app/lib/preview-links.server.ts

Functions

Imports

It imports app/lib/preview-token.mjs, app/lib/rate-limit.mjs. Imported by app/lib/editor/preview-link-action.server.ts, app/lib/editor/publish.server.ts, app/routes/admin.posts.$slug.edit.tsx, app/routes/preview.$token.tsx.

Source

1import {
2  PREVIEW_TTL_SECONDS,
3  expiresAt,
4  isWellFormedToken,
5  makeRecord,
6  mintToken,
7  parseRecord,
8  postIndexKey,
9  postIndexPrefix,
10  tokenFromIndexKey,
11  tokenKey,
12  truncateToken,
13  type PreviewRecord,
14} from "~/lib/preview-token.mjs";
15import { limitHit } from "~/lib/rate-limit.mjs";
16
17/**
18 * The two KV writes are not transactional, so both operations put the token (authority) key at the
19 * end of the window they can fail in. A crash in revoke leaves an orphaned index entry, which is why
20 * `list` skips an entry whose authority record is gone.
21 */
22
23interface PreviewLink {
24  /** The whole token. Reaches the page ONLY inside the copy control's value. */
25  token: string;
26  short: string;
27  /** ISO 8601, or "" when the stored record carried no readable date. */
28  createdAt: string;
29  /** Advisory: KV's expirationTtl is what actually expires the key. */
30  expiresAt: string;
31  createdBy: string;
32  note: string;
33}
34
35type PreviewEnv = { APP_KV: KVNamespace };
36
37/**
38 * The CALLER decides whether the post is a draft. A token minted against a published post is inert,
39 * because the read path refuses to serve one.
40 */
41export async function createPreviewLink(
42  env: PreviewEnv,
43  input: { slug: string; createdBy: string; note?: string; now?: Date },
44): Promise<PreviewLink> {
45  const token = mintToken();
46  const record = makeRecord({
47    slug: input.slug,
48    createdAt: (input.now ?? new Date()).toISOString(),
49    createdBy: input.createdBy,
50    note: input.note ?? "",
51  });
52
53  const options = { expirationTtl: PREVIEW_TTL_SECONDS };
54  await env.APP_KV.put(tokenKey(token), JSON.stringify(record), options);
55  await env.APP_KV.put(postIndexKey(input.slug, token), "", options);
56
57  return toLink(token, record);
58}
59
60export async function revokePreviewLink(
61  env: PreviewEnv,
62  input: { slug: string; token: string },
63): Promise<void> {
64  if (!isWellFormedToken(input.token)) return;
65  await env.APP_KV.delete(tokenKey(input.token));
66  await env.APP_KV.delete(postIndexKey(input.slug, input.token));
67}
68
69/** Skips an orphaned index entry: listing it would offer a link that does not work. */
70export async function listPreviewLinks(
71  env: PreviewEnv,
72  slug: string,
73): Promise<PreviewLink[]> {
74  const listed = await env.APP_KV.list({ prefix: postIndexPrefix(slug) });
75
76  const links: PreviewLink[] = [];
77  for (const entry of listed.keys) {
78    const token = tokenFromIndexKey(entry.name, slug);
79    if (!token) continue;
80    const record = parseRecord(await env.APP_KV.get(tokenKey(token)));
81    if (!record) continue;
82    links.push(toLink(token, record));
83  }
84
85  // An empty createdAt sorts last, so an unreadable date cannot claim to be the newest link.
86  return links.sort((a, b) => (Date.parse(b.createdAt) || 0) - (Date.parse(a.createdAt) || 0));
87}
88
89/**
90 * Enumerates the index rather than remembering what was minted, so a token from a long-ended
91 * session is still reached. Returns the count so "0 revoked" and "the list call failed" differ.
92 */
93export async function revokeAllPreviewLinks(
94  env: PreviewEnv,
95  slug: string,
96): Promise<number> {
97  const listed = await env.APP_KV.list({ prefix: postIndexPrefix(slug) });
98
99  let revoked = 0;
100  for (const entry of listed.keys) {
101    const token = tokenFromIndexKey(entry.name, slug);
102    // An index key whose tail is not a token is still deleted: it is ours by prefix, and leaving
103    // it would make the count wrong forever.
104    if (token) {
105      await env.APP_KV.delete(tokenKey(token));
106      revoked += 1;
107    }
108    await env.APP_KV.delete(entry.name);
109  }
110  return revoked;
111}
112
113/** Rejects a malformed token WITHOUT touching KV, because the read path is public. */
114export async function readPreviewRecord(
115  env: PreviewEnv,
116  token: string,
117): Promise<PreviewRecord | null> {
118  if (!isWellFormedToken(token)) return null;
119  return parseRecord(await env.APP_KV.get(tokenKey(token)));
120}
121
122/**
123 * Loose for a human opening a link, tight against enumeration. The token space (256 bits) is what
124 * makes guessing safe; this only stops the traffic.
125 */
126export const PREVIEW_RATE_LIMIT = 30;
127
128export const PREVIEW_RATE_WINDOW_SECONDS = 60;
129
130/**
131 * FAILS CLOSED when the binding is absent: an unprotected public path that serves unpublished
132 * content must not serve.
133 */
134export async function checkPreviewRate(
135  env: Env,
136  ip: string,
137): Promise<{ ok: boolean; retryAfter: number }> {
138  // Keyed `preview:` rather than `ip:`, so preview traffic does not spend an Ask caller's counter.
139  const verdict = await limitHit(env, `preview:${ip}`, PREVIEW_RATE_LIMIT, PREVIEW_RATE_WINDOW_SECONDS);
140  return { ok: verdict.status === "ok", retryAfter: verdict.retryAfterSeconds };
141}
142
143function toLink(token: string, record: PreviewRecord): PreviewLink {
144  return {
145    token,
146    short: truncateToken(token),
147    createdAt: record.createdAt,
148    expiresAt: expiresAt(record.createdAt),
149    createdBy: record.createdBy,
150    note: record.note,
151  };
152}