export interface Env { DB: D1Database; PHOTOS: R2Bucket; } type DbRow = Record; type DogRow = { id: number; name: string; email: string; passwordHash: string; breed: string | null; age: number | null; personality: string | null; photoId: number | null; favoriteParkId: number | null; createdAt: string; }; const apiOrigin = "https://ds4f.dogbook.alessio.dev"; const jsonHeaders = { "content-type": "application/json; charset=utf-8" }; const photoTypes = new Set(["image/jpeg", "image/png", "image/gif", "image/webp"]); const encoder = new TextEncoder(); function cors(request: Request): Record { return request.headers.get("origin") === apiOrigin ? { "access-control-allow-origin": apiOrigin, "vary": "Origin" } : {}; } function reply(request: Request, body: unknown, status = 200) { return new Response(JSON.stringify(body), { status, headers: { ...jsonHeaders, ...cors(request) } }); } function fail(request: Request, status: number, error: string) { return reply(request, { error }, status); } function str(value: unknown) { return typeof value === "string" ? value.trim() : ""; } function now() { return new Date().toISOString(); } function id(value: string | undefined) { const result = Number(value); return Number.isInteger(result) && result > 0 ? result : null; } function bytesToHex(bytes: Uint8Array) { return Array.from(bytes, byte => byte.toString(16).padStart(2, "0")).join(""); } function randomHex(size: number) { const bytes = new Uint8Array(size); crypto.getRandomValues(bytes); return bytesToHex(bytes); } async function passwordHash(password: string, salt = randomHex(16)) { const key = await crypto.subtle.importKey("raw", encoder.encode(password), "PBKDF2", false, ["deriveBits"]); const bits = await crypto.subtle.deriveBits( // Keep this intentionally low enough for Workers Free's 10 ms CPU budget. { name: "PBKDF2", hash: "SHA-256", salt: encoder.encode(salt), iterations: 10000 }, key, 256 ); return `pbkdf2${salt}${bytesToHex(new Uint8Array(bits))}`; } async function passwordMatches(password: string, stored: string) { const [scheme, salt, expected] = stored.split("$"); if (scheme !== "pbkdf2" || !salt || !expected) return false; const actual = await passwordHash(password, salt); const actualHash = actual.split("$")[2]; if (actualHash.length !== expected.length) return false; let difference = 0; for (let i = 0; i < actualHash.length; i++) difference |= actualHash.charCodeAt(i) ^ expected.charCodeAt(i); return difference === 0; } async function first(env: Env, sql: string, ...args: unknown[]) { return env.DB.prepare(sql).bind(...args).first(); } async function all(env: Env, sql: string, ...args: unknown[]) { const result = await env.DB.prepare(sql).bind(...args).all(); return result.results; } async function run(env: Env, sql: string, ...args: unknown[]) { return env.DB.prepare(sql).bind(...args).run(); } async function dogForToken(env: Env, request: Request): Promise { const header = request.headers.get("authorization") || ""; if (!header.startsWith("Bearer ")) return null; return (await first(env, "SELECT d.* FROM sessions s JOIN dogs d ON d.id = s.dogId WHERE s.token = ? AND s.expiresAt > ?", header.slice(7), now())) ?? null; } async function session(env: Env, dogId: number) { const token = randomHex(32); const createdAt = now(); const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString(); await run(env, "INSERT INTO sessions (token, dogId, createdAt, expiresAt) VALUES (?, ?, ?, ?)", token, dogId, createdAt, expiresAt); return token; } async function requireDog(env: Env, request: Request) { return dogForToken(env, request); } const DOG_SELECT = `SELECT d.*, (SELECT COUNT(*) FROM follows f WHERE f.followeeId = d.id) AS followerCount, (SELECT COUNT(*) FROM follows f WHERE f.followerId = d.id) AS followingCount, (SELECT COUNT(*) FROM posts p WHERE p.dogId = d.id) AS postCount, EXISTS(SELECT 1 FROM follows f WHERE f.followerId = ? AND f.followeeId = d.id) AS isFollowing FROM dogs d`; async function park(env: Env, parkId: number) { return first<{ id: number; name: string; address: string | null; createdAt: string }>(env, "SELECT id, name, address, createdAt FROM parks WHERE id = ?", parkId); } async function publicDog(env: Env, row: DbRow) { const favoriteParkId = row.favoriteParkId as number | null; return { id: row.id, name: row.name, breed: row.breed, age: row.age, personality: row.personality, photoId: row.photoId, favoriteParkId, favoritePark: favoriteParkId == null ? null : await park(env, favoriteParkId), createdAt: row.createdAt, followerCount: Number(row.followerCount ?? 0), followingCount: Number(row.followingCount ?? 0), postCount: Number(row.postCount ?? 0), isFollowing: Boolean(row.isFollowing), }; } async function loadDog(env: Env, dogId: number, viewerId: number | null) { const row = await first(env, `${DOG_SELECT} WHERE d.id = ?`, viewerId ?? -1, dogId); return row ? publicDog(env, row) : null; } async function loadPost(env: Env, postId: number, viewerId: number | null) { const row = await first(env, `${POST_SELECT} WHERE p.id = ?`, viewerId ?? -1, postId); return row ? publicPost(row) : null; } const POST_SELECT = `SELECT p.id, p.dogId, p.text, p.photoId, p.createdAt, d.name AS authorName, d.photoId AS authorPhotoId, (SELECT COUNT(*) FROM likes l WHERE l.postId = p.id) AS likeCount, (SELECT COUNT(*) FROM comments c WHERE c.postId = p.id) AS commentCount, EXISTS(SELECT 1 FROM likes l WHERE l.postId = p.id AND l.dogId = ?) AS likedByMe FROM posts p JOIN dogs d ON d.id = p.dogId`; function publicPost(row: DbRow) { return { id: row.id, dogId: row.dogId, text: row.text, photoId: row.photoId, createdAt: row.createdAt, author: { id: row.dogId, name: row.authorName, photoId: row.authorPhotoId }, likeCount: Number(row.likeCount), commentCount: Number(row.commentCount), likedByMe: Boolean(row.likedByMe), }; } function publicComment(row: DbRow) { return { id: row.id, postId: row.postId, dogId: row.dogId, text: row.text, createdAt: row.createdAt, author: { id: row.dogId, name: row.authorName, photoId: row.authorPhotoId }, }; } async function playdates(env: Env, dogId: number) { const rows = await all(env, `SELECT pd.id, pd.hostId, pd.guestId, pd.parkId, pd.dateTime, pd.title, pd.note, pd.status, pd.createdAt, d.name AS hostName, d.photoId AS hostPhotoId, g.name AS guestName, g.photoId AS guestPhotoId, pk.name AS parkName, pk.address AS parkAddress FROM playdates pd JOIN dogs d ON d.id = pd.hostId JOIN dogs g ON g.id = pd.guestId LEFT JOIN parks pk ON pk.id = pd.parkId WHERE pd.hostId = ? OR pd.guestId = ? ORDER BY pd.dateTime ASC, pd.id ASC`, dogId, dogId); return rows.map(row => ({ id: row.id, host: { id: row.hostId, name: row.hostName, photoId: row.hostPhotoId }, guest: { id: row.guestId, name: row.guestName, photoId: row.guestPhotoId }, park: row.parkId == null ? null : { id: row.parkId, name: row.parkName ?? "Unknown park", address: row.parkAddress, createdAt: "" }, when: row.dateTime, title: row.title, note: row.note, status: row.status, createdAt: row.createdAt, })); } async function body(request: Request) { try { return await request.json() as Record; } catch { return {}; } } async function handleApi(request: Request, env: Env): Promise { const { pathname } = new URL(request.url); const method = request.method; if (method === "OPTIONS") return new Response(null, { status: 204, headers: { ...cors(request), "access-control-allow-methods": "GET,POST,PATCH,DELETE,OPTIONS", "access-control-allow-headers": "Authorization,Content-Type", "access-control-max-age": "86400" } }); if (pathname === "/api/health" && method === "GET") return reply(request, { ok: true }); if (pathname === "/api/auth/register" && method === "POST") { const value = await body(request); const name = str(value.name); const email = str(value.email).toLowerCase(); const password = typeof value.password === "string" ? value.password : ""; if (!name) return fail(request, 400, "Name is required"); if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return fail(request, 400, "A valid email is required"); if (password.length < 6) return fail(request, 400, "Password must be at least 6 characters"); if (await first(env, "SELECT id FROM dogs WHERE email = ?", email)) return fail(request, 409, "That email is already registered"); const created = await run(env, "INSERT INTO dogs (name, email, passwordHash, createdAt) VALUES (?, ?, ?, ?)", name, email, await passwordHash(password), now()); const dogId = Number(created.meta.last_row_id); const token = await session(env, dogId); return reply(request, { token, dog: await loadDog(env, dogId, dogId) }, 201); } if (pathname === "/api/auth/login" && method === "POST") { const value = await body(request); const email = str(value.email).toLowerCase(); const password = typeof value.password === "string" ? value.password : ""; const dog = await first(env, "SELECT * FROM dogs WHERE email = ?", email); if (!dog || !(await passwordMatches(password, dog.passwordHash))) return fail(request, 401, "Invalid email or password"); const token = await session(env, dog.id); return reply(request, { token, dog: await loadDog(env, dog.id, dog.id) }); } if (pathname === "/api/auth/logout" && method === "POST") { const dog = await requireDog(env, request); if (!dog) return fail(request, 401, "Authentication required"); await run(env, "DELETE FROM sessions WHERE token = ?", request.headers.get("authorization")!.slice(7)); return reply(request, { ok: true }); } if (pathname === "/api/auth/me" && method === "GET") { const dog = await requireDog(env, request); if (!dog) return fail(request, 401, "Authentication required"); const publicValue = await loadDog(env, dog.id, dog.id); return reply(request, { dog: { ...publicValue, email: dog.email } }); } if (pathname === "/api/dogs" && method === "GET") { const viewer = await dogForToken(env, request); const q = new URL(request.url).searchParams.get("q")?.trim() ?? ""; const rows = await all(env, `${DOG_SELECT} WHERE (? = '' OR d.name LIKE ? COLLATE NOCASE) ORDER BY d.name COLLATE NOCASE`, viewer?.id ?? -1, q, `%${q}%`); return reply(request, { dogs: await Promise.all(rows.map(row => publicDog(env, row))) }); } const dogRoute = /^\/api\/dogs\/(\d+)(?:\/(posts|follow))?$/.exec(pathname); if (dogRoute) { const dogId = id(dogRoute[1])!; const action = dogRoute[2]; const viewer = await dogForToken(env, request); if (!action && method === "GET") { const dog = await loadDog(env, dogId, viewer?.id ?? null); return dog ? reply(request, { dog }) : fail(request, 404, "Dog not found"); } if (action === "posts" && method === "GET") { const rows = await all(env, `${POST_SELECT} WHERE p.dogId = ? ORDER BY p.createdAt DESC, p.id DESC LIMIT ?`, viewer?.id ?? -1, dogId, 60); return reply(request, { posts: rows.map(publicPost) }); } if (!action && method === "PATCH") { const auth = await requireDog(env, request); if (!auth) return fail(request, 401, "Authentication required"); if (auth.id !== dogId) return fail(request, 403, "You can only edit your own profile"); const value = await body(request); const name = str(value.name); const breed = str(value.breed) || null; const personality = str(value.personality) || null; const age = value.age == null || value.age === "" ? null : Number(value.age); const photoId = value.photoId == null ? null : Number(value.photoId); const favoriteParkId = value.favoriteParkId == null ? null : Number(value.favoriteParkId); if (!name) return fail(request, 400, "Name is required"); if (age != null && (!Number.isInteger(age) || age < 0 || age > 40)) return fail(request, 400, "Invalid age"); if (photoId != null && !(await first(env, "SELECT id FROM photos WHERE id = ?", photoId))) return fail(request, 400, "Invalid photo"); if (favoriteParkId != null && !(await first(env, "SELECT id FROM parks WHERE id = ?", favoriteParkId))) return fail(request, 400, "Invalid park"); await run(env, "UPDATE dogs SET name = ?, breed = ?, age = ?, personality = ?, photoId = ?, favoriteParkId = ? WHERE id = ?", name, breed, age, personality, photoId, favoriteParkId, dogId); return reply(request, { dog: await loadDog(env, dogId, dogId) }); } if (action === "follow" && (method === "POST" || method === "DELETE")) { const auth = await requireDog(env, request); if (!auth) return fail(request, 401, "Authentication required"); if (method === "POST") { if (auth.id === dogId) return fail(request, 400, "You cannot follow yourself"); if (!(await first(env, "SELECT id FROM dogs WHERE id = ?", dogId))) return fail(request, 404, "Dog not found"); await run(env, "INSERT OR IGNORE INTO follows (followerId, followeeId, createdAt) VALUES (?, ?, ?)", auth.id, dogId, now()); return reply(request, { ok: true, following: true }); } await run(env, "DELETE FROM follows WHERE followerId = ? AND followeeId = ?", auth.id, dogId); return reply(request, { ok: true, following: false }); } } if (pathname === "/api/posts/feed" && method === "GET") { const auth = await requireDog(env, request); if (!auth) return fail(request, 401, "Authentication required"); const rows = await all(env, `${POST_SELECT} WHERE p.dogId = ? OR EXISTS(SELECT 1 FROM follows f WHERE f.followerId = ? AND f.followeeId = p.dogId) ORDER BY p.createdAt DESC, p.id DESC LIMIT ?`, auth.id, auth.id, auth.id, 60); return reply(request, { posts: rows.map(publicPost) }); } if (pathname === "/api/posts" && method === "POST") { const auth = await requireDog(env, request); if (!auth) return fail(request, 401, "Authentication required"); const value = await body(request); const text = str(value.text); const photoId = value.photoId == null ? null : Number(value.photoId); if (text.length > 2000) return fail(request, 400, "Post is too long"); if (!text && photoId == null) return fail(request, 400, "Add some text or a photo"); if (photoId != null && !(await first(env, "SELECT id FROM photos WHERE id = ?", photoId))) return fail(request, 400, "Invalid photo"); const created = await run(env, "INSERT INTO posts (dogId, text, photoId, createdAt) VALUES (?, ?, ?, ?)", auth.id, text, photoId, now()); return reply(request, { post: await loadPost(env, Number(created.meta.last_row_id), auth.id) }, 201); } const postRoute = /^\/api\/posts\/(\d+)(?:\/(like|comments)(?:\/(\d+))?)?$/.exec(pathname); if (postRoute) { const postId = id(postRoute[1])!; const action = postRoute[2]; const commentId = id(postRoute[3]); const auth = await requireDog(env, request); if (!auth) return fail(request, 401, "Authentication required"); if (!action && method === "DELETE") { const post = await first<{ dogId: number; photoId: number | null }>(env, "SELECT dogId, photoId FROM posts WHERE id = ?", postId); if (!post) return fail(request, 404, "Post not found"); if (post.dogId !== auth.id) return fail(request, 403, "Only the author can delete this post"); await run(env, "DELETE FROM posts WHERE id = ?", postId); if (post.photoId != null) { const references = await first<{ n: number }>(env, "SELECT (SELECT COUNT(*) FROM posts WHERE photoId = ?) + (SELECT COUNT(*) FROM dogs WHERE photoId = ?) AS n", post.photoId, post.photoId); if (references?.n === 0) { const photo = await first<{ objectKey: string }>(env, "SELECT objectKey FROM photos WHERE id = ?", post.photoId); await run(env, "DELETE FROM photos WHERE id = ?", post.photoId); if (photo) await env.PHOTOS.delete(photo.objectKey); } } return reply(request, { ok: true }); } if (action === "like" && (method === "POST" || method === "DELETE")) { if (method === "POST") { if (!(await first(env, "SELECT id FROM posts WHERE id = ?", postId))) return fail(request, 404, "Post not found"); await run(env, "INSERT OR IGNORE INTO likes (dogId, postId, createdAt) VALUES (?, ?, ?)", auth.id, postId, now()); } else await run(env, "DELETE FROM likes WHERE dogId = ? AND postId = ?", auth.id, postId); const count = await first<{ n: number }>(env, "SELECT COUNT(*) AS n FROM likes WHERE postId = ?", postId); return reply(request, { liked: method === "POST", likeCount: count?.n ?? 0 }); } if (action === "comments" && !commentId && method === "GET") { if (!(await first(env, "SELECT id FROM posts WHERE id = ?", postId))) return fail(request, 404, "Post not found"); const rows = await all(env, "SELECT c.id, c.postId, c.dogId, c.text, c.createdAt, d.name AS authorName, d.photoId AS authorPhotoId FROM comments c JOIN dogs d ON d.id = c.dogId WHERE c.postId = ? ORDER BY c.createdAt ASC, c.id ASC", postId); return reply(request, { comments: rows.map(publicComment) }); } if (action === "comments" && !commentId && method === "POST") { const text = str((await body(request)).text); if (!(await first(env, "SELECT id FROM posts WHERE id = ?", postId))) return fail(request, 404, "Post not found"); if (!text || text.length > 500) return fail(request, 400, "Comment must be 1-500 characters"); const created = await run(env, "INSERT INTO comments (postId, dogId, text, createdAt) VALUES (?, ?, ?, ?)", postId, auth.id, text, now()); const comment = await first(env, "SELECT c.id, c.postId, c.dogId, c.text, c.createdAt, d.name AS authorName, d.photoId AS authorPhotoId FROM comments c JOIN dogs d ON d.id = c.dogId WHERE c.id = ?", Number(created.meta.last_row_id)); return reply(request, { comment: publicComment(comment!) }, 201); } if (action === "comments" && commentId && method === "DELETE") { const comment = await first<{ dogId: number }>(env, "SELECT dogId FROM comments WHERE id = ?", commentId); if (!comment) return fail(request, 404, "Comment not found"); if (comment.dogId !== auth.id) return fail(request, 403, "Only the author can delete this comment"); await run(env, "DELETE FROM comments WHERE id = ?", commentId); return reply(request, { ok: true }); } } if (pathname === "/api/photos" && method === "POST") { const auth = await requireDog(env, request); if (!auth) return fail(request, 401, "Authentication required"); const value = await body(request); let mime = str(value.mime); let encoded = str(value.data); const dataUrl = /^data:([^;,]+);base64,(.+)$/s.exec(encoded); if (dataUrl) { mime = dataUrl[1]; encoded = dataUrl[2]; } if (!photoTypes.has(mime)) return fail(request, 400, "Photo must be a JPEG, PNG, GIF, or WebP image"); let binary: Uint8Array; try { binary = Uint8Array.from(atob(encoded), byte => byte.charCodeAt(0)); } catch { return fail(request, 400, "Invalid image data"); } if (!binary.byteLength) return fail(request, 400, "Empty image data"); if (binary.byteLength > 8 * 1024 * 1024) return fail(request, 400, "Photo is too large (max 8 MB)"); const objectKey = `photos/${randomHex(24)}`; await env.PHOTOS.put(objectKey, binary, { httpMetadata: { contentType: mime, cacheControl: "public, max-age=86400" } }); const created = await run(env, "INSERT INTO photos (mime, objectKey, createdAt) VALUES (?, ?, ?)", mime, objectKey, now()); return reply(request, { photoId: Number(created.meta.last_row_id) }, 201); } const photoRoute = /^\/api\/photos\/(\d+)$/.exec(pathname); if (photoRoute && method === "GET") { const photo = await first<{ mime: string; objectKey: string }>(env, "SELECT mime, objectKey FROM photos WHERE id = ?", id(photoRoute[1])); if (!photo) return fail(request, 404, "Photo not found"); const object = await env.PHOTOS.get(photo.objectKey); if (!object) return fail(request, 404, "Photo not found"); const headers = new Headers(cors(request)); object.writeHttpMetadata(headers); headers.set("etag", object.httpEtag); headers.set("cache-control", "public, max-age=86400"); return new Response(object.body, { headers }); } if (pathname === "/api/parks" && method === "GET") return reply(request, { parks: await all(env, "SELECT id, name, address, createdAt FROM parks ORDER BY name COLLATE NOCASE") }); if (pathname === "/api/parks" && method === "POST") { const auth = await requireDog(env, request); if (!auth) return fail(request, 401, "Authentication required"); const value = await body(request); const name = str(value.name); const address = str(value.address) || null; if (!name) return fail(request, 400, "Park name is required"); const created = await run(env, "INSERT INTO parks (name, address, createdAt) VALUES (?, ?, ?)", name, address, now()); return reply(request, { park: await park(env, Number(created.meta.last_row_id)) }, 201); } if (pathname === "/api/playdates" && method === "GET") { const auth = await requireDog(env, request); return auth ? reply(request, { playdates: await playdates(env, auth.id) }) : fail(request, 401, "Authentication required"); } if (pathname === "/api/playdates" && method === "POST") { const auth = await requireDog(env, request); if (!auth) return fail(request, 401, "Authentication required"); const value = await body(request); const guestId = Number(value.guestId); const parkId = value.parkId == null ? null : Number(value.parkId); const when = str(value.when); const title = str(value.title); const note = str(value.note); const date = new Date(when); if (!Number.isInteger(guestId)) return fail(request, 400, "Choose a guest"); if (guestId === auth.id) return fail(request, 400, "You cannot invite yourself"); if (!(await first(env, "SELECT id FROM dogs WHERE id = ?", guestId))) return fail(request, 404, "Guest not found"); if (parkId != null && !(await first(env, "SELECT id FROM parks WHERE id = ?", parkId))) return fail(request, 400, "Invalid park"); if (Number.isNaN(date.getTime())) return fail(request, 400, "Invalid date/time"); if (title.length > 80) return fail(request, 400, "Title too long"); if (note.length > 500) return fail(request, 400, "Note too long"); const created = await run(env, "INSERT INTO playdates (hostId, guestId, parkId, dateTime, title, note, status, createdAt) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?)", auth.id, guestId, parkId, date.toISOString(), title, note, now()); const result = (await playdates(env, auth.id)).find(item => item.id === Number(created.meta.last_row_id)); return reply(request, { playdate: result }, 201); } const playdateRoute = /^\/api\/playdates\/(\d+)(?:\/respond)?$/.exec(pathname); if (playdateRoute) { const auth = await requireDog(env, request); if (!auth) return fail(request, 401, "Authentication required"); const playdateId = id(playdateRoute[1])!; if (pathname.endsWith("/respond") && method === "POST") { const row = await first<{ guestId: number; status: string }>(env, "SELECT guestId, status FROM playdates WHERE id = ?", playdateId); if (!row) return fail(request, 404, "Playdate not found"); if (row.guestId !== auth.id) return fail(request, 403, "Only the guest can respond"); if (row.status !== "pending") return fail(request, 400, "This playdate has already been answered"); await run(env, "UPDATE playdates SET status = ? WHERE id = ?", Boolean((await body(request)).accept) ? "accepted" : "declined", playdateId); return reply(request, { playdate: (await playdates(env, auth.id)).find(item => item.id === playdateId) }); } if (!pathname.endsWith("/respond") && method === "DELETE") { const row = await first<{ hostId: number }>(env, "SELECT hostId FROM playdates WHERE id = ?", playdateId); if (!row) return fail(request, 404, "Playdate not found"); if (row.hostId !== auth.id) return fail(request, 403, "Only the host can cancel this playdate"); await run(env, "UPDATE playdates SET status = 'cancelled' WHERE id = ?", playdateId); return reply(request, { ok: true }); } } return fail(request, 404, "Not found"); } export default { fetch: (request: Request, env: Env) => handleApi(request, env) } satisfies ExportedHandler;