remco/EpicNext-Cms
1
1 Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat: harden atoms-nexst against review findings (37 items)
Gitea Actions Runner Test / test-job (push) Successful in 2s
Details
CI / check (push) Successful in 30s
Details
CI / tests-integration (push) Successful in 1m42s
Details
CI / tests-unit (push) Failing after 1m49s
Details
CI / tests-ui (push) Successful in 2m31s
Details
CI / preflight (push) Skipped
Details
CI / deploy (push) Skipped
Details

Browse Source 
Second review pass covering security, performance, admin tooling and the
public/room flows. All HIGH and MEDIUM findings from the audit are resolved;
nothing in this commit changes the visible feature set.

Authentication & session security
- CSP is now set on the request headers in the proxy, which is what Next.js
  uses to derive the render nonce, so the nonce is effective.
- 2FA: an already-enabled user cannot re-enroll, the setup endpoint is
  rate-limited per account, and confirmed codes are persisted so the second
  secret no longer silently never applies.
- Password reset revokes the ticket, authTicket and all personal access
  tokens, and bumps the token version so existing sessions die. The same
  revocation is now wired into the staff-side password reset.
- /reset and /verify return a stable error code instead of raw text; the
  mail lookups are ordered by id so duplicates cannot vary between runs.
- Resending the verification mail gets a per-address cooldown on top of the
  per-user limit.
- Issue API tokens with the narrower radio/ticket ability set instead of "*".

Authorization & input handling
- Mid-rank staff can no longer keep dynamically granted non-view admin.*
  permissions: existing grants are revoked by migration and the grant lookup
  is restricted to "%.view". Rank guards use the dynamic super-admin check.
- Alerting a user is permission-checked and audited like the other tools.
- Material mutations (giveCredits/giveDuckets/giveDiamonds, the admin user
  actions route, bulk user actions) are capped and rank-guarded, and bulk
  ids are bounded.
- updateRoom / updateRoomItem write through a field allowlist, and items
  may only be edited through their own room.
- Classnames reaching the filesystem are validated before use so a crafted
  value cannot escape the asset directories.
- The word filter now also covers offline mails, guild forum threads and
  replies, and user mottos.
- Media uploads are validated by magic bytes, /api/media requires the page
  edit permission, APP_URL must be configured once mail is enabled, and the
  diagnostics error route checks the fetch site header.

Admin tooling
- Secret settings render masked and cannot be overwritten with a blank or
  an arbitrary raw key; radio credentials are new password inputs.
- Commandocentrum balance changes are audited.
- Admin list pagination reads the caller's per-page instead of the max, and
  the log exporter caps offset and search length.

Performance
- Catalog translations are cached per module, with a cheap revision hash;
  the public online count uses a stale window instead of hammering the DB.
- The cache warmup now primes the payload the home route actually reads.
- TopHeader batches its queries into one round trip, and LCP avatars load
  eagerly.
- motion/react and sonner are no longer part of the root layout; the nav
  dropdown and mobile nav panels are lazy client chunks. Anonymous visitors
  again get the navigation chrome, and public pages get an edge cacheable
  response.

Accessibility
- Nested <main> elements in phase pages became <section>; the page entrance
  and route progress animations are pure CSS that respect reduced motion.
This commit is contained in:
openhands committed 2026-10-09 16:19:48 +02:00
1 parent 3933214953
commit 6cc45d7413
150 files changed
+2137 -759
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/app/(site)/apply/staff/page.tsx
+2 -2
View File
@@ -110,7 +110,7 @@ export default async function ApplyStaffPage({
const appliedRankIds = new Set(myApps.map((a) => a.rankId));
return (
<main className="page-grid">
<section className="page-grid">
{submitted === "1" ? (
<div role="status" style={feedbackStyle("success")}>
{t("success.submitted")}
@@ -233,6 +233,6 @@ export default async function ApplyStaffPage({
})}
</div>
)}
</main>
</section>
);
}
src/app/(site)/apply/team/page.tsx
+2 -2
View File
@@ -89,7 +89,7 @@ export default async function ApplyTeamPage({
const appliedTeamIds = new Set(myApps.map((a) => a.rankId));
return (
<main className="page-grid">
<section className="page-grid">
{submitted === "1" ? (
<div role="status" style={feedbackStyle("success")}>
{t("success.submitted")}
@@ -199,6 +199,6 @@ export default async function ApplyTeamPage({
})}
</div>
)}
</main>
</section>
);
}
src/app/(site)/badges/page.tsx
+2 -2
View File
@@ -30,7 +30,7 @@ export default async function BadgesPage() {
.catch(() => []);
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="🏅" title={t("title")} subtitle={t("subtitle")} />
<ContentCard padded={badges.length === 0}>
@@ -76,6 +76,6 @@ export default async function BadgesPage() {
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/banned/page.tsx
+2 -2
View File
@@ -52,7 +52,7 @@ export default async function BannedPage() {
});
return (
<main style={{ maxWidth: 560, margin: "2rem auto" }}>
<section style={{ maxWidth: 560, margin: "2rem auto" }}>
<ContentCard icon="🚫" title={t("title")} subtitle={t("subtitle")}>
<p style={{ marginTop: 0 }}>{t("body")}</p>
{reason ? (
@@ -65,6 +65,6 @@ export default async function BannedPage() {
{t("contactStaff")}
</p>
</ContentCard>
</main>
</section>
);
}
src/app/(site)/community/page.tsx
+2 -2
View File
@@ -54,7 +54,7 @@ export default function CommunityPage() {
const t = useTranslations("pages.community");
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="🌍" title={t("title")} subtitle={t("subtitle")} />
<div className="card-grid sm-2 lg-3">
@@ -84,6 +84,6 @@ export default function CommunityPage() {
</Link>
))}
</div>
</main>
</section>
);
}
src/app/(site)/developers/page.tsx
+2 -2
View File
@@ -398,7 +398,7 @@ export default function DevelopersPage() {
const totalEndpoints = GROUPS.reduce((n, g) => n + g.endpoints.length, 0);
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard
icon="🧩"
title="Developer API"
@@ -479,6 +479,6 @@ export default function DevelopersPage() {
</div>
</ContentCard>
))}
</main>
</section>
);
}
src/app/(site)/draw-badge/page.tsx
+2 -2
View File
@@ -102,7 +102,7 @@ export default async function DrawBadgePage({
}
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard
icon="🎨"
title="Draw a Badge"
@@ -231,6 +231,6 @@ export default async function DrawBadgePage({
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/events/[slugOrId]/page.tsx
+2 -2
View File
@@ -142,7 +142,7 @@ export default async function EventDetailPage({
else if (isFull) disabledReason = t("eventFull");
return (
<main className="page-grid">
<section className="page-grid">
<p className="muted" style={{ margin: 0 }}>
<Link href="/events">{t("back")}</Link>
</p>
@@ -259,6 +259,6 @@ export default async function EventDetailPage({
</ul>
</ContentCard>
) : null}
</main>
</section>
);
}
src/app/(site)/events/page.tsx
+2 -2
View File
@@ -69,7 +69,7 @@ async function EventsPage({
const href = (page: number) =>
`/events?${new URLSearchParams({ status: result?.status ?? "all", week: result?.week ?? "", mine: params.mine ?? "", page: String(page) })}`;
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="📅" title={t("title")} subtitle={t("subtitle")} />
<ContentCard>
@@ -272,7 +272,7 @@ async function EventsPage({
</nav>
</ContentCard>
)}
</main>
</section>
);
}
src/app/(site)/forgot/page.tsx
+42 -5
View File
@@ -1,3 +1,4 @@
import type { Metadata } from "next";
import { headers } from "next/headers";
import { getTranslations } from "next-intl/server";
import { requestReset } from "@/actions/password-reset";
@@ -6,6 +7,15 @@ import Link from "@/components/link";
import { ContentCard } from "@/components/public/ui";
import { captchaConfig } from "@/lib/services/captcha";
export async function generateMetadata(): Promise<Metadata> {
const t = await getTranslations("pages.forgot");
return {
title: t("title"),
description: t("subtitle"),
robots: { index: false, follow: false },
};
}
export default async function ForgotPage({
searchParams,
}: {
@@ -17,12 +27,39 @@ export default async function ForgotPage({
const nonce = (await headers()).get("x-nonce") ?? undefined;
return (
<main style={{ maxWidth: 420, margin: "2rem auto" }}>
<section style={{ maxWidth: 420, margin: "2rem auto" }}>
<ContentCard icon="🔑" title={t("title")} subtitle={t("subtitle")}>
{sent ? (
<p className="muted" style={{ textAlign: "center", margin: 0 }}>
{t("sentNotice")}
</p>
<>
<p className="muted" style={{ textAlign: "center", margin: 0 }}>
{t("sentNotice")}
</p>
{/* A mail that never arrived must be retryable from here,
otherwise the visitor is stuck on a dead end. */}
<form
action={requestReset}
style={{ display: "grid", gap: "0.7rem", marginTop: "1rem" }}
>
<input
name="email"
type="email"
placeholder={t("emailPlaceholder")}
autoComplete="email"
required
/>
<CaptchaWidget
captcha={{
provider: cfg.provider,
siteKey: cfg.siteKey || undefined,
field: cfg.field || undefined,
}}
nonce={nonce}
/>
<button type="submit" className="btn btn-primary">
{t("sendAnotherLink")}
</button>
</form>
</>
) : (
<form
action={requestReset}
@@ -66,6 +103,6 @@ export default async function ForgotPage({
<Link href="/login">{t("backToLogin")}</Link>
</p>
</ContentCard>
</main>
</section>
);
}
src/app/(site)/friends/page.tsx
+2 -2
View File
@@ -102,7 +102,7 @@ export default async function FriendsPage({
: null;
return (
<main className="page-grid">
<section className="page-grid">
{removed === "1" ? (
<div role="status" style={feedbackStyle("success")}>
{t("success.removed")}
@@ -180,6 +180,6 @@ export default async function FriendsPage({
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/guilds/[id]/forum/[threadId]/page.tsx
+4 -4
View File
@@ -103,11 +103,11 @@ export default async function GuildForumThreadPage({
} catch (error) {
publicReadFailure("guild.thread")(error);
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard>
<PublicLoadError href={`/guilds/${guildId}/forum/${threadId}`} />
</ContentCard>
</main>
</section>
);
}
@@ -173,7 +173,7 @@ export default async function GuildForumThreadPage({
: null;
return (
<main className="page-grid">
<section className="page-grid">
{replied === "1" ? (
<div role="status" style={feedbackStyle("success")}>
{t("success.replied")}
@@ -317,6 +317,6 @@ export default async function GuildForumThreadPage({
{t("loginToReply")} <Link href="/login">{t("loginLink")}</Link>
</p>
)}
</main>
</section>
);
}
src/app/(site)/guilds/[id]/forum/new/page.tsx
+2 -2
View File
@@ -70,7 +70,7 @@ export default async function NewThreadPage({
: null;
return (
<main className="page-grid">
<section className="page-grid">
{errorMessage ? (
<div role="alert" style={feedbackStyle("error")}>
{errorMessage}
@@ -132,6 +132,6 @@ export default async function NewThreadPage({
</div>
</form>
</ContentCard>
</main>
</section>
);
}
src/app/(site)/guilds/[id]/forum/page.tsx
+4 -4
View File
@@ -67,11 +67,11 @@ export default async function GuildForumPage({
} catch (error) {
publicReadFailure("guild.forum")(error);
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard>
<PublicLoadError href={`/guilds/${guildId}/forum`} />
</ContentCard>
</main>
</section>
);
}
@@ -135,7 +135,7 @@ export default async function GuildForumPage({
const usernameById = new Map(users.map((u) => [u.id, u.username]));
return (
<main className="page-grid">
<section className="page-grid">
{posted === "1" ? (
<div role="status" style={feedbackStyle("success")}>
{t("success.posted")}
@@ -240,6 +240,6 @@ export default async function GuildForumPage({
</table>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/guilds/[id]/page.tsx
+4 -4
View File
@@ -55,11 +55,11 @@ export default async function GuildPage({
} catch (error) {
publicReadFailure("guild.detail")(error);
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard>
<PublicLoadError href={`/guilds/${guildId}`} />
</ContentCard>
</main>
</section>
);
}
@@ -139,7 +139,7 @@ export default async function GuildPage({
const created = formatDate(new Date(guild.dateCreated * 1000), "date");
return (
<main className="page-grid">
<section className="page-grid">
<p style={{ margin: 0 }}>
<Link href="/guilds">{t("allGuilds")}</Link>
</p>
@@ -251,6 +251,6 @@ export default async function GuildPage({
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/guilds/page.tsx
+2 -2
View File
@@ -50,7 +50,7 @@ export default async function GuildsPage() {
const guilds = await getGuilds();
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="🚪" title={t("title")} subtitle={t("subtitle")} />
<ContentCard padded={!guilds?.length}>
@@ -98,6 +98,6 @@ export default async function GuildsPage() {
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/help/[category]/page.tsx
+2 -2
View File
@@ -103,7 +103,7 @@ export default async function HelpCategoryPage({
const hasButton = Boolean(cat.buttonText && cat.buttonText.trim() !== "");
return (
<main className="page-grid">
<section className="page-grid">
<p style={{ margin: 0 }}>
<Link href="/help">{t("back")}</Link>
</p>
@@ -162,6 +162,6 @@ export default async function HelpCategoryPage({
</div>
</ContentCard>
) : null}
</main>
</section>
);
}
src/app/(site)/help/page.tsx
+2 -2
View File
@@ -127,7 +127,7 @@ export default async function HelpCenterPage() {
}
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard
icon="❓"
title={t("title")}
@@ -278,6 +278,6 @@ export default async function HelpCenterPage() {
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/help/tickets/[id]/page.tsx
+2 -2
View File
@@ -157,7 +157,7 @@ export default async function HelpTicketDetailPage({
];
return (
<main className="page-grid">
<section className="page-grid">
{replied === "1" ? (
<div role="status" style={feedbackStyle("success")}>
{t("success.replied")}
@@ -302,6 +302,6 @@ export default async function HelpTicketDetailPage({
{t("closedHint")}
</p>
)}
</main>
</section>
);
}
src/app/(site)/help/tickets/page.tsx
+2 -2
View File
@@ -67,7 +67,7 @@ export default async function HelpTicketsPage({
: null;
return (
<main className="page-grid">
<section className="page-grid">
{created === "1" ? (
<div role="status" style={feedbackStyle("success")}>
{t("success.created")}
@@ -167,6 +167,6 @@ export default async function HelpTicketsPage({
</table>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/layout.tsx
+12 -13
View File
@@ -31,19 +31,18 @@ export default async function SiteLayout({
return (
<>
<CloudsField />
{session?.user?.id ? (
<>
<div data-theme-block="top_header">
<TopHeader session={session} />
</div>
<div data-theme-block="site_header">
<SiteHeader />
</div>
<div data-theme-block="navigation">
<Navigation session={session} />
</div>
</>
) : null}
{/* Site chrome is public: hiding it all for anonymous visitors used to
strand them — from /news, /leaderboard or /shop there was no way to
reach any other page at all. */}
<div data-theme-block="top_header">
<TopHeader session={session} />
</div>
<div data-theme-block="site_header">
<SiteHeader />
</div>
<div data-theme-block="navigation">
<Navigation session={session} />
</div>
<main>
<div
data-theme-block="content_grid"
src/app/(site)/leaderboard/page.tsx
+26 -9
View File
@@ -10,6 +10,7 @@ import {
import { UserAvatarThumbnail } from "@/components/shared/user-avatar-thumbnail";
import { cached } from "@/lib/cache";
import { db, User, UsersCurrency, UsersSettings } from "@/lib/db";
import { loadProfilePrivacyMap } from "@/lib/services/profile-privacy";
export async function generateMetadata(): Promise<Metadata> {
const t = await getTranslations("pages.leaderboard");
@@ -52,7 +53,17 @@ function formatValue(key: TabKey, value: number): string {
return value.toLocaleString();
}
type Row = { username: string; look: string; value: number };
type Row = { userId: number; username: string; look: string; value: number };
/**
* Users who hid their wallet must not appear in the currency tabs: the profile
* page already honours that, and a leaderboard that ignores it makes the
* setting meaningless.
*/
async function withoutHiddenWallets(rows: Row[]): Promise<Row[]> {
const privacy = await loadProfilePrivacyMap(rows.map((r) => r.userId));
return rows.filter((r) => privacy.get(r.userId)?.wallet !== false);
}
async function loadCreditsRows(): Promise<Row[]> {
try {
@@ -62,6 +73,7 @@ async function loadCreditsRows(): Promise<Row[]> {
() =>
db
.select({
id: User.id,
username: User.username,
look: User.look,
credits: User.credits,
@@ -71,11 +83,14 @@ async function loadCreditsRows(): Promise<Row[]> {
.limit(20),
{ staleMs: 120000 },
);
return users.map((u) => ({
username: u.username,
look: u.look,
value: u.credits,
}));
return await withoutHiddenWallets(
users.map((u) => ({
userId: u.id,
username: u.username,
look: u.look,
value: u.credits,
})),
);
} catch {
return [];
}
@@ -89,6 +104,7 @@ async function loadCurrencyRows(type: number): Promise<Row[]> {
() =>
db
.select({
userId: User.id,
username: User.username,
look: User.look,
value: UsersCurrency.amount,
@@ -99,7 +115,7 @@ async function loadCurrencyRows(type: number): Promise<Row[]> {
.orderBy(desc(UsersCurrency.amount))
.limit(20),
{ staleMs: 120000 },
);
).then(withoutHiddenWallets);
} catch {
return [];
}
@@ -116,6 +132,7 @@ async function loadSettingsRows(
() =>
db
.select({
userId: User.id,
username: User.username,
look: User.look,
value: column,
@@ -166,7 +183,7 @@ export default async function LeaderboardPage({
: null;
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard
icon="📊"
title={t("title")}
@@ -245,6 +262,6 @@ export default async function LeaderboardPage({
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/login/page.tsx
+21 -11
View File
@@ -1,4 +1,4 @@
import { count, desc, eq } from "drizzle-orm";
import { desc, eq } from "drizzle-orm";
import type { Metadata } from "next";
import { headers } from "next/headers";
import Image from "next/image";
@@ -13,9 +13,11 @@ import { SurfaceCard } from "@/components/surface-card";
import { auth } from "@/lib/auth";
import { safeRedirectPath } from "@/lib/auth/safe-redirect";
import { cached } from "@/lib/cache";
import { db, User } from "@/lib/db";
import { resolveHotelName } from "@/lib/hotel-name";
import { captchaConfig } from "@/lib/services/captcha";
import { cachedOnlineCount } from "@/lib/services/public-counters";
import { siteSettings } from "@/lib/services/site-settings";
export async function generateMetadata(): Promise<Metadata> {
@@ -34,7 +36,11 @@ export async function generateMetadata(): Promise<Metadata> {
export default async function LoginPage({
searchParams,
}: {
searchParams: Promise<{ from?: string; registered?: string }>;
searchParams: Promise<{
from?: string;
registered?: string;
reset?: string;
}>;
}) {
const t = await getTranslations("pages.login");
const [hotelName, cfg, logo] = await Promise.all([
@@ -53,19 +59,13 @@ export default async function LoginPage({
if (session?.user?.id) redirect(redirectTo);
const [online, recentUsers, latestUsers] = await Promise.all([
cached("online_count", 10_000, () =>
db
.select({ total: count() })
.from(User)
.where(eq(User.online, "1"))
.then((rows) => rows[0]?.total ?? 0),
).catch(() => 0),
cachedOnlineCount().catch(() => 0),
cached(
"auth_online_users",
10_000,
() =>
db
.select({ username: User.username, look: User.look })
.select({ id: User.id, username: User.username, look: User.look })
.from(User)
.where(eq(User.online, "1"))
.limit(8),
@@ -76,7 +76,7 @@ export default async function LoginPage({
30_000,
() =>
db
.select({ username: User.username, look: User.look })
.select({ id: User.id, username: User.username, look: User.look })
.from(User)
.orderBy(desc(User.accountCreated))
.limit(8),
@@ -96,6 +96,16 @@ export default async function LoginPage({
>
{t("registeredSuccess")}
</p>
) : sp.reset === "1" ? (
// `?reset=1` comes from a successful password reset; saying so matters
// because the visitor just changed their password and a silent form
// reads like the reset failed.
<p
role="status"
className="auth-alert auth-alert--success animate-fade-in-up m-0 mb-4"
>
{t("passwordChanged")}
</p>
) : undefined;
return (
src/app/(site)/logo/page.tsx
+2 -2
View File
@@ -30,7 +30,7 @@ export default async function LogoPage() {
),
);
return (
<main
<section
style={{
display: "grid",
gap: "1.5rem",
@@ -45,6 +45,6 @@ export default async function LogoPage() {
/>
<LogoGenerator initialText={initialText} canSaveToSite={canSaveToSite} />
</main>
</section>
);
}
src/app/(site)/maintenance/page.tsx
+2 -2
View File
@@ -14,7 +14,7 @@ export default async function MaintenancePage() {
]);
return (
<main style={{ maxWidth: 560, margin: "2rem auto" }}>
<section style={{ maxWidth: 560, margin: "2rem auto" }}>
<ContentCard
icon="🛠️"
title={t("title", { hotel })}
@@ -25,6 +25,6 @@ export default async function MaintenancePage() {
{t("staffCanLogIn")}
</p>
</ContentCard>
</main>
</section>
);
}
src/app/(site)/marketplace/page.tsx
+2 -2
View File
@@ -82,7 +82,7 @@ export default async function MarketplacePage() {
const total = offers.reduce((sum, o) => sum + o.price, 0);
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="🛍️" title={t("title")} subtitle={t("subtitle")}>
<div className="stat-grid">
<StatBlock
@@ -148,6 +148,6 @@ export default async function MarketplacePage() {
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/me/page.tsx
+8 -6
View File
@@ -47,14 +47,14 @@ async function MePage({
data = await loadUserDashboard(userId);
} catch {
return (
<main>
<section>
<SurfaceCard className="p-6">
<p role="alert">{t("loadError")}</p>
<Link href="/me" className="btn btn-outline">
{t("retry")}
</Link>
</SurfaceCard>
</main>
</section>
);
}
// Daily reward state (settings + schedule + the user's last claim). Never
@@ -63,14 +63,14 @@ async function MePage({
const user = data.userRows[0];
if (!user)
return (
<main>
<section>
<SurfaceCard className="p-6">
<p role="alert">{t("loadError")}</p>
<Link href="/login" className="btn btn-outline">
{t("login")}
</Link>
</SurfaceCard>
</main>
</section>
);
const {
hotelName,
@@ -145,7 +145,7 @@ async function MePage({
? error
: "error";
return (
<main className={styles.dashboard}>
<section className={styles.dashboard}>
{claimed && (
<p role="status" className={styles.feedback}>
{t("claimed")}
@@ -181,6 +181,8 @@ async function MePage({
width={100}
height={140}
className={styles.avatar}
loading="eager"
fetchPriority="high"
/>
<div className={styles.identity}>
<p className="muted">{t("welcome", { hotel: hotelName })}</p>
@@ -469,7 +471,7 @@ async function MePage({
</SurfaceCard>
</aside>
</div>
</main>
</section>
);
}
src/app/(site)/messages/page.tsx
+2 -2
View File
@@ -177,7 +177,7 @@ export default async function MessagesPage({
: null;
return (
<main className="page-grid">
<section className="page-grid">
{accepted === "1" ? (
<div role="status" style={feedbackStyle("success")}>
{t("success.accepted")}
@@ -391,6 +391,6 @@ export default async function MessagesPage({
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/news/[...slug]/page.tsx
+14 -5
View File
@@ -94,7 +94,7 @@ async function ArticlePage({
} catch {
logger.error("Public article lookup failed", { module: "news" });
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="📰" title={t("loadError")}>
<p role="alert">{t("loadError")}</p>
<a
@@ -104,7 +104,7 @@ async function ArticlePage({
{t("retry")}
</a>
</ContentCard>
</main>
</section>
);
}
if (!article) notFound();
@@ -159,7 +159,7 @@ async function ArticlePage({
: null;
return (
<main className="page-grid">
<section className="page-grid">
{comment === "posted" ? (
<div role="status" style={feedbackStyle("success")}>
{t("success.posted")}
@@ -196,7 +196,16 @@ async function ArticlePage({
src={article.image}
alt=""
decoding="async"
style={{ width: "100%", borderRadius: 10, margin: "0 0 1rem" }}
loading="eager"
// Reserve the box: an unbounded hero image shifts the whole
// article down once the bitmap decodes.
style={{
width: "100%",
aspectRatio: "16 / 9",
objectFit: "cover",
borderRadius: 10,
margin: "0 0 1rem",
}}
/>
) : null}
{/* Article body is rich HTML (atom uses TinyMCE) — sanitised server-side. */}
@@ -414,7 +423,7 @@ async function ArticlePage({
)}
</ContentCard>
</section>
</main>
</section>
);
}
src/app/(site)/news/page.tsx
+2 -2
View File
@@ -31,7 +31,7 @@ async function NewsPage({
`/news?${new URLSearchParams({ q: result?.search ?? params.q ?? "", order: result?.order ?? "newest", page: String(page) })}`;
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="📰" title={t("title")} subtitle={t("subtitle")} />
<ContentCard>
@@ -186,7 +186,7 @@ async function NewsPage({
</nav>
</ContentCard>
)}
</main>
</section>
);
}
src/app/(site)/page.tsx
+17 -10
View File
@@ -1,4 +1,4 @@
import { count, desc, eq } from "drizzle-orm";
import { desc, eq } from "drizzle-orm";
import { ArrowRight, ChevronDown } from "lucide-react";
import type { Metadata } from "next";
import { headers } from "next/headers";
@@ -25,7 +25,9 @@ import { formatDate } from "@/lib/format-date";
import { resolveHotelName } from "@/lib/hotel-name";
import { captchaConfig } from "@/lib/services/captcha";
import { getNewsList } from "@/lib/services/news-list";
import { loadProfilePrivacyMap } from "@/lib/services/profile-privacy";
import {
cachedOnlineCount,
countArticles,
countPhotos,
countRooms,
@@ -183,13 +185,7 @@ async function getHotelData() {
recentUsers,
recentPhotos,
] = await Promise.all([
cached("online_count", 10_000, () =>
db
.select({ total: count() })
.from(User)
.where(eq(User.online, "1"))
.then((rows) => rows[0]?.total ?? 0),
).catch(publicReadFailure("home.online")),
cachedOnlineCount().catch(publicReadFailure("home.online")),
cached("total_users", 300_000, countUsers, { staleMs: 300000 }).catch(
publicReadFailure("home.users"),
),
@@ -210,7 +206,7 @@ async function getHotelData() {
15_000,
() =>
db
.select({ username: User.username, look: User.look })
.select({ id: User.id, username: User.username, look: User.look })
.from(User)
.where(eq(User.online, "1"))
.limit(12),
@@ -259,11 +255,22 @@ export default async function Home() {
totalPhotos,
articleCount,
articles,
recentUsers,
recentUsers: rawRecentUsers,
recentPhotos,
logo,
} = await getHotelData();
// Users who hide their online state must not surface in the "who is online"
// rails on the homepage either.
const recentUserPrivacy = await loadProfilePrivacyMap(
(rawRecentUsers ?? []).map((u) => u.id),
);
const recentUsers =
rawRecentUsers === null
? null
: rawRecentUsers.filter(
(u) => recentUserPrivacy.get(u.id)?.online !== false,
);
const captcha = await captchaConfig();
const nonce = (await headers()).get("x-nonce") ?? undefined;
src/app/(site)/photos/page.tsx
+11 -3
View File
@@ -10,6 +10,7 @@ import { ContentCard, EmptyState } from "@/components/public/ui";
import { cached } from "@/lib/cache";
import { CameraWeb, db } from "@/lib/db";
import { formatDate } from "@/lib/format-date";
import { loadProfilePrivacyMap } from "@/lib/services/profile-privacy";
import { publicReadFailure } from "@/lib/services/public-read";
export async function generateMetadata(): Promise<Metadata> {
@@ -53,9 +54,16 @@ export default async function PhotosPage() {
photos = publicReadFailure("photos")(error);
}
// Users can hide their photos everywhere, not only on their profile.
const photoOwners = [...new Set((photos ?? []).map((p) => p.userId))];
const photoPrivacy = await loadProfilePrivacyMap(photoOwners);
const visiblePhotos = (photos ?? []).filter(
(p) => photoPrivacy.get(p.userId)?.photos !== false,
);
// Pre-shape for the client lightbox: translate captions server-side so the
// client component stays free of i18n/db dependencies.
const items: LightboxPhoto[] = (photos ?? []).map((p) => ({
const items: LightboxPhoto[] = visiblePhotos.map((p) => ({
id: String(p.id),
url: p.url,
alt: t("photoAlt", { id: p.userId }),
@@ -64,7 +72,7 @@ export default async function PhotosPage() {
}));
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="📸" title={t("title")} subtitle={t("subtitle")} />
<ContentCard padded={items.length === 0}>
@@ -76,6 +84,6 @@ export default async function PhotosPage() {
<PhotoLightbox photos={items} />
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/polls/[id]/page.tsx
+2 -2
View File
@@ -96,7 +96,7 @@ export default async function PollDetailPage({
}
return (
<main className="page-grid">
<section className="page-grid">
<p className="muted" style={{ margin: 0 }}>
<Link href="/polls">{t("back")}</Link>
</p>
@@ -248,6 +248,6 @@ export default async function PollDetailPage({
</div>
</ContentCard>
) : null}
</main>
</section>
);
}
src/app/(site)/polls/page.tsx
+2 -2
View File
@@ -60,7 +60,7 @@ export default async function PollsPage() {
}));
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="📊" title={t("title")} subtitle={t("subtitle")} />
<ContentCard padded={polls.length === 0}>
@@ -122,6 +122,6 @@ export default async function PollsPage() {
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/radio/apply/page.tsx
+2 -2
View File
@@ -65,7 +65,7 @@ export default async function RadioApplyPage({
: null;
return (
<main className="page-grid">
<section className="page-grid">
{submitted === "1" ? (
<div role="status" style={feedbackStyle("success")}>
{t("success.submitted")}
@@ -199,6 +199,6 @@ export default async function RadioApplyPage({
</button>
</form>
</ContentCard>
</main>
</section>
);
}
src/app/(site)/radio/contests/[id]/page.tsx
+2 -2
View File
@@ -33,7 +33,7 @@ export default async function RadioContestDetailPage({
const active = contest.isActive ? "Active" : "Ended";
return (
<main className="page-grid">
<section className="page-grid">
<p className="muted" style={{ margin: 0 }}>
<Link href="/radio/contests">← Back to contests</Link>
</p>
@@ -90,6 +90,6 @@ export default async function RadioContestDetailPage({
</tbody>
</table>
</ContentCard>
</main>
</section>
);
}
src/app/(site)/radio/contests/page.tsx
+2 -2
View File
@@ -23,7 +23,7 @@ export default async function RadioContestsPage() {
.catch(() => []);
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="🎉" title={t("title")} subtitle={t("subtitle")} />
<ContentCard padded={contests.length === 0}>
@@ -71,6 +71,6 @@ export default async function RadioContestsPage() {
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/radio/giveaways/[id]/page.tsx
+2 -2
View File
@@ -38,7 +38,7 @@ export default async function RadioGiveawayDetailPage({
: null);
return (
<main className="page-grid">
<section className="page-grid">
<p className="muted" style={{ margin: 0 }}>
<Link href="/radio/giveaways">← Back to giveaways</Link>
</p>
@@ -95,6 +95,6 @@ export default async function RadioGiveawayDetailPage({
</tbody>
</table>
</ContentCard>
</main>
</section>
);
}
src/app/(site)/radio/giveaways/page.tsx
+2 -2
View File
@@ -25,7 +25,7 @@ export default async function RadioGiveawaysPage() {
.catch(() => []);
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="🎁" title={t("title")} subtitle={t("subtitle")} />
<ContentCard padded={giveaways.length === 0}>
@@ -78,6 +78,6 @@ export default async function RadioGiveawaysPage() {
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/radio/leaderboard/page.tsx
+2 -2
View File
@@ -38,7 +38,7 @@ export default async function RadioLeaderboardPage() {
const rows = await loadRows();
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="🏆" title={t("title")} subtitle={t("subtitle")} />
<ContentCard padded={rows.length === 0}>
@@ -85,6 +85,6 @@ export default async function RadioLeaderboardPage() {
</table>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/radio/page.tsx
+2 -2
View File
@@ -120,7 +120,7 @@ export default async function RadioPage() {
const isLive = Boolean(streamUrl);
return (
<main className="page-grid">
<section className="page-grid">
{/* ── Header: live stream + now playing ─────────────────────── */}
<ContentCard
icon="📻"
@@ -262,6 +262,6 @@ export default async function RadioPage() {
</table>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/radio/schedule/page.tsx
+2 -2
View File
@@ -74,7 +74,7 @@ export default async function RadioSchedulePage() {
const hasAny = schedules.length > 0;
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="🗓️" title={t("title")} subtitle={t("subtitle")} />
<ContentCard padded={!hasAny}>
@@ -126,6 +126,6 @@ export default async function RadioSchedulePage() {
</table>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/radio/shouts/page.tsx
+2 -2
View File
@@ -73,7 +73,7 @@ export default async function RadioShoutsPage({
: null;
return (
<main className="page-grid">
<section className="page-grid">
{posted === "1" ? (
<div role="status" style={feedbackStyle("success")}>
{t("success.posted")}
@@ -166,6 +166,6 @@ export default async function RadioShoutsPage({
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/rankings/page.tsx
+2 -2
View File
@@ -62,7 +62,7 @@ export default async function RankingsPage() {
}
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="🏆" title={t("title")} subtitle={t("subtitle")} />
<ContentCard padded={!users?.length}>
@@ -104,6 +104,6 @@ export default async function RankingsPage() {
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/rares/[category]/page.tsx
+2 -2
View File
@@ -96,7 +96,7 @@ export default async function RareCategoryPage({
badgeBase && cat.badge ? `${badgeBase}/${cat.badge}.gif` : "";
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard
icon={badgeSrc ? undefined : "💎"}
title={
@@ -194,6 +194,6 @@ export default async function RareCategoryPage({
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/rares/page.tsx
+2 -2
View File
@@ -65,7 +65,7 @@ export default async function RareValuesPage() {
}
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="💎" title={t("title")} subtitle={t("subtitle")} />
{categories.length === 0 ? (
@@ -116,6 +116,6 @@ export default async function RareValuesPage() {
})}
</div>
)}
</main>
</section>
);
}
src/app/(site)/redeem/page.tsx
+2 -2
View File
@@ -29,7 +29,7 @@ export default async function RedeemPage() {
if (!user) redirect("/login");
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="🎟️" title={t("title")} subtitle={t("subtitle")} />
<div className="card-grid sm-2">
@@ -63,6 +63,6 @@ export default async function RedeemPage() {
</p>
</ContentCard>
</div>
</main>
</section>
);
}
src/app/(site)/register/page.tsx
+6 -10
View File
@@ -1,4 +1,4 @@
import { count, desc, eq } from "drizzle-orm";
import { desc, eq } from "drizzle-orm";
import type { Metadata } from "next";
import { headers } from "next/headers";
import Image from "next/image";
@@ -12,9 +12,11 @@ import { RegisterForm } from "@/components/auth/register-form";
import { SurfaceCard } from "@/components/surface-card";
import { auth } from "@/lib/auth";
import { cached } from "@/lib/cache";
import { db, User } from "@/lib/db";
import { resolveHotelName } from "@/lib/hotel-name";
import { captchaConfig } from "@/lib/services/captcha";
import { cachedOnlineCount } from "@/lib/services/public-counters";
import { siteSettings } from "@/lib/services/site-settings";
export async function generateMetadata(): Promise<Metadata> {
@@ -42,19 +44,13 @@ export default async function RegisterPage() {
if (session?.user?.id) redirect("/me");
const [online, recentUsers, latestUsers] = await Promise.all([
cached("online_count", 10_000, () =>
db
.select({ total: count() })
.from(User)
.where(eq(User.online, "1"))
.then((rows) => rows[0]?.total ?? 0),
).catch(() => 0),
cachedOnlineCount().catch(() => 0),
cached(
"auth_online_users",
10_000,
() =>
db
.select({ username: User.username, look: User.look })
.select({ id: User.id, username: User.username, look: User.look })
.from(User)
.where(eq(User.online, "1"))
.limit(8),
@@ -65,7 +61,7 @@ export default async function RegisterPage() {
30_000,
() =>
db
.select({ username: User.username, look: User.look })
.select({ id: User.id, username: User.username, look: User.look })
.from(User)
.orderBy(desc(User.accountCreated))
.limit(8),
src/app/(site)/reset/page.tsx
+26 -4
View File
@@ -1,8 +1,26 @@
import type { Metadata } from "next";
import { getTranslations } from "next-intl/server";
import { resetPassword } from "@/actions/password-reset";
import Link from "@/components/link";
import { ContentCard } from "@/components/public/ui";
export async function generateMetadata(): Promise<Metadata> {
const t = await getTranslations("pages.reset");
return {
title: t("title"),
description: t("subtitle"),
// Single-use links: never indexable.
robots: { index: false, follow: false },
};
}
const ERROR_KEYS: Record<string, string> = {
password: "passwordMinLength",
ratelimit: "tooManyAttempts",
invalid: "invalidLink",
failed: "failed",
};
export default async function ResetPage({
searchParams,
}: {
@@ -10,9 +28,12 @@ export default async function ResetPage({
}) {
const t = await getTranslations("pages.reset");
const { email = "", token = "", error } = await searchParams;
// Only codes the action can produce are mapped — anything else stays silent
// instead of being echoed back onto our own domain.
const errorKey = error ? (ERROR_KEYS[error] ?? null) : null;
return (
<main style={{ maxWidth: 420, margin: "2rem auto" }}>
<section style={{ maxWidth: 420, margin: "2rem auto" }}>
<ContentCard icon="🔐" title={t("title")} subtitle={t("subtitle")}>
<form action={resetPassword} style={{ display: "grid", gap: "0.7rem" }}>
<input type="hidden" name="email" value={email} />
@@ -28,15 +49,16 @@ export default async function ResetPage({
{t("resetPassword")}
</button>
</form>
{error ? (
{errorKey ? (
<p
role="alert"
style={{
color: "var(--color-danger)",
textAlign: "center",
marginBottom: 0,
}}
>
{error}
{t(errorKey)}
</p>
) : null}
<p
@@ -46,6 +68,6 @@ export default async function ResetPage({
<Link href="/login">{t("backToLogin")}</Link>
</p>
</ContentCard>
</main>
</section>
);
}
src/app/(site)/room/[id]/page.tsx
+2 -2
View File
@@ -101,7 +101,7 @@ export default async function RoomPage({
.filter(Boolean);
return (
<main className="page-grid">
<section className="page-grid">
<p style={{ margin: 0 }}>
<Link href="/" className="btn btn-outline">
← Back to the hotel
@@ -166,6 +166,6 @@ export default async function RoomPage({
Enter the hotel to visit {room.name || `room #${room.id}`} in 3D.
</EmptyState>
</ContentCard>
</main>
</section>
);
}
src/app/(site)/search/page.tsx
+14 -3
View File
@@ -5,6 +5,7 @@ import { LocalEventTime } from "@/components/public/local-event-time";
import { ContentCard, EmptyState } from "@/components/public/ui";
import { UserAvatarThumbnail } from "@/components/shared/user-avatar-thumbnail";
import { withPublicPagePerformance } from "@/lib/public-page-performance";
import { loadProfilePrivacyMap } from "@/lib/services/profile-privacy";
import { loadPublicSearch } from "@/lib/services/public-search";
export async function generateMetadata(): Promise<Metadata> {
@@ -29,6 +30,11 @@ async function SearchPage({ searchParams }: { searchParams: Promise<Params> }) {
eventsPage: Number(params.eventsPage ?? 1),
});
const query = result?.query ?? "";
// Users who hide their online state must not have it surfaced here either —
// the listing, not just the profile, is what makes it enumerable.
const userRows =
result?.users.status === "fulfilled" ? result.users.value.rows : [];
const userPrivacy = await loadProfilePrivacyMap(userRows.map((u) => u.id));
const pagination = (
kind: "users" | "rooms" | "news" | "events",
data: { page: number; lastPage: number; total: number },
@@ -65,7 +71,7 @@ async function SearchPage({ searchParams }: { searchParams: Promise<Params> }) {
);
};
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard title={t("title")} subtitle={t("subtitle")} icon="🔎" />
<ContentCard>
<form
@@ -119,7 +125,12 @@ async function SearchPage({ searchParams }: { searchParams: Promise<Params> }) {
{user.username}
</span>
<span className="text-xs muted">
{t(user.online === "1" ? "online" : "offline")}
{t(
user.online === "1" &&
userPrivacy.get(user.id)?.online !== false
? "online"
: "offline",
)}
</span>
</Link>
))}
@@ -220,7 +231,7 @@ async function SearchPage({ searchParams }: { searchParams: Promise<Params> }) {
</section>
</>
)}
</main>
</section>
);
}
src/app/(site)/settings/2fa/page.tsx
+7 -2
View File
@@ -73,7 +73,7 @@ export default async function TwoFactorPage({
}
return (
<main
<section
style={{
display: "grid",
gap: "1.5rem",
@@ -149,6 +149,11 @@ export default async function TwoFactorPage({
{t("rateLimit")}
</p>
) : null}
{sp.error === "alreadyenabled" ? (
<p style={{ color: "var(--color-danger)", marginTop: 0 }}>
{t("alreadyEnabled")}
</p>
) : null}
{!hasAppKey ? (
<p style={{ margin: 0 }}>
@@ -217,6 +222,6 @@ export default async function TwoFactorPage({
</>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/settings/sessions/page.tsx
+2 -2
View File
@@ -78,7 +78,7 @@ export default async function SessionsPage({
}
return (
<main className="page-grid">
<section className="page-grid">
{signedOutAll === "1" ? (
<p
role="status"
@@ -169,6 +169,6 @@ export default async function SessionsPage({
</table>
</ContentCard>
) : null}
</main>
</section>
);
}
src/app/(site)/shop/page.tsx
+2 -2
View File
@@ -154,7 +154,7 @@ export default async function ShopPage({
: undefined;
return (
<main className="page-grid">
<section className="page-grid">
{boughtMessage ? (
<div role="status" style={feedbackStyle("success")}>
{boughtMessage}
@@ -340,6 +340,6 @@ export default async function ShopPage({
</div>
)}
</ContentCard>
</main>
</section>
);
}
src/app/(site)/shop/topup/page.tsx
+2 -2
View File
@@ -41,7 +41,7 @@ export default async function TopUpPage({
const rate = creditsPerUnit();
return (
<main className="page-grid">
<section className="page-grid">
<ContentCard icon="💳" title={t("title")} subtitle={t("subtitle")} />
{sp.status === "cancel" ? (
@@ -92,6 +92,6 @@ export default async function TopUpPage({
</p>
</ContentCard>
</div>
</main>
</section>
);
}
src/app/(site)/staff/page.tsx
+2 -2
View File
@@ -59,7 +59,7 @@ export default async function StaffPage() {
]);
return (
<main className={styles.page}>
<section className={styles.page}>
<SurfaceCard className={styles.hero}>
<div>
<h1>{t("title")}</h1>
@@ -151,6 +151,6 @@ export default async function StaffPage() {
</section>
)
)}
</main>
</section>
);
}
src/app/(site)/u/[username]/page.tsx
+4 -2
View File
@@ -338,7 +338,7 @@ async function ProfilePage({
const badgeByCode = new Map(badgeDetails.map((b) => [b.badgeKey, b]));
return (
<main className={`page-grid ${styles.profile}`}>
<section className={`page-grid ${styles.profile}`}>
{friend === "sent" ? (
<div role="status" style={feedbackStyle("success")}>
{t("success.sent")}
@@ -373,6 +373,8 @@ async function ProfilePage({
width={100}
height={150}
className={styles.avatar}
loading="eager"
fetchPriority="high"
/>
<div className={styles.identity}>
<h1 style={{ margin: "0 0 0.25rem" }}>{user.username}</h1>
@@ -692,7 +694,7 @@ async function ProfilePage({
</ContentCard>
</div>
</div>
</main>
</section>
);
}
src/app/(site)/verify/page.tsx
+34 -5
View File
@@ -1,5 +1,6 @@
import { eq } from "drizzle-orm";
import { asc, eq } from "drizzle-orm";
import { CheckCircle2, Clock, MailX } from "lucide-react";
import type { Metadata } from "next";
import { getTranslations } from "next-intl/server";
import { ResendVerificationForm } from "@/components/auth/resend-verification-form";
import Link from "@/components/link";
@@ -7,6 +8,16 @@ import { SurfaceCard } from "@/components/surface-card";
import { isValidVerificationToken } from "@/lib/auth/email-verification";
import { db, User } from "@/lib/db";
export async function generateMetadata(): Promise<Metadata> {
const t = await getTranslations("pages.verify");
return {
title: t("verifiedTitle"),
description: t("invalidSubtitle"),
// Token links are single-use; the page itself has nothing to index.
robots: { index: false, follow: false },
};
}
type Status = "verified" | "already" | "invalid" | "unavailable";
function StatusCard({
@@ -31,7 +42,7 @@ function StatusCard({
const tint = tintMap[color] ?? tintMap.blue;
return (
<main className="flex min-h-[60vh] items-center justify-center px-4">
<section className="flex min-h-[60vh] items-center justify-center px-4">
<SurfaceCard className="w-full max-w-md">
<div
className="flex items-center gap-2.5 border-b px-5 py-4"
@@ -76,7 +87,7 @@ function StatusCard({
{children}
</div>
</SurfaceCard>
</main>
</section>
);
}
@@ -98,11 +109,14 @@ export default async function VerifyPage({
const ok = await isValidVerificationToken(normalisedEmail, token);
if (ok) {
try {
const [user] = await db
// Legacy databases allow duplicate addresses; always resolve the
// oldest account so the link cannot verify a different one.
const matches = await db
.select({ id: User.id, mailVerified: User.mailVerified })
.from(User)
.where(eq(User.mail, normalisedEmail))
.limit(1);
.orderBy(asc(User.id));
const user = matches[0];
if (!user) {
status = "invalid";
} else if (user.mailVerified === "1") {
@@ -173,6 +187,21 @@ export default async function VerifyPage({
<p className="text-sm" style={{ color: "var(--color-text-muted)" }}>
{t("unavailableBody")}
</p>
{/* Transient failure: offer both the retry path and the way out
instead of leaving the visitor stranded on this card. */}
<ResendVerificationForm />
<Link
href="/login"
className={`${linkClass} !shadow-none`}
style={{
background: "transparent",
color: "var(--color-text-readable)",
border:
"2px solid color-mix(in srgb, var(--color-text-muted) 20%, transparent)",
}}
>
{t("backToLogin")}
</Link>
</StatusCard>
)}
src/app/admin-next/hotel/nitro-cleanup/page.tsx
+7 -1
View File
@@ -1,5 +1,11 @@
import { AdminToaster } from "@/components/admin/admin-toaster";
import { NitroCleanupPanel } from "@/components/admin/studio/nitro-cleanup-panel";
export default function HousekeepingHotelNitroCleanupPage() {
return <NitroCleanupPanel />;
return (
<>
<NitroCleanupPanel />
<AdminToaster />
</>
);
}
src/app/admin/layout.tsx
+2
View File
@@ -6,6 +6,7 @@ import type { ReactNode } from "react";
import { AdminHubChrome } from "@/components/admin/admin-hub-chrome";
import { AdminMobileWrapper } from "@/components/admin/admin-mobile-wrapper";
import { AdminSidebarNav } from "@/components/admin/admin-sidebar-nav";
import { AdminToaster } from "@/components/admin/admin-toaster";
import { AdminTopbar } from "@/components/admin/admin-topbar";
import { LanguageSwitcher } from "@/components/language-switcher";
import Link from "@/components/link";
@@ -54,6 +55,7 @@ export default async function AdminLayout({
</section>
</div>
</AdminMobileWrapper>
<AdminToaster />
</>
);
}
src/app/admin/logs/_lib/load-ignored-logs.ts
+6 -3
View File
@@ -32,7 +32,8 @@ function parsePageParams(
) {
const sp = new URLSearchParams(rawParams);
const parsed = parseListParams(sp);
const perPage = Number(rawParams.perPage) || defaultPerPage;
// parseListParams clamps perPage to 1..100 — use it instead of the raw value.
const perPage = parsed.perPage || defaultPerPage;
return { search: parsed.search.trim(), page: parsed.page, perPage };
}
@@ -63,8 +64,10 @@ async function loadLogList<RawRow, Row>(
rawParams,
input.defaultPerPage ?? 50,
);
const offset = (page - 1) * perPage;
const like = `%${search}%`;
// Cap the offset: `?page=1000000` otherwise builds a multi-hundred-million
// row scan before returning an empty page.
const offset = Math.min((page - 1) * perPage, 100_000);
const like = `%${search.slice(0, 100)}%`;
const where = search ? sql`WHERE ${spec.searchWhere(like)}` : sql``;
const [rawRowsResult, countRows] = await Promise.all([
src/app/admin/radio/settings/page.tsx
+26 -5
View File
@@ -7,7 +7,7 @@ import { StatusCard } from "@/components/admin/dashboard";
import { Button } from "@/components/ui/button";
import { db, WebsiteSetting } from "@/lib/db";
type Field = { key: string; comment: string };
type Field = { key: string; comment: string; secret?: boolean };
type Group = { title: string; fields: Field[] };
const GROUPS: Group[] = [
@@ -19,7 +19,11 @@ const GROUPS: Group[] = [
{ key: "radio_stream_backup_url", comment: "Backup stream URL" },
{ key: "radio_azurecast_base_url", comment: "AzureCast base URL" },
{ key: "radio_azurecast_station_id", comment: "AzureCast station ID" },
{ key: "radio_azurecast_api_key", comment: "AzureCast API key" },
{
key: "radio_azurecast_api_key",
comment: "AzureCast API key",
secret: true,
},
{ key: "radio_azurecast_port", comment: "AzureCast stream port" },
{
key: "radio_azurecast_protocol",
@@ -41,9 +45,14 @@ const GROUPS: Group[] = [
{
key: "radio_sambroadcaster_password",
comment: "Sambroadcaster password",
secret: true,
},
{ key: "radio_virtual_dj_url", comment: "Virtual DJ URL" },
{ key: "radio_virtual_dj_password", comment: "Virtual DJ password" },
{
key: "radio_virtual_dj_password",
comment: "Virtual DJ password",
secret: true,
},
{ key: "radio_djs_api_url", comment: "DJs API URL" },
],
},
@@ -331,7 +340,11 @@ const GROUPS: Group[] = [
{
title: "Discord webhook & custom code",
fields: [
{ key: "radio_discord_webhook_url", comment: "Discord webhook URL" },
{
key: "radio_discord_webhook_url",
comment: "Discord webhook URL",
secret: true,
},
{
key: "radio_discord_enabled",
comment: "Enable Discord notifications (0=no, 1=yes)",
@@ -467,7 +480,15 @@ export default async function AdminRadioSettingsPage() {
<input
id={`f_${field.key}`}
name={field.key}
defaultValue={values.get(field.key) ?? ""}
// Credentials are masked and blank means "keep".
type={field.secret ? "password" : "text"}
autoComplete="off"
placeholder={
field.secret ? "Leave blank to keep" : undefined
}
defaultValue={
field.secret ? "" : (values.get(field.key) ?? "")
}
style={{ width: "100%" }}
/>
{field.comment ? (
src/app/admin/settings/advanced-settings-panel.tsx
+3 -1
View File
@@ -14,8 +14,10 @@ import { MANAGED_SETTING_KEYS } from "./cms-settings-config";
interface SettingRow {
key: string;
/** Masked for secrets — the real value never reaches the client. */
value: string;
comment: string | null;
secret?: boolean;
}
export function AdvancedSettingsPanel({
@@ -126,7 +128,7 @@ export function AdvancedSettingsPanel({
</>
) : (
<code className="flex-1 text-xs break-all text-muted-foreground">
{s.value}
{s.secret ? "•• hidden ••" : s.value}
</code>
)}
</div>
src/app/admin/settings/page.tsx
+9 -1
View File
@@ -5,6 +5,10 @@ import { getTranslations } from "next-intl/server";
import { AdminPageShell } from "@/components/admin/admin-page-shell";
import { db, WebsiteSetting } from "@/lib/db";
import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
import {
isSecretSettingKey,
SECRET_PLACEHOLDER,
} from "@/lib/services/setting-secrets";
import { AdvancedSettingsPanel } from "./advanced-settings-panel";
import { FIELD_DEFAULTS, MANAGED_SETTING_KEYS } from "./cms-settings-config";
import { CmsSettingsForm } from "./cms-settings-form";
@@ -61,10 +65,14 @@ export default async function AdminSettings() {
<CmsSettingsForm values={values} canEdit={canEdit} />
<AdvancedSettingsPanel
// Credentials never leave the server: a reader with only
// SETTINGS_VIEW must not receive captcha/radio secrets in the
// payload, and an editor sees a "keep stored value" placeholder.
settings={settings.map((s) => ({
key: s.key,
value: s.value,
value: isSecretSettingKey(s.key) ? SECRET_PLACEHOLDER : s.value,
comment: s.comment,
secret: isSecretSettingKey(s.key),
}))}
canEdit={canEdit}
/>
src/app/api/admin/import/furni/route.ts
+14 -3
View File
@@ -5,7 +5,7 @@ import { invalidateCatalogTotals } from "@/features/catalog/server/catalog-total
import { apiError, apiOk } from "@/lib/api";
import { withAdmin } from "@/lib/api-handler";
import { db, ItemsBase, queryRows } from "@/lib/db";
import { normalizeClassname } from "@/lib/furni/classname";
import { isSafeAssetName, normalizeClassname } from "@/lib/furni/classname";
import { localFurnitureStatus } from "@/lib/furni/local-presence";
import { PERMS } from "@/lib/permissions";
import { logAudit } from "@/lib/services/audit";
@@ -709,9 +709,20 @@ export const PATCH = withAdmin(
[];
for (const item of items) {
const starIdx = item.classname.indexOf("*");
const normalised = item.classname.trim();
// The classname is joined straight into a `.nitro` file path, so a
// separator/looking payload must never get that far.
if (!isSafeAssetName(normalised)) {
results.push({
classname: item.classname,
ok: false,
warning: "Invalid classname",
});
continue;
}
const starIdx = normalised.indexOf("*");
const baseClassname =
starIdx !== -1 ? item.classname.substring(0, starIdx) : item.classname;
starIdx !== -1 ? normalised.substring(0, starIdx) : normalised;
const nitroPath = path.join(
/*turbopackIgnore: true*/ nitroDir,
`${baseClassname}.nitro`,
src/app/api/admin/users/actions/route.ts
+40 -4
View File
@@ -6,11 +6,20 @@ import { PERMS } from "@/lib/permissions";
import { rcon } from "@/lib/services/rcon";
import { logStaffActivity } from "@/lib/services/staff-activity";
/** Currency grants are capped: an unbounded `amount` minted an economy-breaking
* balance with a single request. */
function positiveAmount(amount: number): boolean {
return Number.isInteger(amount) && amount > 0 && amount <= MAX_CURRENCY_GRANT;
}
const MAX_CURRENCY_GRANT = 1_000_000;
export const POST = withAdmin(
{ permission: PERMS.USERS_EDIT },
async (request, context) => {
const staffId = context.session.user.id;
const staffRank = context.session.user.rank;
const isSuper = context.permissions.isSuperAdmin;
const formData = await request.formData();
const userId = Number(formData.get("userId"));
const username = String(formData.get("username") || "");
@@ -23,6 +32,33 @@ export const POST = withAdmin(
);
}
// Every branch below acts on a live account, so the rank guard that the
// set_rank branch already applies belongs to all of them: staff may not
// act on users at or above their own rank unless they are the hotel's
// dynamic owner.
if (action !== "set_rank") {
const [target] = await db
.select({ rank: User.rank })
.from(User)
.where(eq(User.id, userId))
.limit(1);
if (!target) {
return NextResponse.json(
{ success: false, message: "User not found" },
{ status: 404 },
);
}
if (!isSuper && target.rank >= staffRank) {
return NextResponse.json(
{
success: false,
message: "Cannot act on a user at or above your rank",
},
{ status: 403 },
);
}
}
if (action === "set_rank") {
const rank = Number(formData.get("rank") || "0");
if (!Number.isInteger(rank) || rank < 1) {
@@ -141,7 +177,7 @@ export const POST = withAdmin(
if (action === "give_credits") {
const credits = Number(formData.get("credits") || "0");
if (!credits || credits <= 0) {
if (!positiveAmount(credits)) {
return NextResponse.json(
{ success: false, message: "Invalid credit amount" },
{ status: 400 },
@@ -166,7 +202,7 @@ export const POST = withAdmin(
if (action === "give_duckets") {
const amount = Number(formData.get("amount") || "0");
if (!amount || amount <= 0) {
if (!positiveAmount(amount)) {
return NextResponse.json(
{ success: false, message: "Invalid duckets amount" },
{ status: 400 },
@@ -188,7 +224,7 @@ export const POST = withAdmin(
if (action === "give_diamonds") {
const amount = Number(formData.get("amount") || "0");
if (!amount || amount <= 0) {
if (!positiveAmount(amount)) {
return NextResponse.json(
{ success: false, message: "Invalid diamonds amount" },
{ status: 400 },
@@ -213,7 +249,7 @@ export const POST = withAdmin(
if (action === "give_points") {
const amount = Number(formData.get("amount") || "0");
if (!amount || amount <= 0) {
if (!positiveAmount(amount)) {
return NextResponse.json(
{ success: false, message: "Invalid points amount" },
{ status: 400 },
src/app/api/diagnostics/errors/route.ts
+6
View File
@@ -23,6 +23,12 @@ export async function POST(request: Request) {
!request.headers.get("content-type")?.startsWith("application/json")
)
return new Response(null, { status: 403 });
// The IP bucket is rotatable, so also require the browser's own fetch
// metadata: a script hammering this endpoint from another site is
// `cross-site`, while a real in-page reporter is never.
const fetchSite = request.headers.get("sec-fetch-site");
if (fetchSite && fetchSite !== "same-origin" && fetchSite !== "none")
return new Response(null, { status: 403 });
const limit = await rateLimit(`cms-error:${await clientIp()}`, 20, 60000);
if (!limit.ok) return new Response(null, { status: 429 });
const reader = request.body?.getReader();
src/app/api/home/route.ts
+2 -38
View File
@@ -1,11 +1,7 @@
import { and, count, desc, eq, or, sql } from "drizzle-orm";
import { env } from "@/env";
import { apiJson } from "@/lib/api";
import { db, User, WebsiteArticles } from "@/lib/db";
import { resolveHotelName } from "@/lib/hotel-name";
import { logger } from "@/lib/logger";
import { apiCacheKey, cacheSafe } from "@/lib/redis-cache";
import { cacheNews } from "@/lib/services/news-cache";
import { cachedHomePayload } from "@/lib/services/home-payload";
/**
* GET /api/home — combined landing payload: the latest 4 website_articles and
@@ -14,39 +10,7 @@ import { cacheNews } from "@/lib/services/news-cache";
*/
export async function GET(_req: Request) {
try {
const data = await cacheNews(apiCacheKey("home"), 15_000, async () => {
const [articles, onlineRows, hotelName] = await Promise.all([
db
.select({
id: WebsiteArticles.id,
title: WebsiteArticles.title,
slug: WebsiteArticles.slug,
shortStory: WebsiteArticles.shortStory,
image: WebsiteArticles.image,
createdAt: WebsiteArticles.createdAt,
})
.from(WebsiteArticles)
.where(
and(
eq(WebsiteArticles.status, "published"),
or(
sql`${WebsiteArticles.publishAt} IS NULL`,
sql`${WebsiteArticles.publishAt} <= NOW()`,
),
),
)
.orderBy(desc(WebsiteArticles.createdAt))
.limit(4),
db.select({ total: count() }).from(User).where(eq(User.online, "1")),
resolveHotelName(),
]);
return cacheSafe({
articles,
online: onlineRows[0]?.total ?? 0,
hotelName,
});
});
return apiJson(data);
return apiJson(await cachedHomePayload());
} catch (error) {
logger.error("Public news query failed", { module: "news", error });
return apiJson(
src/app/api/leaderboard/route.ts
+34 -6
View File
@@ -14,11 +14,29 @@ const CURRENCY_TYPE: Record<Exclude<LeaderboardType, "credits">, number> = {
duckets: 0,
};
type Row = { rank: number; username: string; look: string; value: number };
type Row = {
rank: number;
userId: number;
username: string;
look: string;
value: number;
};
/** Hidden-wallet users must not be listed, exactly like on the page. */
async function withoutHiddenWallets<T extends { userId: number }>(
rows: T[],
): Promise<T[]> {
const { loadProfilePrivacyMap } = await import(
"@/lib/services/profile-privacy"
);
const privacy = await loadProfilePrivacyMap(rows.map((r) => r.userId));
return rows.filter((r) => privacy.get(r.userId)?.wallet !== false);
}
async function loadCreditsRows(): Promise<Row[]> {
const users = await db
.select({
userId: User.id,
username: User.username,
look: User.look,
credits: User.credits,
@@ -26,8 +44,9 @@ async function loadCreditsRows(): Promise<Row[]> {
.from(User)
.orderBy(desc(User.credits))
.limit(20);
return users.map((u, i) => ({
return (await withoutHiddenWallets(users)).map((u, i) => ({
rank: i + 1,
userId: u.userId,
username: u.username,
look: u.look,
value: u.credits,
@@ -55,15 +74,24 @@ async function loadCurrencyRows(type: number): Promise<Row[]> {
top.map((t) => t.userId),
),
);
const byId = new Map(users.map((u) => [u.id, u]));
const allowed = await withoutHiddenWallets(top);
const allowedIds = new Set(allowed.map((t) => t.userId));
const byId = new Map(
users.filter((u) => allowedIds.has(u.id)).map((u) => [u.id, u]),
);
return top
return allowed
.map((t) => {
const u = byId.get(t.userId);
if (!u) return null;
return { username: u.username, look: u.look, value: t.amount };
return {
userId: u.id,
username: u.username,
look: u.look,
value: t.amount,
};
})
.filter((r): r is Omit<Row, "rank"> => r !== null)
.filter((r) => r !== null)
.map((r, i) => ({ rank: i + 1, ...r }));
}
src/app/api/media/route.ts
+12 -5
View File
@@ -1,13 +1,20 @@
import { existsSync, readdirSync, statSync } from "node:fs";
import { resolve } from "node:path";
import { NextResponse } from "next/server";
import { apiOk } from "@/lib/api";
import { withAdmin } from "@/lib/api-handler";
import { MEDIA_ROOT } from "@/lib/media-storage";
import { PERMS } from "@/lib/permissions";
export async function GET() {
/**
* Directory listing for the admin media picker. It used to be world-readable and
* unrated, which handed every visitor a complete inventory of uploaded media
* (logo/favicon paths included) plus their timestamps.
*/
export const GET = withAdmin({ permission: PERMS.PAGES_EDIT }, async () => {
const dir = MEDIA_ROOT;
// eslint-disable-next-line security/detect-non-literal-fs-filename
if (!existsSync(dir)) {
return NextResponse.json({ files: [] });
return apiOk({ files: [] });
}
// eslint-disable-next-line security/detect-non-literal-fs-filename
const files = readdirSync(dir)
@@ -23,5 +30,5 @@ export async function GET() {
})
.sort((a, b) => b.uploaded - a.uploaded);
return NextResponse.json({ files });
}
return apiOk({ files });
});
src/app/api/photos/route.ts
+13 -1
View File
@@ -31,8 +31,20 @@ export async function GET(req: Request) {
.limit(take)
.offset(skip),
]);
// Photo privacy is a per-user setting, so the API honours it like
// the /photos page does.
const { loadProfilePrivacyMap } = await import(
"@/lib/services/profile-privacy"
);
const photoPrivacy = await loadProfilePrivacyMap(
photos.map((p) => p.userId),
);
return cacheSafe({
data: photos,
data: photos.filter(
(p) => photoPrivacy.get(p.userId)?.photos !== false,
),
meta: {
page,
perPage,
src/app/api/radio/shouts/route.ts
+9
View File
@@ -4,6 +4,7 @@ import { bearerUserId } from "@/lib/api-auth";
import { db, RadioShouts, User } from "@/lib/db";
import { rateLimit } from "@/lib/rate-limit";
import { apiCacheKey, redisCache } from "@/lib/redis-cache";
import { moderateOrThrow } from "@/lib/services/moderation";
// Latest 50 radio shouts with their author's username/look resolved. Mirrors the
// query behind the public /radio/shouts page (radio_shouts ordered by created_at
@@ -93,6 +94,14 @@ export async function POST(req: Request) {
);
}
// The same word filter the server action applies — the API path used to
// skip it entirely, so a filtered message could be posted with one fetch.
try {
await moderateOrThrow(message);
} catch (error) {
return apiError((error as Error).message, 422);
}
try {
const now = new Date();
await db.insert(RadioShouts).values({
src/app/api/users/[username]/route.ts
+11 -2
View File
@@ -23,6 +23,7 @@ export async function GET(
async () => {
const [row] = await db
.select({
id: User.id,
username: User.username,
look: User.look,
motto: User.motto,
@@ -39,13 +40,21 @@ export async function GET(
return null;
}
// Wallet / online visibility are per-user settings; the public API
// used to hand both out unconditionally, which made bulk scraping
// of hidden wallets possible.
const { loadProfilePrivacy } = await import(
"@/lib/services/profile-privacy"
);
const privacy = await loadProfilePrivacy(row.id);
return cacheSafe({
username: row.username,
look: row.look,
motto: row.motto,
rank: row.rank,
credits: row.credits,
online: row.online === "1",
credits: privacy.values.wallet ? row.credits : null,
online: privacy.values.online ? row.online === "1" : null,
accountCreated: row.accountCreated,
});
},
src/app/client/page.tsx
+3 -10
View File
@@ -1,12 +1,11 @@
import { count, eq } from "drizzle-orm";
import { headers } from "next/headers";
import { redirect } from "next/navigation";
import { auth } from "@/lib/auth";
import { issueSsoTicket } from "@/lib/auth/sso-ticket";
import { cached } from "@/lib/cache";
import { resolveClientIp } from "@/lib/client-ip";
import { db, User } from "@/lib/db";
import { resolveHotelName } from "@/lib/hotel-name";
import { cachedOnlineCount } from "@/lib/services/public-counters";
import { siteSettings } from "@/lib/services/site-settings";
import { ClientView } from "./client-view";
@@ -27,13 +26,7 @@ export default async function ClientPage() {
// render as fast as possible since the player is waiting for the game.
const [ticket, onlineCount] = await Promise.all([
issueSsoTicket(userId, hotelName, ip),
cached("online_count", 10_000, async () => {
const [row] = await db
.select({ total: count() })
.from(User)
.where(eq(User.online, "1"));
return row?.total ?? 0;
}).catch(() => 0),
cachedOnlineCount().catch(() => 0),
]);
return (
src/app/globals.css
+55
View File
@@ -167,6 +167,61 @@ html {
text-size-adjust: 100%;
}
/* ── Route transition (CSS only — no animation runtime on public pages) ── */
@keyframes page-enter-rise {
from {
opacity: 0;
transform: translate3d(0, 10px, 0);
}
to {
opacity: 1;
transform: none;
}
}
.page-enter {
animation: page-enter-rise 240ms ease-out both;
}
/* ── Route progress indicator ─────────────────────────────────────────── */
.route-progress {
position: fixed;
inset: 0 0 auto 0;
z-index: 99999;
height: 3px;
overflow: hidden;
background: transparent;
pointer-events: none;
opacity: 0;
transition: opacity 200ms linear;
}
.route-progress[data-loading="true"] {
opacity: 1;
}
@keyframes route-progress-run {
from {
width: 0%;
opacity: 1;
}
70% {
width: 85%;
opacity: 1;
}
to {
width: 100%;
opacity: 0;
}
}
.route-progress__bar {
display: block;
height: 100%;
width: 0;
background: var(--color-primary);
box-shadow: 0 0 10px var(--color-primary);
}
.route-progress[data-loading="true"] .route-progress__bar {
animation: route-progress-run 400ms ease-in-out both;
}
@media (prefers-reduced-motion: reduce) {
html:focus-within {
scroll-behavior: auto;
src/app/layout.tsx
-14
View File
@@ -6,7 +6,6 @@ import { NextIntlClientProvider } from "next-intl";
import { getLocale, getMessages } from "next-intl/server";
import { type ReactNode, Suspense } from "react";
import { Toaster } from "sonner";
import { GlobalProgressBar } from "@/components/global-progress-bar";
import { PwaRegister } from "@/components/pwa-register";
import { ScopedThemeVars } from "@/components/scoped-theme-vars";
@@ -106,19 +105,6 @@ export default async function RootLayout({
<ThemeScopeDetector />
{children}
<PwaRegister />
<Toaster
position="top-right"
richColors
closeButton
toastOptions={{
style: {
background: "var(--color-surface)",
color: "var(--color-text-readable)",
border:
"1px solid color-mix(in srgb, var(--color-text-muted) 12%, transparent)",
},
}}
/>
</NextIntlClientProvider>
</body>
</html>