159 lines · 4 KBtext/plain; charset=utf-8
The Coline App SDK: apps, tools, file types and surfaces that run inside Coline workspaces, and public websites with Coline Sites. TypeScript, with an in-memory test workspace. MIT.
| COLINE_DELIVERY_HEADER, |
| 5 | COLINE_SIGNATURE_HEADER, |
| 6 | COLINE_TIMESTAMP_HEADER, |
| 7 | verifyAppRequestSignature, |
| 8 | } from "../server/signing"; |
| 9 |
| 10 | export const COLINE_HOSTED_REQUEST_MAX_TIMESTAMP_DRIFT_MS = 5 * 60 * 1000; |
| 11 |
| 12 | export const colineHostedWorkspaceSchema = z.object({ |
| 13 | id: z.string().min(1), |
| 14 | slug: z.string().min(1), |
| 15 | name: z.string().min(1), |
| 16 | }); |
| 17 |
| 18 | export const colineHostedAppSchema = z.object({ |
| 19 | appInstallId: z.string().min(1), |
| 20 | appId: z.string().min(1), |
| 21 | appKey: z.string().min(1), |
| 22 | name: z.string().min(1), |
| 23 | }); |
| 24 |
| 25 | export const colineHostedActorSchema = z.object({ |
| 26 | userId: z.string().min(1), |
| 27 | email: z.string().email(), |
| 28 | handle: z.string().nullable().optional(), |
| 29 | firstName: z.string().nullable().optional(), |
| 30 | lastName: z.string().nullable().optional(), |
| 31 | }); |
| 32 |
| 33 | export const colineHostedFileSchema = z.object({ |
| 34 | id: z.string().min(1), |
| 35 | typeKey: z.string().min(1), |
| 36 | title: z.string().optional(), |
| 37 | }); |
| 38 |
| 39 | export const colineHostedRenderHomeRequestSchema = z.object({ |
| 40 | workspace: colineHostedWorkspaceSchema, |
| 41 | app: colineHostedAppSchema, |
| 42 | actor: colineHostedActorSchema.nullable().optional(), |
| 43 | }); |
| 44 |
| 45 | export const colineHostedRenderFileRequestSchema = z.object({ |
| 46 | workspace: colineHostedWorkspaceSchema, |
| 47 | app: colineHostedAppSchema, |
| 48 | actor: colineHostedActorSchema.nullable().optional(), |
| 49 | file: colineHostedFileSchema, |
| 50 | document: z.record(z.string(), z.unknown()), |
| 51 | }); |
| 52 |
| 53 | export const colineHostedActionRequestSchema = z.object({ |
| 54 | workspace: colineHostedWorkspaceSchema, |
| 55 | app: colineHostedAppSchema, |
| 56 | actor: colineHostedActorSchema.nullable().optional(), |
| 57 | action: colineUiActionSchema, |
| 58 | file: colineHostedFileSchema.nullable().optional(), |
| 59 | }); |
| 60 |
| 61 | export const colineHostedActionResponseSchema = z.union([ |
| 62 | z.object({ type: z.literal("ok") }), |
| 63 | z.object({ type: z.literal("refresh") }), |
| 64 | z.object({ |
| 65 | type: z.literal("navigate"), |
| 66 | href: z.string().min(1), |
| 67 | }), |
| 68 | z.object({ |
| 69 | type: z.literal("open_file"), |
| 70 | fileId: z.string().min(1), |
| 71 | }), |
| 72 | ]); |
| 73 |
| 74 | export type ColineHostedWorkspace = z.infer<typeof colineHostedWorkspaceSchema>; |
| 75 | export type ColineHostedApp = z.infer<typeof colineHostedAppSchema>; |
| 76 | export type ColineHostedActor = z.infer<typeof colineHostedActorSchema>; |
| 77 | export type ColineHostedFile = z.infer<typeof colineHostedFileSchema>; |
| 78 | export type ColineHostedRenderHomeRequest = z.infer< |
| 79 | typeof colineHostedRenderHomeRequestSchema |
| 80 | >; |
| 81 | export type ColineHostedRenderFileRequest = z.infer< |
| 82 | typeof colineHostedRenderFileRequestSchema |
| 83 | >; |
| 84 | export type ColineHostedActionRequest = z.infer< |
| 85 | typeof colineHostedActionRequestSchema |
| 86 | >; |
| 87 | export type ColineHostedActionResponse = z.infer< |
| 88 | typeof colineHostedActionResponseSchema |
| 89 | >; |
| 90 |
| 91 | export async function parseSignedColineRequest<T>(params: { |
| 92 | request: Request; |
| 93 | secret: string; |
| 94 | schema: z.ZodType<T>; |
| 95 | now?: Date; |
| 96 | }): Promise<{ |
| 97 | deliveryId: string; |
| 98 | timestamp: string; |
| 99 | data: T; |
| 100 | }> { |
| 101 | const signature = params.request.headers.get(COLINE_SIGNATURE_HEADER); |
| 102 | const timestamp = params.request.headers.get(COLINE_TIMESTAMP_HEADER); |
| 103 | const deliveryId = params.request.headers.get(COLINE_DELIVERY_HEADER); |
| 104 | const body = await params.request.text(); |
| 105 |
| 106 | if (!signature || !timestamp || !deliveryId) { |
| 107 | throw new Error("Missing required Coline signing headers."); |
| 108 | } |
| 109 |
| 110 | const timestampMs = new Date(timestamp).getTime(); |
| 111 | const nowMs = (params.now ?? new Date()).getTime(); |
| 112 | if ( |
| 113 | Number.isNaN(timestampMs) || |
| 114 | Math.abs(nowMs - timestampMs) > COLINE_HOSTED_REQUEST_MAX_TIMESTAMP_DRIFT_MS |
| 115 | ) { |
| 116 | throw new Error("Coline request timestamp is too old or invalid."); |
| 117 | } |
| 118 |
| 119 | const isValid = await verifyAppRequestSignature({ |
| 120 | secret: params.secret, |
| 121 | timestamp, |
| 122 | body, |
| 123 | signature, |
| 124 | }); |
| 125 |
| 126 | if (!isValid) { |
| 127 | throw new Error("Invalid Coline request signature."); |
| 128 | } |
| 129 |
| 130 | const parsedBody = JSON.parse(body) as unknown; |
| 131 |
| 132 | return { |
| 133 | deliveryId, |
| 134 | timestamp, |
| 135 | data: params.schema.parse(parsedBody), |
| 136 | }; |
| 137 | } |
| 138 |
| 139 | export const hostedActionResults = { |
| 140 | ok(): ColineHostedActionResponse { |
| 141 | return { type: "ok" }; |
| 142 | }, |
| 143 | refresh(): ColineHostedActionResponse { |
| 144 | return { type: "refresh" }; |
| 145 | }, |
| 146 | navigate(href: string): ColineHostedActionResponse { |
| 147 | return colineHostedActionResponseSchema.parse({ |
| 148 | type: "navigate", |
| 149 | href, |
| 150 | }); |
| 151 | }, |
| 152 | openFile(fileId: string): ColineHostedActionResponse { |
| 153 | return colineHostedActionResponseSchema.parse({ |
| 154 | type: "open_file", |
| 155 | fileId, |
| 156 | }); |
| 157 | }, |
| 158 | }; |
| 159 |