feat: support embedded authoring for creation (#1741)

Adds support for creating documents and templates
using our embed components.

Support is super primitive at the moment and is being polished.

packages/lib/package.json

@@ -28,6 +28,7 @@
     "@lingui/core": "^5.2.0",
     "@lingui/macro": "^5.2.0",
     "@lingui/react": "^5.2.0",
+    "jose": "^6.0.0",
     "@noble/ciphers": "0.4.0",
     "@noble/hashes": "1.3.2",
     "@node-rs/bcrypt": "^1.10.0",
@@ -58,4 +59,4 @@
     "@types/luxon": "^3.3.1",
     "@types/pg": "^8.11.4"
   }
-}
+}

packages/lib/server-only/embedding-presign/create-embedding-presign-token.ts

@@ -0,0 +1,63 @@
+import { SignJWT } from 'jose';
+import { DateTime } from 'luxon';
+
+import { AppError, AppErrorCode } from '../../errors/app-error';
+import { env } from '../../utils/env';
+import { getApiTokenByToken } from '../public-api/get-api-token-by-token';
+
+export type CreateEmbeddingPresignTokenOptions = {
+  apiToken: string;
+  /**
+   * Number of hours until the token expires
+   * In development mode, can be set to 0 to create a token that expires immediately (for testing)
+   */
+  expiresIn?: number;
+};
+
+export const createEmbeddingPresignToken = async ({
+  apiToken,
+  expiresIn,
+}: CreateEmbeddingPresignTokenOptions) => {
+  try {
+    // Validate the API token
+    const validatedToken = await getApiTokenByToken({ token: apiToken });
+
+    const now = DateTime.now();
+
+    // In development mode, allow setting expiresIn to 0 for testing
+    // In production, enforce a minimum expiration time
+    const isDevelopment = env('NODE_ENV') !== 'production';
+    console.log('isDevelopment', isDevelopment);
+    const minExpirationMinutes = isDevelopment ? 0 : 5;
+
+    // Ensure expiresIn is at least the minimum allowed value
+    const effectiveExpiresIn =
+      expiresIn !== undefined && expiresIn >= minExpirationMinutes ? expiresIn : 60; // Default to 1 hour if not specified or below minimum
+
+    const expiresAt = now.plus({ minutes: effectiveExpiresIn });
+
+    const secret = new TextEncoder().encode(validatedToken.token);
+
+    const token = await new SignJWT({
+      aud: String(validatedToken.teamId ?? validatedToken.userId),
+      sub: String(validatedToken.id),
+    })
+      .setProtectedHeader({ alg: 'HS256' })
+      .setIssuedAt(now.toJSDate())
+      .setExpirationTime(expiresAt.toJSDate())
+      .sign(secret);
+
+    return {
+      token,
+      expiresAt: expiresAt.toJSDate(),
+      expiresIn: Math.floor(expiresAt.diff(now).toMillis() / 1000),
+    };
+  } catch (error) {
+    if (error instanceof AppError) {
+      throw error;
+    }
+    throw new AppError(AppErrorCode.UNKNOWN_ERROR, {
+      message: 'Failed to create presign token',
+    });
+  }
+};

packages/lib/server-only/embedding-presign/verify-embedding-presign-token.ts

@@ -0,0 +1,115 @@
+import type { JWTPayload } from 'jose';
+import { decodeJwt, jwtVerify } from 'jose';
+
+import { prisma } from '@documenso/prisma';
+
+import { AppError, AppErrorCode } from '../../errors/app-error';
+
+export type VerifyEmbeddingPresignTokenOptions = {
+  token: string;
+};
+
+export const verifyEmbeddingPresignToken = async ({
+  token,
+}: VerifyEmbeddingPresignTokenOptions) => {
+  // First decode the JWT to get the claims without verification
+  let decodedToken: JWTPayload;
+
+  try {
+    decodedToken = decodeJwt<JWTPayload>(token);
+  } catch (error) {
+    console.error('Error decoding JWT token:', error);
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'Invalid presign token format',
+    });
+  }
+
+  // Validate the required claims
+  if (!decodedToken.sub || typeof decodedToken.sub !== 'string') {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'Invalid presign token format: missing or invalid subject claim',
+    });
+  }
+
+  if (!decodedToken.aud || typeof decodedToken.aud !== 'string') {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'Invalid presign token format: missing or invalid audience claim',
+    });
+  }
+
+  // Convert string IDs to numbers
+  const tokenId = Number(decodedToken.sub);
+  const audienceId = Number(decodedToken.aud);
+
+  if (Number.isNaN(tokenId) || !Number.isInteger(tokenId)) {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'Invalid token ID format in subject claim',
+    });
+  }
+
+  if (Number.isNaN(audienceId) || !Number.isInteger(audienceId)) {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'Invalid user ID format in audience claim',
+    });
+  }
+
+  // Get the API token to use as the verification secret
+  const apiToken = await prisma.apiToken.findFirst({
+    where: {
+      id: tokenId,
+    },
+  });
+
+  if (!apiToken) {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'Invalid presign token: API token not found',
+    });
+  }
+
+  // This should never happen but we need to narrow types
+  if (!apiToken.userId) {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'Invalid presign token: API token does not have a user attached',
+    });
+  }
+
+  const userId = apiToken.userId;
+
+  if (audienceId !== apiToken.teamId && audienceId !== apiToken.userId) {
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'Invalid presign token: API token does not match audience',
+    });
+  }
+
+  // Now verify the token with the actual secret
+  const secret = new TextEncoder().encode(apiToken.token);
+
+  try {
+    await jwtVerify(token, secret);
+  } catch (error) {
+    // Check if the token has expired
+    if (error instanceof Error && error.name === 'JWTExpired') {
+      throw new AppError(AppErrorCode.UNAUTHORIZED, {
+        message: 'Presign token has expired',
+      });
+    }
+
+    // Handle invalid signature
+    if (error instanceof Error && error.name === 'JWSInvalid') {
+      throw new AppError(AppErrorCode.UNAUTHORIZED, {
+        message: 'Invalid presign token signature',
+      });
+    }
+
+    // Log and rethrow other errors
+    console.error('Error verifying JWT token:', error);
+    throw new AppError(AppErrorCode.UNAUTHORIZED, {
+      message: 'Failed to verify presign token',
+    });
+  }
+
+  return {
+    ...apiToken,
+    userId,
+  };
+};