netops/netops-todo-node/server.js

'use strict';
/**
 * NetOps To-Do — server.
 *
 * Express for REST-API + statiske filer, ws for sanntidspush.
 * Alle mutasjoner går via REST (lett å curl-e og feilsøke); WebSocket brukes
 * kun til å pushe endringer, presence og "redigerer nå"-signaler til klientene.
 *
 * Brukernavn hentes fra (i denne rekkefølgen):
 *   1. X-Remote-User-header        (satt av reverse proxy / oauth2-proxy o.l.)
 *   2. Authorization: Basic        (Basic Auth terminert i proxy, brukernavn gjenbrukes)
 *   3. netops_user-cookie          (selvvalgt navn — for hjemme/dev-bruk;
 *                                   skru av med DISABLE_COOKIE_AUTH=1)
 *   4. 'anon'
 */

const path = require('path');
const http = require('http');
const fs = require('fs');
const express = require('express');
const { WebSocketServer } = require('ws');
const { Store, NotFoundError, ConflictError } = require('./lib/store');

const COOKIE_AUTH_ENABLED = process.env.DISABLE_COOKIE_AUTH !== '1';

function sanitizeUser(raw) {
  if (typeof raw !== 'string') return '';
  return raw.replace(/[^A-Za-z0-9._@\-]/g, '').slice(0, 64);
}

function parseCookies(header) {
  const out = {};
  if (!header) return out;
  for (const part of header.split(';')) {
    const i = part.indexOf('=');
    if (i > 0) out[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim());
  }
  return out;
}

// Felles for HTTP-requests og WebSocket-upgrade (begge har headers).
function userFromRequest(req) {
  let u = sanitizeUser(req.headers['x-remote-user']);
  if (u) return u;
  const auth = req.headers.authorization || '';
  if (auth.startsWith('Basic ')) {
    try {
      const decoded = Buffer.from(auth.slice(6), 'base64').toString('utf8');
      u = sanitizeUser(decoded.split(':')[0]);
      if (u) return u;
    } catch { /* ignorer ugyldig base64 */ }
  }
  if (COOKIE_AUTH_ENABLED) {
    u = sanitizeUser(parseCookies(req.headers.cookie).netops_user);
    if (u) return u;
  }
  return 'anon';
}

function createServer({ dataDir = path.join(__dirname, 'data') } = {}) {
  const store = new Store(dataDir);
  store.load();

  const app = express();
  app.disable('x-powered-by');
  app.use(express.json({ limit: '2mb' }));
  app.use((req, res, next) => {
    req.user = userFromRequest(req);
    res.setHeader('X-Content-Type-Options', 'nosniff');
    if (req.path.startsWith('/api/')) res.setHeader('Cache-Control', 'no-store');
    next();
  });
  app.use(express.static(path.join(__dirname, 'public')));

  const server = http.createServer(app);

  // ---------- WebSocket ----------
  const wss = new WebSocketServer({ noServer: true });
  // ws → { user, editing: taskId|null, isAlive }
  const clients = new Map();

  server.on('upgrade', (req, socket, head) => {
    if (!req.url.startsWith('/ws')) { socket.destroy(); return; }
    wss.handleUpgrade(req, socket, head, ws => {
      wss.emit('connection', ws, req);
    });
  });

  function broadcast(obj) {
    const msg = JSON.stringify(obj);
    for (const ws of clients.keys()) {
      if (ws.readyState === ws.OPEN) ws.send(msg);
    }
  }

  function onlineUsers() {
    const set = new Set();
    for (const meta of clients.values()) set.add(meta.user);
    return [...set].sort();
  }

  // { taskId: [brukernavn, ...] } — hvem som har redigeringsmodal åpen
  function editingState() {
    const out = {};
    for (const meta of clients.values()) {
      if (!meta.editing) continue;
      (out[meta.editing] ||= []).push(meta.user);
    }
    return out;
  }

  function broadcastPresence() {
    broadcast({ type: 'presence', online: onlineUsers() });
  }

  wss.on('connection', (ws, req) => {
    const user = userFromRequest(req);
    clients.set(ws, { user, editing: null, isAlive: true });
    store.rememberUser(user);

    ws.send(JSON.stringify({ type: 'hello', user, online: onlineUsers(), editing: editingState() }));
    ws.send(JSON.stringify({ type: 'sync', tasks: store.list(), activity: store.activity }));
    broadcastPresence();

    ws.on('pong', () => { const m = clients.get(ws); if (m) m.isAlive = true; });

    ws.on('message', raw => {
      let msg;
      try { msg = JSON.parse(raw); } catch { return; }
      const meta = clients.get(ws);
      if (!meta) return;
      if (msg.type === 'editing') {
        meta.editing = msg.active && typeof msg.id === 'string' ? msg.id.slice(0, 32) : null;
        broadcast({ type: 'editing', editing: editingState() });
      }
    });

    ws.on('close', () => {
      const meta = clients.get(ws);
      clients.delete(ws);
      if (meta && meta.editing) broadcast({ type: 'editing', editing: editingState() });
      broadcastPresence();
    });
  });

  // Heartbeat: dropp døde tilkoblinger (klient bak NAT/proxy som forsvant).
  const heartbeat = setInterval(() => {
    for (const [ws, meta] of clients) {
      if (!meta.isAlive) { ws.terminate(); clients.delete(ws); continue; }
      meta.isAlive = false;
      ws.ping();
    }
  }, 30000);
  heartbeat.unref();

  // ---------- REST API ----------
  const todayStr = () => new Date().toISOString().slice(0, 10);
  const validDate = d => typeof d === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(d);

  app.get('/healthz', (req, res) => res.json({ ok: true, tasks: store.tasks.length }));

  app.get('/api/state', (req, res) => {
    store.rememberUser(req.user);
    const today = todayStr();
    const plan = store.getPlan(req.user, today);
    res.json({
      user: req.user,
      canSetName: COOKIE_AUTH_ENABLED,
      tasks: store.list(),
      activity: store.activity,
      known_users: [...store.knownUsers].sort(),
      online: onlineUsers(),
      categories: store.categories(),
      plan: { date: today, user: req.user, name: plan.name, items: plan.items, shared: plan.shared },
      planIndex: store.planIndex(req.user),
    });
  });

  app.get('/api/plan', (req, res) => {
    const date = validDate(req.query.date) ? req.query.date : todayStr();
    const owner = typeof req.query.user === 'string' && req.query.user ? sanitizeUser(req.query.user) : req.user;
    const plan = store.getPlanFor(req.user, owner, date);
    if (!plan) return res.status(403).json({ error: 'Planen er privat' });
    res.json({ date, user: owner, name: plan.name, items: plan.items, shared: plan.shared, readonly: owner !== req.user });
  });

  // Plan-endringer påvirker per-oppgave-badges hos andre. Delte planer
  // broadcastes til alle; private sendes kun til eierens egne faner (andre får
  // en tom melding så de fjerner planen fra sin badge-indeks).
  function broadcastPlan(owner, date) {
    const plan = store.getPlan(owner, date);
    const ownerMsg = JSON.stringify({ type: 'plan', user: owner, date, name: plan.name, items: plan.items, shared: plan.shared });
    const othersMsg = plan.shared
      ? ownerMsg
      : JSON.stringify({ type: 'plan', user: owner, date, name: '', items: [], shared: false });
    for (const [ws, meta] of clients) {
      if (ws.readyState !== ws.OPEN) continue;
      ws.send(meta.user === owner ? ownerMsg : othersMsg);
    }
  }

  app.put('/api/plan', (req, res) => {
    const date = validDate(req.body && req.body.date) ? req.body.date : todayStr();
    const name = req.body && typeof req.body.name === 'string' ? req.body.name : undefined;
    const shared = req.body && typeof req.body.shared === 'boolean' ? req.body.shared : undefined;
    const plan = store.setPlan(req.user, date, req.body && req.body.items, name, shared);
    broadcastPlan(req.user, date);
    res.json({ date, user: req.user, name: plan.name, items: plan.items, shared: plan.shared });
  });

  app.put('/api/plan/share', (req, res) => {
    const date = validDate(req.body && req.body.date) ? req.body.date : todayStr();
    const shared = !!(req.body && req.body.shared);
    const plan = store.setPlanShared(req.user, date, shared);
    broadcastPlan(req.user, date);
    res.json({ date, user: req.user, name: plan.name, items: plan.items, shared: plan.shared });
  });

  app.put('/api/plan/move', (req, res) => {
    const from = validDate(req.body && req.body.from) ? req.body.from : null;
    const to = validDate(req.body && req.body.to) ? req.body.to : null;
    if (!from || !to) return res.status(400).json({ error: 'Ugyldig dato (from/to må være YYYY-MM-DD)' });
    const plan = store.movePlan(req.user, from, to);
    broadcastPlan(req.user, from); // kildedatoen er nå tom
    broadcastPlan(req.user, to);   // måldatoen har planen
    res.json({ date: to, user: req.user, name: plan.name, items: plan.items, shared: plan.shared });
  });

  app.post('/api/categories', (req, res) => {
    const cat = store.addCategory({ name: req.body && req.body.name, color: req.body && req.body.color }, req.user);
    broadcast({ type: 'categories', categories: store.categories(), by: req.user });
    res.status(201).json({ category: cat });
  });

  app.post('/api/login', (req, res) => {
    if (!COOKIE_AUTH_ENABLED) return res.status(403).json({ error: 'Navnevalg er deaktivert — auth styres av proxy' });
    const raw = req.body && req.body.name;
    // Ved eksplisitt navnevalg: avvis ugyldige tegn i stedet for å sanitere stille.
    if (typeof raw !== 'string' || !/^[A-Za-z0-9._@\-]{1,64}$/.test(raw)) {
      return res.status(400).json({ error: 'Ugyldig navn (a-z, 0-9, . _ @ -)' });
    }
    const name = raw;
    res.setHeader('Set-Cookie', `netops_user=${encodeURIComponent(name)}; Path=/; Max-Age=31536000; SameSite=Lax`);
    store.rememberUser(name);
    res.json({ user: name });
  });

  app.post('/api/tasks', (req, res) => {
    const { task, activity } = store.create(req.body, req.user);
    broadcast({ type: 'task', op: 'create', task, by: req.user, activity });
    res.status(201).json({ task });
  });

  app.put('/api/tasks/:id', (req, res) => {
    // Valgfri `comment` følger med ved statusbytte; normalizeTask ignorerer
    // ukjente felter, så den blir ikke en del av selve oppgaven.
    const comment = req.body && typeof req.body.comment === 'string' ? req.body.comment : '';
    const { task, activity } = store.update(req.params.id, req.body, req.user, { comment });
    broadcast({ type: 'task', op: 'update', task, by: req.user, activity });
    res.json({ task });
  });

  app.delete('/api/tasks/:id', (req, res) => {
    const { task, activity } = store.remove(req.params.id, req.user);
    broadcast({ type: 'task', op: 'delete', id: task.id, by: req.user, activity });
    res.json({ ok: true, task });
  });

  app.post('/api/tasks/:id/comments', (req, res) => {
    const { task, comment, activity } = store.addComment(req.params.id, req.body && req.body.text, req.user);
    broadcast({ type: 'task', op: 'update', task, by: req.user, activity });
    res.status(201).json({ task, comment });
  });

  app.delete('/api/tasks/:id/comments/:cid', (req, res) => {
    const { task } = store.deleteComment(req.params.id, req.params.cid, req.user);
    broadcast({ type: 'task', op: 'update', task, by: req.user });
    res.json({ task });
  });

  app.post('/api/replace', (req, res) => {
    const { count, activity } = store.replaceAll(req.body, req.user);
    broadcast({ type: 'sync', tasks: store.list(), activity: store.activity, by: req.user });
    res.json({ ok: true, count });
  });

  app.post('/api/seed', (req, res) => {
    const seedFile = path.join(__dirname, 'seed.json');
    let seed;
    try { seed = JSON.parse(fs.readFileSync(seedFile, 'utf8')); }
    catch { return res.status(500).json({ error: 'Mangler seed.json' }); }
    const { count } = store.seed(seed, req.user);
    broadcast({ type: 'sync', tasks: store.list(), activity: store.activity, by: req.user });
    res.json({ ok: true, count });
  });

  // Feilhåndtering — oversetter store-exceptions til HTTP-koder.
  app.use((err, req, res, next) => {
    if (err instanceof NotFoundError) return res.status(404).json({ error: err.message });
    if (err instanceof ConflictError) return res.status(409).json({ error: err.message, task: err.task });
    if (err.type === 'entity.parse.failed') return res.status(400).json({ error: 'Ugyldig JSON' });
    const code = err.status || 400;
    res.status(code >= 500 ? 500 : code).json({ error: err.message || 'Ukjent feil' });
  });

  return { app, server, store, wss, clients };
}

if (require.main === module) {
  const port = Number(process.env.PORT) || 3000;
  const host = process.env.HOST || '0.0.0.0';
  const dataDir = process.env.DATA_DIR || path.join(__dirname, 'data');
  const { server, store } = createServer({ dataDir });
  server.listen(port, host, () => {
    console.log(`NetOps To-Do kjører på http://${host === '0.0.0.0' ? 'localhost' : host}:${port}`);
    console.log(`Datakatalog: ${dataDir} (${store.tasks.length} oppgaver)`);
    if (!COOKIE_AUTH_ENABLED) console.log('Cookie-auth er deaktivert — bruker kun proxy-headere');
  });
}

module.exports = { createServer, userFromRequest };