1672 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
openhands	d73baf1458	fix(catalog): take furnidata values from the clone source for retro items ... The resync route rebuilt every entry from items_base plus the *official Habbo* furnidata. A classname that only exists on a retro hotel (leet.ws and friends) is absent from the official set, so lookupOfficialHabboFurni returned null and the entry was written with revision 0, category "unknown" and an empty description — even though the clone import had those exact values available at import time from the source's own furnidata. - resync/route.ts: when a classname is genuinely missing from official Habbo, fall back to the configured clone sources. Their furnidata is indexed by normalized classname and each entry is coerced into the OfficialHabboFurniEntry shape, which is the same JSON shape, so it drives the existing buildFurniEntry fallbacks for revision, category, name, description, defaultdir, partcolors, specialtype, furniline, environment, rare and bc. items_base stays authoritative for id, spriteId and dims, and public_name still wins over the source name, matching the import. The index is memoized per request, not at module scope: a module-level cache would pin the source list for the life of the process and a source added later would never be picked up. fetchSourceFurnidata already caches per URL, so this costs one parse rather than a network round-trip. Disabled sources and sources that fail to respond are skipped, so an unreachable hotel degrades to the previous items_base-only behaviour instead of failing the run. Official Habbo still wins whenever it has the classname, so existing behaviour is unchanged for everything but the retro-only case. Applies to every resync mode, so the pre-existing ?missing=1 sweep picks this up too.	2026-09-29 16:02:58 +02:00
openhands	2f7e557d5e	feat(catalog): add a Studio button to fix missing furnidata entries ... "Missing furnidata" was only a filter in the Studio status dropdown, so imported items whose classname was absent from FurnitureData.json could be found but not fixed from that screen. Only the Catalog Audit page could repair them, and only globally. Adds the same shape of quick action that "no nitro" already had: - studio-client.tsx: a "N no furnidata" shortcut next to the "N no nitro" button that sets the missingFurnidata status filter, and a bulk "Add missing furnidata (N)" button for the selected rows. Both only appear when there is something to act on. Rows that come back repaired flip to hasFurnidata: true so the badges and counts update in place; rows the server reported in errors keep their state. - resync/route.ts: accepts an optional { classnames: string[] } body to target exactly the selected rows. classnames are resolved through the same normalized local index the listing uses to decide hasFurnidata, so the rows written are the rows flagged as missing. The upsert is already idempotent, and RCON updateCatalog + updateItems run afterwards so the emulator picks the new entries up. Also clears the Studio furnidata cache after a write, which this route never did: without it the listing kept serving a stale hasFurnidata for up to the 30s cache TTL, so a repair looked like it had done nothing. PERMS is now imported from permission-slugs (identical re-export) so the route no longer pulls next-auth into tests. - studio-filters.test.ts: pins the missingFurnidata branch, in particular that an unchecked item (hasFurnidata undefined) is not treated as missing. The existing ?days / ?missing / ?broken / ?all modes are unchanged; the body is only consulted when it carries a classnames array.	2026-09-29 15:48:32 +02:00
openhands	4be7eaed59	fix(catalog): never create a page that reuses a sibling's order number ... The emulator complained "Sibling order 2 is used more than once" 74 times in production, covering 19 pages across 12 parents. The cause was that nearly every page-creation path passed orderNum 0, so each new page collided with whatever sibling already sat at 0 or 1, and the Park placeholder pages all shared the sentinel values 99 and 999. The production rows themselves are repaired out of band (renumbered 1..N per affected parent, ordered by order_num then id so the existing visual order is preserved, plus one dangling catalog_items row whose items_base no longer existed removed). This commit stops it recurring. - hierarchy.ts: add nextFreeSiblingOrder(), which ignores -1 and 0 as the same root set, treats a missing orderNum as 0, and returns an order strictly above the highest sibling in use. An explicit order is still honoured whenever it is free, so callers that genuinely want a position keep it. - page-commands.ts: createPageCommand resolves the real order through nextFreeSiblingOrder instead of writing the requested 0 straight through. Note that furni-import.ts and upload-import.ts still take their order from the furnidata catInfo.order, so two categories carrying the same furnidata order can still collide. That is caught by the emulator audit and repaired by fixEmulatorIssues(), but it is not prevented here.	2026-09-29 15:34:44 +02:00
openhands	9cc57cddfc	feat(catalog): update the catalog live after an import, no page refresh ... Organising imports, the Studio furni batch, the catalog totals and the "import from a source" stats all used to need a full page reload, or at best a router.refresh() that re-rendered the whole admin route, before anything on screen reflected what the import had just written. - live-catalog-merge.ts (new): pure tree and total arithmetic. Applies a delta of created pages, added offers and moved offers, recomputes depth for the touched subtree, bumps parent child counts and the item totals. Returns the input untouched when a delta is empty, so subscribers can bail out instead of re-rendering. Depth resolution tolerates a parent cycle in a dirty DB and still terminates, matching getTreeFlat. - use-live-catalog.ts (new): one module-level store exposed through useSyncExternalStore, so every consumer shares a single instance without threading a provider through the admin layout. Deltas only apply to the "normal" catalog, so public and public_handlers trees stay separate. seedCatalogTotals() takes the first server value per mode and never overwrites it afterwards, so a later hard render cannot make the header totals jump backwards. - actions/catalog.ts: organizeImportFurni now reports each group through the new OrganizedPageChange, carrying parentId, pageLayout, the icon, isNew and the per-source movedFrom counts, so the client can fold the result into the tree without reading the page back. - organize-imports-dialog.tsx: drops useRouter and router.refresh(); the response is applied as a delta the moment the run finishes. - studio-client.tsx: reads the tree from the store instead of freezing it with useState(initialTree), loads it on mount when empty, and refreshes it once a batch import settles. The batch is server-side and derives its import pages from furnidata, so that one path re-reads the tree via GET /api/admin/catalog/tree?mode=full rather than trusting the delta. - studio/furni/page.tsx: stops calling getTreeFlat() and no longer passes initialTree; the store is the single source of truth for the rail. - import-clone-client.tsx: tracks which items are already present, so present and clonable update per cloned row instead of only at the end. - catalog-manager-dialog.tsx: seeds the totals once and renders the live values, so the header reflects an import that just ran. - e2e/ui/fixtures/entry.tsx: drops the removed initialTree prop.	2026-09-29 15:34:36 +02:00
openhands	7507c3b55c	fix(deploy): detect the actually-live blue/green slot, stop nginx-sync clobbering the upstream ... - ci-deploy.sh: read_active_port() now probes both slots on /api/health and picks the one that really answers; the upstream file only serves as a fallback when zero or both slots respond. A stray 'docker compose up' (or a clobbered snippet) can no longer derail the next deploy's cutover. - nginx-sync.sh: cms_upstream_servers.conf is runtime-owned by ci-deploy.sh; only seed it when missing, never overwrite what a deploy wrote. This is the root cause of tonight's 502: a nginx-sync run reset the snippet (written to green:3003 by the last cutover) back to the dead slot A:3002. - cms_upstream_servers.conf: restore the fresh-host seed default to slot A.	2026-09-28 23:38:22 +02:00
openhands	90b65c92a2	feat(proxy): sync Cloudflare ranges at nginx+Traefik, block IP spoofing ... - cloudflare-ips.conf (new): geo $cms_trusted_edge + set_real_ip_from from live CF IPv4/IPv6 ranges plus Traefik bridge and loopback - nginx-cms.conf: forward real client IP only from trusted peers, strip incoming CF-Connecting-IP, 403 any other peer that presents one (spoof gate); direct game clients on :9443 stay unaffected - cf-ips-sync.sh (new): fetch cloudflare.com/ips-v4/-v6, regenerate the nginx snippet and Traefik websecure.forwardedHeaders.trustedIPs - nginx-sync.sh: install the cloudflare-ips.conf snippet - cms_upstream_servers.conf: point default at the live green slot 3003	2026-09-28 23:35:00 +02:00
openhands	7697728d07	feat(cache): single-owner caching across nginx, edge and content edits ... Rebuild production nginx from the repo (deployment/proxy/*) with a single Cache-Control owner per route: the app stays the source, nginx only manages headers, and Cloudflare stores the public API allowlist at the edge. - deployment/proxy: nginx.conf, mime.types, nginx-cms.conf and the blue/green upstream snippet; config backed by scripts/nginx-sync.sh (idempotent install + reload, --check/--force). - nginx serves Cache-Tag headers on the public allowlist (cms-public), gamedata, client and camera responses so the edge and purge stay in sync. - src/lib/edge-cache.ts + tests: coalesced, fire-and-forget edge purges that no-op unless Cloudflare is configured; scripts/cf-purge.sh and cf-setup-cache.sh create and purge the cache rule. - src/lib/cloudflare-api.ts: purgeCacheByTags/purgeCacheByUrls. - Purge hooks after catalog exports (public + gamedata) and on shop, team, guild, photo and rare-values edits; ci-deploy purges after each release. - src/proxy.ts excludes the imaging/images docs from the middleware matcher.	2026-09-28 21:55:18 +02:00
openhands	30dcecd530	style: restore tab indentation in package.json ... The previous dependency upgrade rewrote the file with two-space indentation, which violated the Biome formatter setting (indentStyle: tab) and broke `biome check .`.	2026-09-27 19:49:30 +02:00
openhands	e4f83a8036	chore: upgrade to pnpm v12, vitest v5 and resolve deprecated subdependencies	2026-09-27 19:42:34 +02:00
openhands	f187cd70a9	chore(deps): bump vitest and @vitest/coverage-v8 to 5.0.2 ... Patch release, bug fixes only, no breaking changes. Two entries are relevant to this repository: a stack overflow when spying on Set.prototype.add, and the hanging-process reporter switching to its ESM entrypoint, which drops why-is-node-running 2.3.0, siginfo and stackback in favour of why-is-node-running 3.2.2. Verified with the CI unit command: 3302 tests pass under --maxWorkers=4, the coverage run clears its thresholds, pnpm deps:audit reports no known vulnerabilities, and the lockfile stays consistent under --frozen-lockfile.	2026-09-27 19:32:57 +02:00
openhands	d2d01141f1	style: apply Biome formatting to the catalog release test ... The timeout constant made the first it() line exceed the line width, so `biome check .` failed with a format error. Reformat and confirm the three publication tests still pass.	2026-09-27 19:26:08 +02:00
openhands	c2981bd970	test(catalog): give the Git publication tests room to finish ... These drive real git processes against a local bare remote, so their cost is process spawns competing with every other Vitest worker. Measured on CI they take 23-30s each, and the 30s override was crossed by 37ms, so the run failed on wall-clock rather than on behaviour. Replace the three hand-picked 30_000 values with one documented constant at 120_000, which keeps a genuine hang visible while clearing the observed spread. The global default stays at 10s so nothing else is loosened.	2026-09-27 19:20:44 +02:00
openhands	d9ef7f8360	chore(ci): remove Renovate ... Dependency updates are handled manually, so the scheduled Renovate job only cost a daily privileged Docker run on the deploy host. The empty cache directory it maintained is gone too, and the operations note now records that updates are manual instead of describing bot behaviour.	2026-09-27 19:15:31 +02:00
openhands	1f9ad02410	chore: ignore .env.local and .env.*.local ... load-env.ts reads .env.local before .env and gives it precedence, so a developer override file can hold real secrets. Only .env was ignored, so that file was one 'git add .' away from being committed.	2026-09-27 19:03:44 +02:00
openhands	80d7ae14ba	fix(ci): fail fast when the deploy dir has no DATABASE_URL ... pnpm db:migrate runs on the host and reads DATABASE_URL from the deploy directory's .env. When that variable was missing the deploy had already built an image and run the browser gate before pnpm db:migrate aborted on an empty value, so a release was paid for in full and then thrown away. Check for the variable right after the .env is copied, before the build, and say plainly that the live release was not touched. The deploy test fixture gains a DATABASE_URL so it mirrors a working deploy directory instead of the broken one.	2026-09-27 18:57:10 +02:00
openhands	bc00ecf08c	feat(i18n): complete message parity across all 25 locales ... The admin.studio.nitroCleanup section (102 keys) only existed in en and nl, so 23 locales fell back to English for the entire Nitro Cleanup panel. The referrals and dailyRewards keys were missing from the same 23 locales, and en itself was missing 6 keys that nl had. Add the missing keys to every locale with translations, so all 25 locales now carry the same 6063 keys.	2026-09-27 18:38:58 +02:00
openhands	944527e078	feat(nitro-cleanup): dedupe FurnitureData and clean dangling figure entries ... Add a gamedata cleanup to the Nitro Cleanup panel: a read-only preview plus an apply run that dedupes FurnitureData classnames and removes rows and figure entries that reference nothing. Three passes run in a fixed order, because cleanFigureMap has to precede cleanFigureData: dropping the part that points at a set is what makes that set unreferenced. A pass refuses to write when it would delete more than maxRemovals rows (default 500) and reports the reason, a wrong asset directory otherwise turns every row into an orphan and one call would empty the file. Passes that would act on empty input (no libraries, no sets) treat that as a missing file rather than as a reason to delete everything. Every write copies the file to a timestamped backup first, so a pass that turns out to be wrong can be undone by hand. The plan reads FurnitureData once and hands the parsed copy to both furniture passes; the file is tens of megabytes in a real deployment.	2026-09-27 17:14:30 +02:00
openhands	d176fad4da	fix(nitro): repair stale meta.image in bundles that are already lossless ... A bundle whose texture is already VP8L was returned untouched, so a stale spritesheet.meta.image survived the normalisation and the client could not find the texture member. Rebuild the archive in that case and reuse the existing VP8L bytes instead of decoding them again.	2026-09-27 17:13:52 +02:00
openhands	9ee22db8ba	fix(nitro): normalise attached and recovered .nitro bundles too ... Two more .nitro entry points in the main import path still wrote the supplied buffer verbatim: an attached `providedNitro` and a bundle pulled back by `resolveMissingNitro`. Both are real furniture imports, so they could still land a PNG texture while the SWF, clone and upload paths produced WebP. Route both through the same normalisation, falling back to the original bytes with a warning if the texture cannot be decoded.	2026-09-27 16:00:44 +02:00
openhands	b26e2e0de4	feat(nitro): normalise hotel and uploaded bundles to WebP Lossless ... Importing from a hotel wrote the downloaded .nitro to disk untouched, so official PNG textures stayed PNG and only SWF imports ended up as WebP. Every Studio import should produce the same format regardless of where the bytes came from, so both clone and upload paths now run the bundle through toWebpLosslessBundle. The helper decodes the texture and re-encodes it with the same VP8L options the SWF importer uses, so the artwork round-trips bit-for-bit, and lets createNitroBundle relabel the member and repair the meta.image pointer. A bundle that is already lossless WebP is returned untouched, making the operation idempotent and safe to run on re-import. A colour variant that shares a library keeps the member base name it arrived with. A texture that cannot be decoded keeps its original format with a warning instead of failing the import: the bundle is valid, and losing a furniture item over a codec edge case is worse than a slightly larger texture.	2026-09-27 15:55:17 +02:00
openhands	306e209e29	fix(nitro): normalise uploaded bundles so meta.image matches the texture ... An uploaded .nitro was written to disk byte-for-byte, so a bundle from a third-party tool that ships a WebP member while still pointing spritesheet.meta.image at a .png was accepted and stored as-is. The client resolves the spritesheet through that pointer, so the result was a file that validates fine and then renders nothing. Re-write the bundle through createNitroBundle on import, which labels the member from the actual bytes and repairs the pointer. No texture is re-encoded, so the bytes stay identical, and the member keeps the base name it arrived with so `chair*2` colour variants that share the `chair` library are not renamed.	2026-09-27 15:47:44 +02:00
openhands	17de94d984	feat(nitro): convert imported SWF bundles to WebP Lossless ... Newly converted .nitro bundles now store their spritesheet as WebP VP8L instead of PNG, so imports land much smaller without changing a single pixel. The texture member and spritesheet.meta.image are both labelled from the actual bytes, never from a caller's assumption. - encode through sharp with lossless and exact, so colour hidden under alpha 0 survives; this mirrors ImageSharp's TransparentColorMode.Preserve - detect PNG/WebP by magic bytes and reject anything the client cannot render, on create, download and upload paths - keep the source format when deriving size-32 sheets, scaling composites and editing metadata, so existing bundles are never silently rewritten - report fidelity in the studio: the compression panel re-encodes with the same options the importer uses, so it cannot drift and invent false warnings, and shows PNG/WebP size estimates convertSwfToNitro and buildSpritesheet are now async, so the worker, the main-thread fallback and every import call site await them. PNG stays supported for existing bundles and icon sidecars are untouched.	2026-09-27 15:42:21 +02:00
openhands	420210ffa0	fix(build): make the production build pass, and stop it eating 20GB ... `next build` had never completed on this host, so three real defects were sitting in the tree untested. All three are now fixed and the build is green. - The build was not memory-bound the way it looked. Turbopack's builder reached 20.5GB RSS and died, and raising `--max-old-space-size` could never have helped: that flag caps the V8 heap, while the 20GB sat in Turbopack's own Rust allocator. The first symptom was misleading because the process doing the allocating is a grandchild of `npx`, so watching the direct child shows a 95MB shim the whole time. Building with `--webpack` puts the build back under the JS heap, where the flag actually applies: peak 5.9GB, 150s, exit 0. - withAdmin's second parameter was typed `{ params?: ... }` and given a `= {}` default, which made it optional and `RouteContext | undefined`. Next's generated route types assert that argument against `ParamCheck<RouteContext>` and reject it, across 113 route files. `tsc --noEmit` cannot see this, because Next only adds `.next/types` to the project during a production build — so the type check that everyone runs locally was structurally incapable of catching the only type error that blocks a deploy. `params` is now required, which is also what the code already assumed: it is awaited with no guard. The 35 test call sites that invoked a handler with one argument now pass a real context, and the await got a guard so a direct internal call cannot turn a missing context into a 500. - `src/app/api/admin/import/furni/route.ts` re-exported `ensureDirectories` and `importSingleFurni` for "backward compatibility" that nothing used; the batch route imports from `@/lib/services/furni-import` directly. Next rejects any value export from a route module that is not an HTTP verb or config, so this had been breaking the build for as long as it existed. Removed. - `isomorphic-dompurify` builds its server-side DOM through jsdom. Bundled, that pulls jsdom's `browser/default-stylesheet.css` into the server chunk, where the path no longer resolves, and page-data collection dies with ENOENT on every page that sanitizes HTML. Marked external so Node resolves it from node_modules and the standalone tracer includes it. The remaining build warning is a pre-existing circular dependency between chunks that share the webpack runtime. It costs hash reuse, not correctness, and is left alone rather than churned here. Verified: build exit 0, 276 static pages generated, 3223 tests pass, tsc and biome clean.	2026-09-25 19:47:10 +02:00
openhands	155bf750c3	fix(cache): bound grace windows, cap render queues, and drop the useless estimate ... Follow-up to f81b114b, addressing the three ways that commit could make things worse rather than better. All three were verified against the real database or by breaking the test and watching it fail. - The grace window is now capped at 120s. A window is a cushion for the TTL boundary, not a second TTL, but the call sites treated it as the latter: the 5 min values/staff routes and the 10 min teams route asked for a window as long as or longer than their own TTL, so a single large staleMs silently doubled how far behind a value could be served. Nothing marked those as unsafe, because nothing looked wrong. The cap lives in the cache rather than at the call sites so no future route can reintroduce it. Routes that asked for less than 120s (the 10s online poll, the 20s news cache) are unchanged, so their intended cushion still does its job. - A request no longer queues behind an arbitrarily old render. Sharing a render is what collapses a cold-cache stampede into one render, but a hung render used to hold up everyone who arrived after it. A newcomer past 2s now serves the placeholder instead of waiting, reusing the ImagerUnavailableError path that "both upstreams down" already takes. The caller that actually started the render keeps waiting, which is correct: it is the one whose image this is. When the join window is removed the new test hangs for the full 10s it was meant to prevent, which is the tail this bounds. - The information_schema row-count estimate is gone; the counters are exact again. Running it against the live database: users 165, rooms 92, camera_web 0, and the estimate was 0.00% off on all three. At 165 rows an index scan is cheaper than the extra round trip the estimate needed, so the optimisation bought nothing and traded a guaranteed-correct member count for an approximation that InnoDB would only make less accurate as the table grows. The exactness is now pinned by tests: a real zero stays zero, a database error propagates instead of becoming a number, and each counter counts the table it claims to. The module stays, because the homepage and the boot warm-up writing different values to the same cache key is its own bug. The module comment records the measured numbers, because "COUNT(*) is too slow" sounds true in the abstract and is false here. 3223 tests pass.	2026-09-25 18:55:33 +02:00
openhands	f81b114b69	perf(cache): single-flight avatar renders, cacheable public reads, cheap row counts ... Three separate things that were each costing more than they needed to on the hot path. - Single-flight avatar renders. The disk cache was checked first and a miss went straight to the upstream, with nothing shared between callers, so a page requesting dozens of avatars at once turned N concurrent requests for one figure into N renders. A render is the most expensive operation this app does, and the duplication happened exactly when the cache had nothing to offer. Eight concurrent requests now cause one render instead of eight. The map lives on globalThis because Next can evaluate the module more than once per process, and two copies would each start their own render. - Let public read-only routes be cached by a shared cache. Every JSON response was `cache-control: no-store`, so a CDN in front of the app could not answer any of it and every request reached the origin. publicCacheControl() opts a route in with s-maxage and stale-while-revalidate, using the same TTL as the server-side cache so the two layers cannot disagree. The default stays no-store: most routes here are personalised, admin-only or auth-dependent. /api/badges/leaderboard is deliberately left alone because it returns per-viewer rank entries to signed-in callers. Note this only takes effect once a cache rule exists for /api/* at the CDN, or the explicit `cache: "no-store"` is dropped from the client fetches (24 files do that today, including the /api/online poll). The headers alone are inert until one of those happens. - Take the homepage row counts from the storage engine estimate instead of COUNT(*), which walks an index and gets slower as the tables grow. A missing or zero estimate falls back to the exact count rather than ever showing a wrong zero. The online count stays exact: it is an indexed read over a small subset and a few seconds of drift reads as broken rather than approximate. The counters move into one module because the homepage and the boot warm-up populate the same cache keys, so two implementations would race to write different values into the same entry. 3223 tests pass.	2026-09-25 18:42:23 +02:00
openhands	203399aab7	fix(cache): true LRU, stale-while-revalidate and cross-process invalidation ... The in-process cache was a FIFO of 500 entries that was never touched on a read, so a key polled on every request could be evicted by an unrelated burst of dynamic keys. That looked exactly like the cache being cleared at random, and it is what made the site fall back to the database unpredictably. - Evict least-recently-used instead, and raise the default budget to 2000 (CACHE_MEMORY_MAX_ENTRIES). Reading a key now marks it as used, so a hot key only leaves when a hotter one takes its place. - Add opt-in stale-while-revalidate (CachedOptions.staleMs). The grace window lives on the entry, so one call site opting in protects every reader of that key. A failed background refresh keeps serving the last good value instead of falling through to the origin, and is reported once rather than per read. - Invalidate across processes. invalidateKey() now clears memory, deletes the Redis key and publishes a signal, so a value written by one process is no longer served stale by the others for the rest of its TTL. A failed Redis delete no longer skips the broadcast. - Guard against a refresh that started before an invalidation writing its outdated result back into the cache. - Read the news revision at most once a second per process instead of on every call, with a pub/sub signal to drop the local copy when it rotates. A Redis outage now degrades to the in-process cache rather than to no cache at all. - Warm the hot public keys on boot, so the first visitors after a deploy do not each pay for a miss. - Count hits, misses, stale serves, errors and evictions per key, exposed at GET /api/admin/devops/cache. Without it a wrong REDIS_URL, a full budget and a dead origin all look identical from the outside. - Enforce the imaging cache budget for real: records are .img/.json pairs, so the old cap counted files and never removed anything while entries were fresh. Sweeps are throttled per directory and prune to a low-water mark. - Cap the JWT version map, and stop per-test scratch roots from littering the runtime imaging cache. Public read-only endpoints get grace windows; admin, account and auth data deliberately stays fresh. Redis TTLs get a little jitter so keys written together no longer expire together. 3209 tests pass. next build could not be verified on this host: the optimized build is OOM-killed before prerender, so this has not run in a real Next runtime yet.	2026-09-25 18:26:45 +02:00
openhands	f490fcc9da	fix(imaging): stop caching fallback renders ... A fallback render drops the requested effect and is only a degraded stand-in, so writing it to the 30 day disk cache kept serving the worse image long after the local renderer recovered. Cache primary renders only and let the next request pick up the real render.	2026-09-24 23:34:54 +02:00
openhands	fe5a7a6185	fix(imaging): keep avatars rendering, cacheable and reliably timed ... Effect renders need a little over 4s, which the 4s primary timeout cut off, so every avatar with the default effect fell through to an unreachable public fallback and rendered as a placeholder. Raise the primary budget above the observed render cost and shorten the fallback budget. Also stop the proxy from stamping no-store over the avatar and media responses, so browsers keep the long-lived Cache-Control the route already sends, and recreate the imaging cache directories with the container user on every deploy, since root ownership made those cache writes fail silently.	2026-09-24 23:22:28 +02:00
openhands	8486ac4053	feat(security): add darklist.de source and raise the blocklist cap to 1M	2026-09-24 23:22:27 +02:00
openhands	7f6febf906	fix(security): drop URLhaus feed, validate CIDR ranges, pass unknown client IPs	2026-09-24 19:19:22 +02:00
openhands	7392b843ad	fix(security): LAPI-only engine boot, import via stdin, correct compose service	2026-09-24 18:59:13 +02:00
openhands	9562a75378	feat(security): external IP blocklist sync for the local CrowdSec engine	2026-09-24 18:39:38 +02:00
openhands	84d53139a9	feat(security): opt-in local CrowdSec LAPI bouncer on the Docker engine	2026-09-24 18:08:18 +02:00
openhands	3e1a3f92c8	feat(security): recovery alerts, gate-block sharing, rolling-window burst and admin breakdown for CrowdSec	2026-09-23 15:06:16 +02:00
openhands	301edd2c9a	feat(security): ops alerts, shared backoff, atomic quota and daily stats for CrowdSec ... Add an alerting/stats layer over the existing CrowdSec integration: - New crowdsec-alerts.ts: cooldown-gated ops alerts (Redis NX lock, TTL from HEALTH_ALERT_COOLDOWN_MIN) fanning out through the app's sendAlert service. Raised for daily quota exhaustion, block bursts (5-min window past CROWDSEC_ALERT_BLOCK_BURST), and signal-push failures. - New crowdsec-stats.ts: daily counters (lookups/blocks/reports/report_fail) in Redis with a 14-day reader for the admin panel. - Shared 403/429 backoff: the pause marker now lives in Redis (crowdsec:backoff-until) so every instance honours it, not just the process that hit the limit. - Atomic quota reservation: INCR-before-call with self-rollback on overshoot, so concurrent instances can never slip calls past the daily ceiling. - Admin anti-DDoS page gains a last-14-days activity table next to the quota bar.	2026-09-23 14:45:35 +02:00
openhands	5e4fc9ab59	feat(security): give back to CrowdSec and harden the CTI budget ... - Bound the in-process verdict cache (FIFO eviction at 2000 entries) so a flood of distinct bucket-tripping IPs cannot grow it without limit. - Record block metadata (reputation, score, behaviors, category, TTL) in antiddos:block:meta:{ip}, surfaced as the reason in the admin block list; unban now also clears the metadata and report locks. - Track daily CTI enrichment usage in Redis (crowdsec:usage:{date}); warn once at 80% and pause lookups until tomorrow at CROWDSEC_CTI_DAILY_QUOTA (default 10000, 0 = unlimited) so a via-spread DDoS cannot burn the plan. - Add opt-in signal push to the CrowdSec community (CAPI watcher): stable auto-generated 48-char machine_id/password pair persisted in Redis (or via env), one-time registration, cached JWT login, optional Console enrollment, and POST /v3/signals with a ban decision, deduped per IP. Never throws and reports last status to the admin panel with a verify action. - Admin page: quota usage bar, reporting status/verify channel, and CrowdSec block reasons in the active-blocks list.	2026-09-23 14:24:44 +02:00
openhands	ee25545b7f	chore: pin Node.js toolchain to 26.10.0 ... Align the active runtime with the pinned version across .nvmrc, package.json engines and the Dockerfile base images, so scripts/check-node-toolchain.mjs passes on the CI host running Node 26.10.0.	2026-09-23 13:07:05 +02:00
openhands	f32a6dadd0	feat(security): auto-block repeat offenders via CrowdSec community reputation ... - new crowdsec-api lib: CTI lookup (GET /smoke/{ip}, freemium x-api-key), verdict parser with false-positive veto, 1h Redis + in-memory verdict cache, NX lock dedupe, 403/429 backoff; writes only the shared antiddos:block:{ip} key (value "crowdsec") and never touches Cloudflare - gate fires it fire-and-forget for IPs that already tripped a rate bucket, so known-bad IPs are hard-blocked before the local maxViolations threshold - runtime config: crowdsecAutoBlock toggle, score threshold (0-5, default 4), block TTL (default 24h); boot defaults CROWDSEC_AUTO_BLOCK_ENABLED / CROWDSEC_BLOCK_SCORE / CROWDSEC_BLOCK_TTL_SECONDS - admin panel: CrowdSec stat card, verify-connection action, score/TTL settings, CrowdSec source badge in the blocked-IPs list - credentials live in env only (CROWDSEC_API_KEY); block is enforced per-request via proxy on the resolved X-Forwarded-For / CF-Connecting-IP - tests: crowdsec-api unit suite + ddos-guard integration suite (early-block, threshold, cache dedupe, backoff)	2026-09-23 13:03:19 +02:00
openhands	64edb81ab7	docs: add Cloudflare & anti-DDoS setup guide to README	2026-09-22 23:38:54 +02:00
openhands	c56696b230	docs(env): document anti-DDoS thresholds and Cloudflare API auto-block vars	2026-09-22 23:37:39 +02:00
openhands	6264f9fb20	test(security): make Cloudflare block tests deterministic under CI Redis ... cloudflare-api unit tests drove the real Redis connection when REDIS_URL was set (CI), causing cross-test bleed. Mock @/lib/redis with an in-memory fake identical to the gate integration test.	2026-09-22 23:31:41 +02:00
openhands	4479753160	feat(security): mirror anti-DDoS blocks to Cloudflare edge via API ... - gate creates a zone IP Access Rule (block) for proxied offenders that hit the block threshold, deduped until the tiered block expires - cloudflare-api lib: verified endpoints, create/delete/verify/list helpers, Redis-backed tracking + 30s TTL sweep (instrumentation worker + admin render) - runtime toggle cloudflareAutoBlock in antiddos config; boot default CLOUDFLARE_AUTO_BLOCK_ENABLED - admin panel: Cloudflare edge-blocks card with verify + remove-rule actions; unban also lifts the edge block - credentials live in env only (CLOUDFLARE_API_TOKEN / CLOUDFLARE_ZONE_ID)	2026-09-22 23:27:15 +02:00
openhands	f0c27eb815	feat(security): Cloudflare-aware IP trust and admin-tunable anti-DDoS ... - resolveClientIp: trust cf-connecting-ip only behind cf-ray/cdn-loop, use nginx x-real-ip otherwise (anti-spoof) - antiddos-config: Redis-backed live config (antiddos:config) with 30s cache, 13 ANTI_DDOS_* env vars - ddos-guard: consume tunable rates/tiers via getAntiddosConfig - admin panel at /admin/devops/antiddos (save/reset/unban actions, PERMS.SETTINGS_VIEW) - register new admin page in housekeeping migration matrix (146 -> 147)	2026-09-22 22:22:51 +02:00
openhands	fd4d0fa1cb	feat(security): harden anti-DDoS gate with scanner triage, tiered blocks and in-process global halt	2026-09-22 21:57:09 +02:00
openhands	98a184953a	feat(security): add Redis-backed app-layer anti-DDoS rate limiting to proxy	2026-09-22 21:48:40 +02:00
openhands	d8f2a21011	deps: upgrade Next.js from 16.3.5 to 16.3.6 ... Bump the framework to the latest 16.3.6 patch release. Typecheck passes and the homepage renders (HTTP 200) on the dev server with Next 16.3.6 under Turbopack.	2026-09-22 21:31:34 +02:00
openhands	761bfb2940	ci: run unit, integration and UI tests as parallel jobs ... Split the heavy test suites out of the check job so coverage, MariaDB/Redis integration and Playwright UI tests run concurrently on the host runner (capacity raised to 4) instead of back-to-back (~2min wall-time saving). Deploy and preflight now gate on all three test jobs.	2026-09-22 21:18:49 +02:00
openhands	292268f418	ci: reuse host-playwright browser cache instead of re-downloading chromium ... Point PLAYWRIGHT_BROWSERS_PATH at the persistent /opt/ms-playwright dir on the host runner so 'playwright install chromium' is an instant no-op after the first run (was ~100s CDN download per job).	2026-09-22 21:10:15 +02:00
openhands	b2777634f7	ci: run all workflows on the self-hosted host runner ... - Switch test-runner and renovate workflows from ubuntu-latest to self-hosted now that a native host runner is running as a systemd service - Replace remaining hardcoded color utilities in the homepage with theme tokens and inline rgba styles to satisfy the no-hardcoded-colors contract - Restore dual UserAvatarThumbnail usage on the homepage (hero avatar stack plus community grid) to satisfy the public avatar presentation contract	2026-09-22 20:59:02 +02:00
openhands	628d24c0c7	feat(home): redesign landing page with cinematic hero and glass panels	2026-09-22 20:28:23 +02:00