server.js

'use strict';

/**
 * CodeQuorum server: static client + REST API + real-time collaboration.
 *
 * Security posture (see SECURITY.md):
 *   - helmet sets security headers incl. a tailored Content-Security-Policy
 *   - express-rate-limit throttles the API
 *   - all input is validated (zod) and all SQL is parameterized
 *   - authorization is enforced SERVER-SIDE on the socket layer: private rooms
 *     reject non-members, and "viewer" role edits are dropped, never trusted
 *
 * Realtime wire protocol:
 *   client → join         { roomId, user, clientId }
 *   server → joined       { role }                  'owner' | 'editor' | 'viewer'
 *   server → access-denied { reason }
 *   server → init         <binary Yjs state>
 *   server → presence     [{ id, name, color, file }]
 *   client → y-update      <binary>  (ignored from viewers)
 *   server → y-update      <binary>
 *   client → awareness     <binary> ; server → awareness <binary>
 *   client → set-activity <fileName|null> ; client → rename <name>
 *   server → peer-left    { clientId }
 */

const http = require('http');
const os = require('os');
const crypto = require('crypto');
const path = require('path');
const express = require('express');
const helmet = require('helmet');
const cookieParser = require('cookie-parser');
const rateLimit = require('express-rate-limit');
const { Server } = require('socket.io');

const rooms = require('./rooms');
const repo = require('./repo');
const apiRouter = require('./api');
const { attachUser, userIdFromCookieHeader } = require('./auth');

const PORT = process.env.PORT || 3000;
const PUBLIC_DIR = path.join(__dirname, '..', 'public');

const app = express();
const server = http.createServer(app);
const io = new Server(server, { maxHttpBufferSize: 1e7 });

app.disable('x-powered-by');
app.use(helmet({
  contentSecurityPolicy: {
    useDefaults: true,
    directives: {
      'default-src': ["'self'"],
      // 'wasm-unsafe-eval' lets the self-hosted Pyodide (Python) runtime compile
      // its WebAssembly. It permits WASM only — NOT arbitrary JS eval.
      'script-src': ["'self'", "'wasm-unsafe-eval'"],
      'style-src': ["'self'", "'unsafe-inline'"],   // CodeMirror injects styles
      'img-src': ["'self'", 'data:'],
      'connect-src': ["'self'", 'ws:', 'wss:'],
      'worker-src': ["'self'", 'blob:'],              // JS sandbox (blob) + Python worker (self)
      'frame-src': ["'self'", 'blob:'],               // sandboxed HTML preview
      'object-src': ["'none'"],
      'base-uri': ["'self'"],
      'form-action': ["'self'"],
    },
  },
  // The HTML preview is intentionally framed; allow same-origin framing only.
  crossOriginEmbedderPolicy: false,
}));
app.use(express.json({ limit: '1mb' }));
app.use(cookieParser());
app.use(attachUser);

app.use('/api', rateLimit({ windowMs: 60 * 1000, max: 300, standardHeaders: true, legacyHeaders: false }), apiRouter);

// Sandboxed live preview. Client posts assembled HTML; we serve it from a
// short-lived URL with its OWN locked-down CSP (inline scripts allowed so the
// user's page runs, but `default-src 'none'` blocks all network access). Served
// from a real URL so it does NOT inherit the app's strict CSP.
const previews = new Map(); // token -> { html, ts }
const PREVIEW_TTL = 60 * 1000;
function sweepPreviews() {
  const now = Date.now();
  for (const [t, v] of previews) if (now - v.ts > PREVIEW_TTL) previews.delete(t);
}

app.post('/api/preview', (req, res) => {
  sweepPreviews();
  if (previews.size > 500) return res.status(429).json({ error: 'Too many previews in flight.' });
  const html = String((req.body && req.body.html) || '');
  const token = crypto.randomBytes(12).toString('hex');
  previews.set(token, { html, ts: Date.now() });
  res.json({ token });
});

app.get('/preview/:token', (req, res) => {
  const entry = previews.get(req.params.token);
  if (!entry) return res.status(404).type('html').send('<p style="font:14px sans-serif">Preview expired — run it again.</p>');
  res.setHeader('Content-Security-Policy',
    "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob:; style-src 'unsafe-inline'; img-src data: blob:; font-src data:; media-src data: blob:; frame-ancestors 'self'");
  res.type('html').send(entry.html);
});

// Self-hosted Pyodide runtime (Python in notebooks) — served from our origin.
app.use('/pyodide', express.static(path.join(__dirname, '..', 'node_modules', 'pyodide'), {
  immutable: true,
  maxAge: '7d',
}));

app.use(express.static(PUBLIC_DIR));
app.get('/', (_req, res) => res.sendFile(path.join(PUBLIC_DIR, 'index.html')));
app.get('/room/:id', (_req, res) => res.sendFile(path.join(PUBLIC_DIR, 'room.html')));
app.get('/healthz', (_req, res) => res.json({ ok: true, rooms: rooms._rooms.size }));

async function emitPresence(roomId) {
  const sockets = await io.in(roomId).fetchSockets();
  io.in(roomId).emit('presence', sockets.map((s) => s.data.user).filter(Boolean));
}

io.use((socket, next) => {
  socket.data.userId = userIdFromCookieHeader(socket.handshake.headers.cookie) || null;
  next();
});

io.on('connection', (socket) => {
  socket.on('join', async ({ roomId, user, clientId } = {}) => {
    const id = rooms.sanitizeId(roomId);
    if (!id) return socket.emit('access-denied', { reason: 'Invalid room id.' });

    // Ensure a room record exists; a first visitor (anonymous or signed-in)
    // creates a public room, becoming owner if signed in.
    let room = repo.rooms.byId(id);
    if (!room) {
      room = repo.rooms.create({ roomId: id, name: id, ownerId: socket.data.userId, visibility: 'public' });
      if (socket.data.userId) repo.members.add(id, socket.data.userId, 'editor');
    }

    const role = repo.effectiveRole(room, socket.data.userId);
    if (!role) return socket.emit('access-denied', { reason: 'This room is private.' });

    socket.data.roomId = id;
    socket.data.role = role;
    socket.data.canEdit = role !== 'viewer';
    socket.data.clientId = clientId;
    socket.data.user = {
      id: socket.id,
      clientId,                 // Yjs clientID, used for "follow" / "spotlight"
      name: (user && String(user.name).slice(0, 40)) || 'Anonymous',
      color: (user && user.color) || '#888888',
      file: null,
    };

    socket.join(id);
    rooms.join(id);
    socket.emit('joined', { role });
    socket.emit('init', Buffer.from(rooms.getStateAsUpdate(id)));
    await emitPresence(id);
  });

  socket.on('y-update', (update) => {
    const id = socket.data.roomId;
    if (!id || !update || !socket.data.canEdit) return; // viewers cannot write
    const bytes = new Uint8Array(update);
    rooms.applyUpdate(id, bytes);
    repo.rooms.touch(id);
    socket.to(id).emit('y-update', Buffer.from(bytes));
  });

  socket.on('awareness', (update) => {
    const id = socket.data.roomId;
    if (!id || !update) return;
    socket.to(id).emit('awareness', Buffer.from(new Uint8Array(update)));
  });

  socket.on('rename', async (name) => {
    const id = socket.data.roomId;
    if (!id || !socket.data.user) return;
    socket.data.user.name = String(name).slice(0, 40) || 'Anonymous';
    await emitPresence(id);
  });

  // Figma-style "spotlight": ask everyone in the room to follow this user.
  socket.on('spotlight', () => {
    const id = socket.data.roomId;
    if (!id || socket.data.clientId == null) return;
    socket.to(id).emit('spotlight', { clientId: socket.data.clientId, name: socket.data.user && socket.data.user.name });
  });

  socket.on('set-activity', async (fileName) => {
    const id = socket.data.roomId;
    if (!id || !socket.data.user) return;
    socket.data.user.file = fileName ? String(fileName).slice(0, 120) : null;
    await emitPresence(id);
  });

  socket.on('disconnect', async () => {
    const id = socket.data.roomId;
    if (!id) return;
    rooms.leave(id);
    if (socket.data.clientId != null) socket.to(id).emit('peer-left', { clientId: socket.data.clientId });
    await emitPresence(id);
  });
});

function lanAddresses() {
  const out = [];
  for (const ifaces of Object.values(os.networkInterfaces())) {
    for (const i of ifaces || []) {
      if (i.family === 'IPv4' && !i.internal) out.push(i.address);
    }
  }
  return out;
}

if (require.main === module) {
  server.listen(PORT, () => {
    console.log(`\n  CodeQuorum is running:\n`);
    console.log(`    • Local:   http://localhost:${PORT}`);
    for (const ip of lanAddresses()) console.log(`    • Network: http://${ip}:${PORT}   (share THIS with people on your Wi-Fi/LAN)`);
    console.log(`\n  Note: a "localhost" link only works on THIS machine. To collaborate`);
    console.log(`  with others, share the Network URL above, or deploy (see README).\n`);
  });
}

module.exports = { app, server, io };