dashcaddy/status/build.js

const fs = require('fs');
const path = require('path');
const crypto = require('crypto');
const esbuild = require('esbuild');

// DC-119: single source of truth for the CRLF->LF normalization applied to
// every source read before minification (see the long comment in build()).
// Exported so tests/build-determinism.test.js pins THE ACTUAL regex, not a
// re-implementation that would silently drift if this one changes.
const normalizeSource = (s) => s.replace(/\r\n/g, '\n');

const JS = (...parts) => path.join(__dirname, 'js', ...parts);
const DIST = path.join(__dirname, 'dist');
const INDEX_HTML = path.join(__dirname, 'index.html');
const SW_JS = path.join(__dirname, 'sw.js');

// Bundle definitions — files are concatenated in order, then minified
const bundles = {
  'core.js': [
    // error-handler.js MUST be first — globals.js below does
    // `const errorHandler = new ErrorHandler()` at top level, which throws
    // ReferenceError if the ErrorHandler class isn't already on `window`.
    JS('error-handler.js'),
    JS('globals.js'),
    JS('skeleton-loader.js'),
    JS('theme.js'),
    // DC-049: pluggable auth gate — claims ownership of the
    // ?auth=required flow by setting window.__dc_049_handled BEFORE
    // totp-auth.js runs, so the legacy TOTP-only overlay doesn't flicker
    // in for multi-provider installs. Single-provider TOTP-only installs
    // work because this module delegates back to window._showTotpOverlay().
    JS('auth-gate.js'),
    JS('totp-auth.js'),
    // totp-recovery.js registers window._refreshRecoveryLink which totp-auth.js
    // calls from showTotpOverlay(). Must come after totp-auth.js.
    JS('totp-recovery.js'),
    JS('credential-vault-handoff.js'),
    JS('service-credentials.js'),
    JS('totp-settings.js'),
    // DC-048 admin panel — modal-overlay UI for user/invite management.
    // Renders the "Admin" trigger button into the top bar; only visible
    // when /api/v1/auth/me returns isAdmin=true.
    JS('admin.js'),
    JS('core', 'credentials.js'),
    JS('core', 'grid.js'),
    JS('core', 'dns.js'),
    JS('core', 'logs.js'),
    JS('core', 'service-modals.js'),
    JS('core', 'service-infrastructure.js'),
    JS('core', 'service-crud.js'),
    JS('core', 'service-create.js'),
    JS('live-events.js'),
    JS('service-filter.js'),
    JS('batch-operations.js'),
  ],
  'features.js': [
    JS('logo-customization.js'),
    JS('setup-wizard.js'),
    JS('app-selector.js'),
    JS('recipes.js'),
    JS('import-export.js'),
    JS('error-logs.js'),
    JS('container-logs.js'),
    // DC-055: Host journald log viewer — reads /var/log/journal via the
    // bind-mount added in start.sh. Self-contained modal with SSE stream
    // + bounded tail read. Exposes window.openJournaldModal().
    JS('journald.js'),
    JS('snapshot.js'),
    JS('smart-arr-connect.js'),
    JS('notification-settings.js'),
    JS('panel-tabs.js'),
    JS('backup-restore.js'),
    JS('resource-monitor.js'),
    JS('health-check.js'),
    JS('update-management.js'),
    JS('docker-resources.js'),
    JS('compose-import.js'),
    JS('container-exec.js'),
    JS('audit-log.js'),
    JS('security-center.js'),
    JS('weather.js'),
    JS('clock.js'),
    JS('card-badges.js'),
    JS('theme-builder.js'),
    JS('license.js'),
    // DC-058: Share modal — opened from the share button on each service card.
    // Must come after license.js because it uses window.openShareModal and
    // window.wireModal + window.injectModal + window.escapeHtml helpers
    // defined in globals.js (already in core.js).
    JS('share-modal.js'),
  ],
  'onboarding.js': [
    JS('driver.min.js'),
    // error-handler.js moved to core.js bundle; window.ErrorHandler is already
    // set before this bundle runs.
    JS('progress-tracker.js'),
    JS('theme-adapter.js'),
    JS('tooltip-definitions.js'),
    JS('dns-template-selector.js'),
    JS('tour-manager.js'),
    JS('onboarding.js'),
  ],
  'init.js': [
    JS('core', 'init.js'),
    JS('monitoring-widgets.js'),
    JS('keyboard-shortcuts.js'),
  ],
};

function updateInlineScriptCspHash() {
  const html = fs.readFileSync(INDEX_HTML, 'utf8');
  // The hash MUST match what the browser computes from the served bytes.
  // git's text normalization + tar transport strip CRLF on the Linux side,
  // so the deployed file is always LF-only — even when the dev copy is CRLF
  // (e.g. cloned on Windows). Normalize before hashing so a Windows-built
  // index.html produces a CSP allowlist that matches the served LF version.
  const normalized = html.replace(/\r\n/g, '\n');
  const scripts = [...normalized.matchAll(/<script>([\s\S]*?)<\/script>/g)];
  const target = scripts.find(match => {
    const block = match[1] || '';
    return block.includes("license-topbar-version") || block.includes("openVersionInfo") || block.includes("widget-");
  });

  if (!target) {
    throw new Error('Could not find inline dashboard bootstrap script in index.html');
  }

  const scriptContent = target[1];
  const hash = crypto.createHash('sha256').update(scriptContent).digest('base64');
  // Write the CSP update back into the original (possibly CRLF) file so we
  // don't churn the working copy's line endings just because we read it.
  const updatedHtml = html.replace(
    /script-src 'self' 'sha256-[^']+';/,
    `script-src 'self' 'sha256-${hash}';`
  );

  if (updatedHtml !== html) {
    fs.writeFileSync(INDEX_HTML, updatedHtml);
  }

  return hash;
}

async function build() {
  // Ensure dist/ exists
  if (!fs.existsSync(DIST)) fs.mkdirSync(DIST);

  const results = {};

  for (const [outName, files] of Object.entries(bundles)) {
    // Read and concatenate
    const parts = [];
    for (const file of files) {
      if (!fs.existsSync(file)) {
        console.warn(`  WARN: ${path.relative(__dirname, file)} not found, skipping`);
        continue;
      }
      // DC-119: normalize CRLF -> LF before minifying. Root cause (verified
      // empirically with esbuild 0.25.12 probes): the production transform
      // uses sourcemap:'both', which base64-embeds the RAW source bytes as
      // sourcesContent in the inline map — CR bytes survive into dist, so a
      // CRLF working copy (Windows dev tree, core.autocrlf=true) and an LF
      // checkout (DNS2) of the same commit produce different dist bytes and
      // a different sw.js cache tag. With this normalization both are
      // byte-identical (sha256-verified). Before it, every Linux rebuild of
      // a Windows-committed bundle showed phantom drift on `git pull` in
      // /opt/dashcaddy (the recurring "pre-pull drift" stashes — note those
      // also contained minified-identifier renames, a second vector from
      // esbuild version drift across the ^0.25.0 caret range, already
      // pinned by package-lock.json).
      parts.push(normalizeSource(fs.readFileSync(file, 'utf8')));
    }
    const concatenated = parts.join(';\n');

    // Minify with esbuild (safe to re-minify already-minified code like driver.min.js)
    // DC-072: sourcemap='both' emits inline + external .map for production debugging
    const { code, map } = await esbuild.transform(concatenated, {
      minify: true,
      target: 'es2020',
      sourcemap: 'both',
    });

    const outPath = path.join(DIST, outName);
    fs.writeFileSync(outPath, code);
    if (map) {
      fs.writeFileSync(outPath + '.map', map);
    }

    const rawSize = (Buffer.byteLength(concatenated) / 1024).toFixed(1);
    const minSize = (Buffer.byteLength(code) / 1024).toFixed(1);
    results[outName] = { rawSize, minSize, fileCount: files.length };
  }

  const cspHash = updateInlineScriptCspHash();
  const cacheTag = updateServiceWorkerCache();

  // Summary
  console.log('\n  DashCaddy Frontend Build\n');
  console.log('  Bundle            Files    Raw      Min');
  console.log('  ─────────────────────────────────────────');
  let totalRaw = 0, totalMin = 0;
  for (const [name, r] of Object.entries(results)) {
    console.log(`  ${name.padEnd(18)} ${String(r.fileCount).padStart(3)}   ${r.rawSize.padStart(6)} KB  ${r.minSize.padStart(6)} KB`);
    totalRaw += parseFloat(r.rawSize);
    totalMin += parseFloat(r.minSize);
  }
  console.log('  ─────────────────────────────────────────');
  console.log(`  ${'Total'.padEnd(18)}      ${totalRaw.toFixed(1).padStart(6)} KB  ${totalMin.toFixed(1).padStart(6)} KB`);
  console.log(`\n  Output: ${DIST}`);
  console.log(`  CSP Hash: sha256-${cspHash}`);
  console.log(`  SW Cache: dashcaddy-shell-${cacheTag}\n`);
}

// Rewrites the CACHE constant in sw.js to a tag derived from the bundle
// contents. Every change in dist/ produces a new cache name; on next load
// the SW's activate handler wipes all older caches, so users never get
// stuck on stale precached bundles after a release.
function updateServiceWorkerCache() {
  // DC-119: normalize on read — same rationale as the bundle sources above.
  // A CRLF sw.js would otherwise keep its CR bytes through the regex
  // replace, so the written sw.js (and its committed bytes) would differ
  // per-platform even with an identical cache tag.
  const sw = normalizeSource(fs.readFileSync(SW_JS, 'utf8'));
  const hash = crypto.createHash('sha256');
  for (const name of Object.keys(bundles)) {
    hash.update(fs.readFileSync(path.join(DIST, name)));
  }
  const tag = hash.digest('hex').slice(0, 10);
  const updated = sw.replace(
    /const CACHE = 'dashcaddy-shell-[^']+';/,
    `const CACHE = 'dashcaddy-shell-${tag}';`
  );
  if (updated !== sw) {
    fs.writeFileSync(SW_JS, updated);
  }
  return tag;
}

// Watch mode
// DC-119: only auto-run when invoked directly (`node build.js`). Requiring
// build.js as a module (as tests/build-determinism.test.js does, to pin the
// normalizeSource regex) must NOT trigger a full dist rebuild.
if (require.main === module) {
  if (process.argv.includes('--watch')) {
    console.log('  Watching for changes...\n');
    build();

    const jsDir = path.join(__dirname, 'js');
    let debounce = null;
    fs.watch(jsDir, { recursive: true }, (event, filename) => {
      if (!filename || !filename.endsWith('.js')) return;
      clearTimeout(debounce);
      debounce = setTimeout(() => {
        console.log(`  Changed: ${filename}`);
        build();
      }, 200);
    });
  } else {
    build();
  }
}

// DC-119: export for tests (normalizeSource is pinned by
// tests/build-determinism.test.js). build/bundles stay internal.
module.exports = { normalizeSource };