Routes (additiv unter /api/v1/marketplace/*): - POST/GET /authors/me — eigenes Author-Profil anlegen/updaten/lesen - GET /authors/:slug — public Profile-Lookup (banned-reason gestrippt) - POST /decks — Deck-Init (Slug-Validation + Pflicht-Author-Profil + CHECK auf paid + Pro-License) - POST /decks/:slug/publish — Versions-Snapshot mit per-Karte cardContentHash aus @cards/domain, per-Version-Hash, AI-Mod-Stub-Log, atomarer latest_version_id-Bump in Drizzle-Transaction - PATCH /decks/:slug — Metadaten-Update (Owner-Only) - GET /decks/:slug — Public-Detail mit optional-auth-Middleware Geport aus cards-decommission-base:services/cards-server/, mit Greenfield-Anpassungen: - Hashing über @cards/domain.cardContentHash (gemeinsame SoT zwischen privatem cards.cards und marketplace.deck_cards), per- Version-Hash als SHA-256 über sortierte Karten-Hashes mit Ord-Prefix - AI-Moderation als R2-Stub (pass+rationale+model='stub'), echte mana-llm-Anbindung in späterer Welle - Auth-Middleware-Shape an Greenfield (userId/tier/authMode in c.get(...) statt user-Object), optional-auth als Schwester für anonymen Public-Read - Hono-typing: outer Marketplace-Decks-Router ist Partial<AuthVars> weil Public-GET kein JWT braucht; Auth-Subroute ist strict Lese-Referenz: - 3331 LOC altes cards-server-Code (routes, services, middleware, lib) unter docs/marketplace/archive/code/ archiviert. Read-only, nicht im Build-Path. Verifikation: - 16 neue Vitest-Tests (Slug + Version-Hash), 72 gesamt grün - type-check 0 errors - E2E-Smoke gegen lokale cards-api: Cardecky-Author + Deck r2-stoische-ethik mit 3 Karten v1.0.0 (basic + basic + cloze), per-Karten-Hashes geschrieben, ai_moderation_log-Row da, semver-409 + paid-422-Errors verifiziert. Smoke-Daten danach aufgeräumt. Verbleibend für R3+: Discovery (explore + search), Engagement (stars/ subscribe/fork), Smart-Merge mit FSRS-State-Erhalt; danach R4 PRs + Card-Discussions, R5 Frontend-Routes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
44 lines
1.6 KiB
TypeScript
44 lines
1.6 KiB
TypeScript
/**
|
|
* Content hashing — SHA-256 over canonicalized payloads. Drives:
|
|
* - per-card `content_hash` (smart-merge across version bumps)
|
|
* - per-version `content_hash` (cache + dedup detection)
|
|
*
|
|
* Canonicalization sorts object keys recursively so `{a:1,b:2}` and
|
|
* `{b:2,a:1}` produce identical hashes. Without that, equivalent
|
|
* payloads from different clients would diverge. Numbers/booleans
|
|
* stringify naturally; strings are passed through verbatim.
|
|
*/
|
|
|
|
import { createHash } from 'node:crypto';
|
|
|
|
function canonical(value: unknown): unknown {
|
|
if (value === null || typeof value !== 'object') return value;
|
|
if (Array.isArray(value)) return value.map(canonical);
|
|
const sorted: Record<string, unknown> = {};
|
|
for (const key of Object.keys(value as Record<string, unknown>).sort()) {
|
|
sorted[key] = canonical((value as Record<string, unknown>)[key]);
|
|
}
|
|
return sorted;
|
|
}
|
|
|
|
function sha256(input: string): string {
|
|
return createHash('sha256').update(input).digest('hex');
|
|
}
|
|
|
|
/** Hash for a single card — based on (type, fields). */
|
|
export function hashCard(card: { type: string; fields: Record<string, string> }): string {
|
|
return sha256(JSON.stringify(canonical({ type: card.type, fields: card.fields })));
|
|
}
|
|
|
|
/**
|
|
* Hash for an ordered list of cards — version content hash. Order
|
|
* matters because re-ordering is a meaningful change for the learner.
|
|
*/
|
|
export function hashVersionCards(
|
|
cards: { type: string; fields: Record<string, string>; ord: number }[]
|
|
): string {
|
|
const ordered = [...cards].sort((a, b) => a.ord - b.ord);
|
|
return sha256(
|
|
JSON.stringify(ordered.map((c) => canonical({ type: c.type, fields: c.fields, ord: c.ord })))
|
|
);
|
|
}
|