from '@wispplace/private-sites'
import { Elysia } from 'elysia'
import { authorizeWisp } from '../lib/oauth-authorize'
import { openPrivateSiteForAccount, redeemScopedShare, resolveShareLink } from '../lib/private-sites-service'
import { authenticateRequest, SESSION_COOKIE_NAME } from '../lib/wisp-auth'
const logger = createLogger('main-app')
const json = (value: unknown): string =>
JSON.stringify(value).replace(//g, '\\u003e').replace(/&/g, '\\u0026')
const page = (title: string, body: string): string => `
${title} — wisp.place
${body}`
const signInPage = (siteId: string, token?: string): string => {
const shared = token !== undefined
return page(
'sign in',
`wisp.place
${shared ? 'shared link
' : ''}
sign in to open this ${shared ? 'link' : 'private site'}
${shared ? '' : 'only accounts with access can open it without a share link.
'}
`,
)
}
const deniedPage = (): string =>
page(
'not available',
`wisp.place
this link is not available
it may have been revoked, expired, or issued to a different account.
`,
)
const htmlResponse = (set: { headers: Record; status?: number | string }, body: string) => {
set.headers['Content-Type'] = 'text/html; charset=utf-8'
set.headers['Cache-Control'] = 'no-store, no-cache, must-revalidate, private'
set.headers['Referrer-Policy'] = 'no-referrer'
set.headers['X-Robots-Tag'] = 'noindex, nofollow'
return body
}
const readBody = (body: unknown) => {
const value = body as { siteId?: unknown; token?: unknown; handle?: unknown } | null
return {
siteId: typeof value?.siteId === 'string' ? value.siteId : '',
token: typeof value?.token === 'string' ? value.token : undefined,
handle: typeof value?.handle === 'string' ? value.handle.trim() : '',
}
}
export const resolvePrivateShareState = async (
state: string | null | undefined,
viewerDid: string,
): Promise<{ url: string | null } | null> => {
if (!state) return null
let parsed: { kind?: unknown; siteId?: unknown; token?: unknown }
try {
parsed = JSON.parse(state)
} catch {
return null
}
if (typeof parsed.siteId !== 'string') return null
if (parsed.kind === 'privateOpen') return { url: await openPrivateSiteForAccount(parsed.siteId, viewerDid) }
if (parsed.kind !== 'privateShare' || typeof parsed.token !== 'string') return null
return { url: await redeemScopedShare(parsed.siteId, parsed.token, viewerDid) }
}
export const privateRedeemRoutes = (client: NodeOAuthClient, cookieSecret: string) =>
new Elysia({ cookie: { secrets: cookieSecret, sign: [SESSION_COOKIE_NAME] } })
.post('/private/redeem', async ({ body, cookie, request, set }) => {
const { siteId, token } = readBody(body)
if (!siteId || !token) {
set.status = 400
return htmlResponse(set, deniedPage())
}
const auth = await authenticateRequest(client, cookie, request.headers.get('cookie'))
if (!auth) return htmlResponse(set, signInPage(siteId, token))
const url = await redeemScopedShare(siteId, token, auth.did)
if (!url) {
set.status = 404
return htmlResponse(set, deniedPage())
}
set.status = 303
set.headers.Location = url
return ''
})
.get('/private/denied', ({ set }) => {
set.status = 403
return htmlResponse(set, deniedPage())
})
.get('/private/open', async ({ query, cookie, request, set }) => {
const siteId = typeof query.siteId === 'string' ? query.siteId : ''
if (!siteId) {
set.status = 400
return htmlResponse(set, deniedPage())
}
const auth = await authenticateRequest(client, cookie, request.headers.get('cookie'))
if (!auth) return htmlResponse(set, signInPage(siteId))
const url = await openPrivateSiteForAccount(siteId, auth.did)
if (!url) {
set.status = 404
return htmlResponse(set, deniedPage())
}
set.status = 303
set.headers.Location = url
return ''
})
.get('/p/:token', async ({ params, set }) => {
const target = await resolveShareLink(params.token ?? '')
if (!target) {
set.status = 404
return htmlResponse(set, deniedPage())
}
set.status = 302
set.headers.Location = target
set.headers['Cache-Control'] = 'no-store, no-cache, must-revalidate, private'
set.headers['Referrer-Policy'] = 'no-referrer'
return ''
})
.post('/private/sign-in', async ({ body, set }) => {
const { siteId, token, handle } = readBody(body)
if (!siteId || !handle) {
set.status = 400
return { error: 'missing handle' }
}
try {
const state = JSON.stringify({ kind: token ? 'privateShare' : 'privateOpen', siteId, token })
return { url: (await authorizeWisp(client, handle, { state })).toString() }
} catch (err) {
logger.error('[PrivateSite] Sign-in failed', err)
set.status = 400
return { error: 'sign-in unavailable' }
}
})