Compare commits
1
Commits
main
..
8c3a0f4115
| Author | SHA1 | Date | |
|---|---|---|---|
 remco
|
8c3a0f4115 |
No files matched your search
@@ -78,6 +78,73 @@ CLOUDFLARE_AUTO_BLOCK_ENABLED=true
|
||||
# Override for tests/staging (production uses the public endpoint by default).
|
||||
CLOUDFLARE_API_BASE_URL=https://api.cloudflare.com/client/v4
|
||||
|
||||
# --- CROWDSEC API (community reputation auto-block, optional) ---
|
||||
# Free CTI API key: https://app.crowdsec.net/ → Settings → CTI API Keys.
|
||||
# When set, the anti-DDoS gate checks the community reputation of repeat
|
||||
# offenders (CTI GET /smoke/{ip}) and immediately hard-blocks known-bad IPs.
|
||||
# Lookups only happen for IPs that already tripped a rate bucket and are
|
||||
# cached in Redis for 1h, so quota usage stays minimal.
|
||||
CROWDSEC_API_KEY=
|
||||
# Runtime toggle for reputation-based auto-blocking (also overridable live
|
||||
# from the admin panel). Requires CROWDSEC_API_KEY.
|
||||
CROWDSEC_AUTO_BLOCK_ENABLED=true
|
||||
# Minimum malevolence score 0-5 (CrowdSec scale; 4-5 = "malicious") before an
|
||||
# IP is treated as known-bad. IPs with false-positive tags are never blocked.
|
||||
CROWDSEC_BLOCK_SCORE=4
|
||||
# How long a CrowdSec-confirmed bad IP stays blocked (seconds).
|
||||
CROWDSEC_BLOCK_TTL_SECONDS=86400
|
||||
# Endpoint — override only for tests/staging.
|
||||
CROWDSEC_CTI_BASE_URL=https://cti.api.crowdsec.net/v2
|
||||
# Daily enrichment-call ceiling (freemium plan ≈ 10k/day). Once today's
|
||||
# counter reaches it, reputation lookups pause until tomorrow so a spread
|
||||
# DDoS cannot silently burn the whole quota. 0 = unlimited.
|
||||
CROWDSEC_CTI_DAILY_QUOTA=10000
|
||||
# How many new community-reputation blocks within a 5-minute window justify an
|
||||
# ops alert (quota/backoff/report alerts all use HEALTH_ALERT_COOLDOWN_MIN).
|
||||
CROWDSEC_ALERT_BLOCK_BURST=10
|
||||
|
||||
# --- CROWDSEC SIGNAL PUSH (share our blocks back, optional) ---
|
||||
# Opt-in: pushes blocked IPs + behaviors to the CrowdSec Central API (CAPI) so
|
||||
# the community blocklist protects other members too. Set to "true" to enable.
|
||||
# Requires watcher credentials — either set both CROWDSEC_REPORT_MACHINE_ID
|
||||
# (48 chars, [A-Za-z0-9]) and CROWDSEC_REPORT_PASSWORD now, or leave them
|
||||
# unset and let the app generate a stable pair persisted in Redis automatically.
|
||||
CROWDSEC_REPORT_ENABLED=false
|
||||
CROWDSEC_REPORT_MACHINE_ID=
|
||||
CROWDSEC_REPORT_PASSWORD=
|
||||
# Optional: attachment key from https://app.crowdsec.net → Console settings —
|
||||
# links our watcher to your account so pushed signals show up there.
|
||||
CROWDSEC_REPORT_ENROLL_KEY=
|
||||
# Central API base — override only for tests/staging.
|
||||
CROWDSEC_CAPI_BASE_URL=https://api.crowdsec.net/v3
|
||||
|
||||
# --- CROWDSEC LOCAL (opt-in engine on this Docker host, no proxy changes) ---
|
||||
# App-layer LAPI bouncer: the anti-DDoS gate asks the local engine per client
|
||||
# IP (short-cached) and blocks ban/captcha decisions before its own buckets.
|
||||
# Start everything with `bash cms security`; it writes the key below into .env
|
||||
# and starts the CrowdSec engine bound to 127.0.0.1. Set to "true" to load the
|
||||
# bouncer without the local engine (not recommended).
|
||||
CROWDSEC_LOCAL_ENABLED=false
|
||||
# Host access-log directory mounted into the engine for detection (Nginx only).
|
||||
CROWDSEC_NGINX_LOG_DIR=/var/log/nginx
|
||||
# Change LAPI port AND LAPI URL together when 18080 is already taken.
|
||||
CROWDSEC_LAPI_PORT=18080
|
||||
CROWDSEC_LAPI_URL=http://127.0.0.1:18080
|
||||
# Generated by `bash cms security`; keep in .env, never commit a value.
|
||||
CROWDSEC_LAPI_API_KEY=
|
||||
# IP blocklist sync (`bash cms security blocklists`): space-separated URLs, by
|
||||
# default Spamhaus DROP/EDROP, DShield, CINS, Greensnow, StopForumSpam,
|
||||
# blocklist.de, Emerging Threats, abuse.ch Feodo/SSLBL/URLhaus, IPsum,
|
||||
# Firehol ipsets and Tor exit nodes. Requires internet to fetch; detection and
|
||||
# blocking stay local.
|
||||
#CROWDSEC_BLOCKLIST_SOURCES=https://www.spamhaus.org/drop/drop.txt https://example.org/list.txt
|
||||
# Expiration for each blocklist decision (re-synced keeps them fresh).
|
||||
#CROWDSEC_BLOCKLIST_DURATION=24h
|
||||
# Combined cap per sync (safety valve against excessive decisions).
|
||||
#CROWDSEC_BLOCKLIST_MAX_DECISIONS=1000000
|
||||
# Comma-separated IPs/CIDRs that a sync must always skip (allowlist).
|
||||
#CROWDSEC_BLOCKLIST_ALLOW=1.2.3.4,10.0.0.0/8
|
||||
|
||||
# --- PATHS ---
|
||||
BADGE_UPLOAD_DIR=./public/assets/images/badges
|
||||
EMULATOR_JAR_PATH=./emulator/Arcturus.jar
|
||||
|
||||
@@ -33,12 +33,6 @@ jobs:
|
||||
- name: Toolchain check
|
||||
run: node scripts/check-node-toolchain.mjs
|
||||
|
||||
# Port selection decides which blue/green slot stays live. Getting it
|
||||
# wrong starts the candidate on an occupied port, so the regression that
|
||||
# caused a failed deploy is covered here, before any image is built.
|
||||
- name: Deploy port-selection tests
|
||||
run: bash scripts/ci-deploy-ports.test.sh
|
||||
|
||||
- name: Install dependencies
|
||||
run: pnpm install --frozen-lockfile
|
||||
|
||||
|
||||
@@ -1,12 +1,5 @@
|
||||
image: node:26
|
||||
|
||||
# Runner containers have no systemd, so scripts/with-memory-cap.sh cannot
|
||||
# enforce an RSS cap there and correctly refuses to run unbounded. These
|
||||
# builds are already isolated inside their own runner container (not the
|
||||
# host) and use the webpack builder; opt out explicitly on purpose.
|
||||
variables:
|
||||
CMS_MEMORY_CAP_BACKEND: "none"
|
||||
|
||||
stages:
|
||||
- test
|
||||
- build
|
||||
|
||||
+27
-35
@@ -1,50 +1,40 @@
|
||||
# syntax=docker/dockerfile:1
|
||||
# Pin the runtime to the supported engine; update both stages deliberately.
|
||||
FROM node:26.10.0-alpine AS migrations
|
||||
WORKDIR /app
|
||||
ENV NEXT_TELEMETRY_DISABLED=1
|
||||
|
||||
# Installeer git, bash en pnpm v12. bash is nodig voor
|
||||
# scripts/with-memory-cap.sh (gebruikt bashisme zoals arrays en BASH_REMATCH);
|
||||
# Alpine levert geen bash mee.
|
||||
# Keep the bootstrap aligned with package.json packageManager.
|
||||
# The apk cache is persisted in a BuildKit cache mount so git is not
|
||||
# re-downloaded on every build.
|
||||
RUN --mount=type=cache,target=/var/cache/apk \
|
||||
apk add --no-cache git bash \
|
||||
&& npm install -g pnpm@12.10.1
|
||||
|
||||
# Stel het PATH zo in dat Alpine pnpm gegarandeerd overal herkent
|
||||
ENV PNPM_HOME="/usr/local/share/pnpm"
|
||||
ENV PATH="$PNPM_HOME:/usr/local/bin:$PATH"
|
||||
|
||||
apk add --no-cache git \
|
||||
&& npm install -g pnpm@11.25.0
|
||||
# The pnpm store is kept in a BuildKit cache mount that persists across builds
|
||||
# on the builder. This is what stops disk usage from growing unbounded: the
|
||||
# downloaded dependency store is shared and reused instead of being copied into
|
||||
# a fresh image layer on every build. Unlike an image layer it is also prunable
|
||||
# independently, so a hard cap (see ci-deploy.sh) keeps it bounded.
|
||||
ENV PNPM_HOME=/pnpm PNPM_STORE=/pnpm/store
|
||||
# pnpm-workspace.yaml + .npmrc must be present too: the lockfile records the
|
||||
# overrides from pnpm-workspace.yaml, and --frozen-lockfile rejects a build
|
||||
# where the workspace config is absent (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH).
|
||||
COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml* .npmrc* ./
|
||||
|
||||
# Voer de installatie uit met de pnpm v12 store cache-mount
|
||||
RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
|
||||
pnpm install --frozen-lockfile --ignore-scripts
|
||||
|
||||
# pnpm fetch: download all deps into the shared cache-mounted store.
|
||||
RUN --mount=type=cache,target=/pnpm \
|
||||
pnpm fetch --ignore-scripts
|
||||
# Install offline from the cache-mounted store; the store itself stays in the
|
||||
# build cache between builds.
|
||||
RUN --mount=type=cache,target=/pnpm \
|
||||
pnpm install --frozen-lockfile --ignore-scripts --offline
|
||||
COPY . .
|
||||
ARG NEXT_DEPLOYMENT_ID="unknown"
|
||||
LABEL org.opencontainers.image.revision="$NEXT_DEPLOYMENT_ID"
|
||||
|
||||
FROM migrations AS builder
|
||||
ARG NEXT_DEPLOYMENT_ID="unknown"
|
||||
ENV NEXT_DEPLOYMENT_ID="$NEXT_DEPLOYMENT_ID"
|
||||
|
||||
# The build runs the webpack builder (see the `build` script in package.json).
|
||||
# Turbopack's compiler is a single native process that grows past 12GB RSS on
|
||||
# this 329-route app and gets OOM-killed; webpack peaks around 5GB. A
|
||||
# --max-old-space-size cap does NOT help, because that memory is native
|
||||
# Turbopack memory rather than the V8 heap.
|
||||
#
|
||||
# `pnpm run build` goes through scripts/with-memory-cap.sh. BuildKit's build
|
||||
# container has /sys/fs/cgroup mounted read-only (no cgroup MemoryMax) and
|
||||
# `ulimit -v` breaks V8-based builds (see the script header), so this stage
|
||||
# explicitly opts out of the cap. The real bound here is the webpack builder
|
||||
# + the V8 heap cap above, and the build runs isolated in its own container,
|
||||
# not on the host; the host itself is protected by the same wrapper through
|
||||
# systemd.
|
||||
ENV NODE_OPTIONS="--max-old-space-size=4096"
|
||||
ENV CMS_MEMORY_CAP_BACKEND=none
|
||||
|
||||
# Bouw de Next.js applicatie met caching
|
||||
# Fixture values exist only for this build command; production secrets are runtime-only.
|
||||
# Cache Next.js build output and webpack caches so rebuilds only redo the
|
||||
# changed parts.
|
||||
RUN --mount=type=cache,target=/app/.next/cache \
|
||||
DATABASE_URL="mysql://build:[email protected]:9/build" \
|
||||
HOTEL_NAME="Build fixture" APP_URL="http://localhost:3002" \
|
||||
@@ -72,6 +62,8 @@ COPY --from=builder --chown=nextjs:nextjs /app/drizzle/migrations ./drizzle/migr
|
||||
COPY --chown=nextjs:nextjs scripts/docker-start.mjs ./docker-start.mjs
|
||||
USER nextjs
|
||||
EXPOSE 3002
|
||||
# Self-contained healthcheck so `docker run` (ci-deploy) also gets Docker-level
|
||||
# health; docker-compose overrides this with its own probe if needed.
|
||||
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
|
||||
CMD ["node", "-e", "fetch('http://127.0.0.1:'+(process.env.PORT||'3002')+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
|
||||
ENTRYPOINT ["/sbin/tini", "--"]
|
||||
|
||||
@@ -838,6 +838,132 @@ Open **DevOps → Anti-DDoS protection**
|
||||
|
||||
---
|
||||
|
||||
## Local CrowdSec Engine (opt-in)
|
||||
|
||||
The repository ships a self-contained CrowdSec engine that runs on the same
|
||||
Docker host. It runs `crowdsecurity/crowdsec:v1.8.1` in its own Compose project
|
||||
and exposes **LAPI only** on `127.0.0.1:18080`. When enabled, the app-layer
|
||||
anti-DDoS gate (`src/lib/crowdsec-local.ts`) asks the local LAPI per client IP
|
||||
(short-cached) and blocks `ban` / `captcha` decisions before its own rate
|
||||
buckets run. No reverse-proxy, Traefik, Cloudflare or firewall configuration is
|
||||
changed.
|
||||
|
||||
The engine boots in **LAPI-only mode** (`DISABLE_AGENT=true`): it does not
|
||||
consume the host Nginx access log and needs no outbound access to
|
||||
`crowdsec.net`, which is often blocked on hardened hosts. Combined with
|
||||
`DISABLE_ONLINE_API=true` (no CrowdSec Central API) the engine needs no account
|
||||
and no inbound internet — blocking comes from the imported blocklists
|
||||
(Step 4) and the app's own rate buckets. Re-enable the agent only on a host
|
||||
with outbound internet by removing `DISABLE_AGENT: "true"` from
|
||||
`deployment/crowdsec/compose.crowdsec.yml`.
|
||||
|
||||
### Step 1 — Enable the engine and register the bouncer
|
||||
|
||||
```bash
|
||||
bash cms security
|
||||
```
|
||||
|
||||
This generates `CROWDSEC_LAPI_API_KEY` (random 64 hex chars), writes the
|
||||
CrowdSec flags into `.env`, starts the engine and registers the `cms` bouncer
|
||||
against the local LAPI. The engine does **not** enroll into the CrowdSec
|
||||
Central API (`DISABLE_ONLINE_API=true`) and runs without the agent
|
||||
(`DISABLE_AGENT=true`), so it never phones home.
|
||||
|
||||
### Step 2 — Restart the CMS so it loads the bouncer credentials
|
||||
|
||||
A CI-managed `epicnext-cms-app` picks the new `.env` values up on its next
|
||||
deployment. For a clone running via the updater:
|
||||
|
||||
```bash
|
||||
bash cms update --skip-pull
|
||||
```
|
||||
|
||||
or restart the container directly (`docker compose restart cms`). Without the
|
||||
restart the gate has not loaded the LAPI URL/key yet.
|
||||
|
||||
### Step 3 — Verify
|
||||
|
||||
```bash
|
||||
bash cms security status
|
||||
```
|
||||
|
||||
Expect `CROWDSEC_LOCAL_ENABLED=yes` and `LAPI health: OK (127.0.0.1:18080)`.
|
||||
In the admin panel, **DevOps → Anti-DDoS protection** shows live block
|
||||
statistics split per origin (`community` vs `local`).
|
||||
|
||||
### Step 4 — Stop the engine again (optional)
|
||||
|
||||
```bash
|
||||
bash cms security disable
|
||||
```
|
||||
|
||||
Stops the container and sets `CROWDSEC_LOCAL_ENABLED=false`. Volumes and the
|
||||
`.env` key are kept.
|
||||
|
||||
### Step 5 — Load external IP blocklists (optional)
|
||||
|
||||
The engine has no built-in lists, so provide your own via a one-shot sync
|
||||
(fetches the sources, replaces every previous `cscli-import` decision):
|
||||
|
||||
```bash
|
||||
bash cms security blocklists
|
||||
```
|
||||
|
||||
Defaults: Spamhaus DROP/EDROP, DShield, CINS, Greensnow, StopForumSpam,
|
||||
Binary Defense, blocklist.de, Emerging Threats, BruteForceBlocker, abuse.ch
|
||||
Feodo/SSLBL, Darklist, Botvrij, IPsum, Firehol ipsets and Tor exit nodes
|
||||
(26 sources). URLhaus was removed because its `text_online` feed lists URLs,
|
||||
not IPs; a malformed token in it could otherwise expand into a bogus
|
||||
huge CIDR. The validator only accepts whole-line bare IPs or proper CIDRs,
|
||||
enforces sane prefix bounds and drops reserved/private/loopback space, so a
|
||||
bad source entry can never block the origin or internal traffic. The largest
|
||||
commercial/crowdsourced lists (AbuseIPDB, MaxMind, Cisco Talos, AlienVault
|
||||
OTX) are not included because they require an account or API key; IPsum
|
||||
already aggregates ~30 additional feeds. No account is needed, but internet
|
||||
access is — only for fetching; detection and blocking remain local. Sync
|
||||
hourly as a cron job:
|
||||
|
||||
```bash
|
||||
bash cms security blocklists-install-cron
|
||||
```
|
||||
|
||||
Removal: `bash cms security blocklists-uninstall-cron`. Dry-run without
|
||||
touching LAPI: `bash cms security blocklists --dry-run`. Override the sources,
|
||||
duration, a combined cap or an allowlist in `.env`
|
||||
(`CROWDSEC_BLOCKLIST_SOURCES`, `CROWDSEC_BLOCKLIST_DURATION`,
|
||||
`CROWDSEC_BLOCKLIST_MAX_DECISIONS`, `CROWDSEC_BLOCKLIST_ALLOW`). Existing
|
||||
`cscli-import` decisions are replaced on every sync, so removed entries
|
||||
expire.
|
||||
|
||||
### Environment variables
|
||||
|
||||
| Variable | Default | Purpose |
|
||||
| ---------------------------- | ----------------------------- | ------------------------------------ |
|
||||
| `CROWDSEC_LOCAL_ENABLED` | `false` | Master switch for the local stack |
|
||||
| `CROWDSEC_LAPI_URL` | `http://127.0.0.1:18080` | LAPI endpoint (loopback only) |
|
||||
| `CROWDSEC_LAPI_PORT` | `18080` | Host port the engine maps to LAPI |
|
||||
| `CROWDSEC_LAPI_API_KEY` | — | Bouncer key; required when enabled |
|
||||
| `CROWDSEC_LAPI_TIMEOUT_MS` | `500` | Per-decision request timeout |
|
||||
| `CROWDSEC_LAPI_RETRY_MS` | `500` | Backoff before retrying LAPI |
|
||||
| `CROWDSEC_NGINX_LOG_DIR` | `/var/log/nginx` | Access-log directory for the engine |
|
||||
|
||||
### Notes and limitations
|
||||
|
||||
- Changing the port means updating `CROWDSEC_LAPI_PORT` **and**
|
||||
`CROWDSEC_LAPI_URL` together, then re-running `bash cms security`.
|
||||
- Rotate the key by editing `CROWDSEC_LAPI_API_KEY` in `.env`, running
|
||||
`bash cms security` again (re-registers the bouncer) and restarting the CMS.
|
||||
- The gate is **fail-closed at startup** when the feature is enabled without a
|
||||
key (startup aborts with a clear message). At runtime a LAPI network error
|
||||
**fails open** (traffic is allowed, decisions paused); a 403 from LAPI
|
||||
pauses local decisions for 5 minutes.
|
||||
- This bouncer is **application-layer**: it sheds known-bad IPs at the CMS
|
||||
process only. It does not drop traffic before the origin, does not protect
|
||||
other host ports/services, and depends on the client IP being trustworthy at
|
||||
the ingress. Keep the upstream protections (Cloudflare IP rules, proxy rate
|
||||
limits) for defense before the origin.
|
||||
|
||||
---
|
||||
|
||||
## Production Deployment (blue/green)
|
||||
|
||||
@@ -875,24 +1001,6 @@ that the CI deploy path deliberately uses `docker run` rather than compose, so
|
||||
the resource limits are declared in **both** places — limits that only existed
|
||||
in compose would never apply to a real release.
|
||||
|
||||
### Compose on a CI host
|
||||
|
||||
Compose and CI both want port 3002, so only one of them can own a host. A stray
|
||||
compose replica (`docker compose up`, or the daily `scripts/docker-update.sh`
|
||||
cron) parked an `epicnext-cms` container on the blue slot while nginx served the
|
||||
green slot, and every later release stopped on "Port 3002 is already in use" —
|
||||
after the build, the migrations and the browser gate. Two guards now prevent
|
||||
that:
|
||||
|
||||
- `scripts/docker-update.sh` refuses to run on a CI host. It used to test only
|
||||
`epicnext-cms-app`, but after a cutover to the green slot that container is
|
||||
stopped and deleted, so the guard stopped firing while the host stayed
|
||||
CI-managed. It now checks both slot containers and the nginx upstream.
|
||||
- `ci-deploy.sh` retires a compose replica of *this* checkout
|
||||
(`com.docker.compose.project.config_files`) from the candidate port before
|
||||
starting the candidate — but never a slot container, and never the port nginx
|
||||
currently serves. Anything else still fails loudly in `assert_port_free`.
|
||||
|
||||
### The nginx upstream is the switch
|
||||
|
||||
nginx does not know about container names; it reads a plain list of backends from
|
||||
@@ -969,7 +1077,7 @@ branch guard inside `ci-deploy.sh` only accepts `main`/`master`.
|
||||
| `pnpm db:bulk` | Batch-import >50 MB JSON via `scripts/bulk-import-json.ts` |
|
||||
| `pnpm db:up` / `pnpm db:down` | Start / stop the `mariadb-turbo` container |
|
||||
| `pnpm gamedata:compress` | Pre-compress large gamedata JSON to `.gz` (gzip_static) |
|
||||
| `pnpm analyze` | Build + report per-route bundle sizes |
|
||||
| `pnpm analyze` | Build + open bundle analyzer |
|
||||
| `pnpm jobs:worker` | Start background task worker |
|
||||
| `pnpm biome:check` | Lint and format code |
|
||||
|
||||
@@ -1098,7 +1206,7 @@ The CMS automatically translates furniture names and descriptions to **13 langua
|
||||
pnpm dev # Start with hot reload
|
||||
pnpm typecheck # Type check all files
|
||||
pnpm test # Run test suite
|
||||
pnpm analyze # Build and report per-route bundle sizes
|
||||
pnpm analyze # Build and analyze bundle sizes
|
||||
pnpm biome:check # Lint and format
|
||||
```
|
||||
|
||||
|
||||
-24
@@ -38,30 +38,6 @@
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"includes": [
|
||||
"src/components/admin/catalog-manager/sortable-tree.tsx",
|
||||
"src/components/admin/studio/organize-imports-dialog/mall-helpers.tsx",
|
||||
"src/app/admin/import/furni/nitro-editor-dialog.tsx"
|
||||
],
|
||||
"linter": {
|
||||
"rules": {
|
||||
"suspicious": {
|
||||
"noArrayIndexKey": "off"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"includes": ["src/components/admin/catalog-manager/sortable-tree.tsx"],
|
||||
"linter": {
|
||||
"rules": {
|
||||
"correctness": {
|
||||
"useExhaustiveDependencies": "off"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"css": {
|
||||
|
||||
@@ -4,6 +4,7 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
case "${1:-help}" in
|
||||
install) shift; exec bash "$DIR/scripts/docker-install.sh" "$@" ;;
|
||||
update) shift; exec bash "$DIR/scripts/docker-update.sh" "$@" ;;
|
||||
help|--help|-h) printf '%s\n' 'bash cms install Configure and install on a Linux Docker host' 'bash cms update Update using saved settings; --skip-pull uses checked-out release' ;;
|
||||
*) echo "Unknown command. Use: bash cms install | update" >&2; exit 1 ;;
|
||||
security) shift; exec bash "$DIR/scripts/crowdsec-setup.sh" "$@" ;;
|
||||
help|--help|-h) printf '%s\n' 'bash cms install Configure and install on a Linux Docker host' 'bash cms update Update using saved settings; --skip-pull uses checked-out release' 'bash cms security Configure the opt-in local CrowdSec stack (enable|status|disable|blocklists)' ;;
|
||||
*) echo "Unknown command. Use: bash cms install | update | security" >&2; exit 1 ;;
|
||||
esac
|
||||
@@ -0,0 +1,4 @@
|
||||
filenames:
|
||||
- /var/log/nginx/access.log
|
||||
labels:
|
||||
type: nginx
|
||||
@@ -0,0 +1,41 @@
|
||||
services:
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:${CROWDSEC_VERSION:-v1.8.1}
|
||||
container_name: epicnext-crowdsec
|
||||
restart: unless-stopped
|
||||
profiles: ["security"]
|
||||
environment:
|
||||
DISABLE_AGENT: "true"
|
||||
BOUNCER_KEY_cms: ${CROWDSEC_LAPI_API_KEY:?CROWDSEC_LAPI_API_KEY must be set}
|
||||
DISABLE_ONLINE_API: "true"
|
||||
GID: "${CROWDSEC_GID:-0}"
|
||||
TZ: "${TZ:-UTC}"
|
||||
ports:
|
||||
- "${CROWDSEC_LAPI_BIND_HOST:-127.0.0.1}:${CROWDSEC_LAPI_PORT:-18080}:8080"
|
||||
volumes:
|
||||
- ./acquis.d:/etc/crowdsec/acquis.d:ro
|
||||
- ${CROWDSEC_NGINX_LOG_DIR:-/var/log/nginx}:/var/log/nginx:ro
|
||||
- crowdsec-config:/etc/crowdsec
|
||||
- crowdsec-data:/var/lib/crowdsec/data
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
pids_limit: 256
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: "10m"
|
||||
max-file: "3"
|
||||
healthcheck:
|
||||
test:
|
||||
[
|
||||
"CMD-SHELL",
|
||||
"wget -q -O - http://127.0.0.1:8080/health >/dev/null 2>&1",
|
||||
]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 30s
|
||||
|
||||
volumes:
|
||||
crowdsec-config:
|
||||
crowdsec-data:
|
||||
@@ -162,22 +162,6 @@ server {
|
||||
ssl_early_data on;
|
||||
add_header Alt-Svc 'h3=":9443"; ma=86400' always;
|
||||
|
||||
# Resuming a session skips the full handshake, which is most of the cost of
|
||||
# a TLS connection. Without this nginx performs no session resumption at all:
|
||||
# every visitor paid a full handshake on every request. 50M shared sessions
|
||||
# is roughly 1GB at the default 20-byte key id plus overhead.
|
||||
ssl_session_cache shared:CMS_TLS:50m;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_tickets off;
|
||||
|
||||
# `index index.html` without a `root` left nginx resolving every
|
||||
# try_files/$uri against the compiled-in default /etc/nginx/html. The
|
||||
# /robots.txt and /favicon.ico probes then stat() a path the worker cannot
|
||||
# traverse, and because a failed stat is logged at crit the error log filled
|
||||
# with 149 crit lines per scan. Pointing root at the CMS document root makes
|
||||
# the same probe a plain 404, which log_not_found already suppresses.
|
||||
root /var/www/html;
|
||||
|
||||
index index.html;
|
||||
|
||||
# ─── Security Headers ───
|
||||
@@ -382,21 +366,8 @@ server {
|
||||
add_header Cache-Tag "cms-camera";
|
||||
}
|
||||
|
||||
# robots.txt is generated by the CMS (src/app/robots.ts, force-dynamic
|
||||
# because it needs APP_URL) and sitemap.xml points crawlers at it. This
|
||||
# location used to answer from disk with try_files, which made it a
|
||||
# guaranteed 404: the file does not exist in public/, so crawlers were told
|
||||
# to obey a robots.txt they could never read. Proxy it like the route it
|
||||
# actually is. favicon.ico below stays on disk — log_not_found already
|
||||
# keeps its miss quiet.
|
||||
location = /robots.txt {
|
||||
access_log off;
|
||||
proxy_pass http://cms_app;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
|
||||
location = /favicon.ico { expires 1y; access_log off; log_not_found off; try_files $uri =404; }
|
||||
location = /robots.txt { expires 1d; access_log off; log_not_found off; try_files $uri =404; }
|
||||
|
||||
# ─── Static Next.js Assets ───
|
||||
location /_next/static/ {
|
||||
|
||||
@@ -1,39 +0,0 @@
|
||||
[Unit]
|
||||
# The scheduled-job worker (scheduled articles, catalog export, backups, disk
|
||||
# and health probes). This is NOT optional: a web process alone does not
|
||||
# establish that scheduled work runs. The CMS reports it as a failed
|
||||
# diagnostic row when the Redis heartbeat at cms:jobs-worker:heartbeat is
|
||||
# missing, which is exactly what happened while nothing supervised this.
|
||||
#
|
||||
# It runs on the host rather than in a container on purpose: the schedule
|
||||
# shells out to mysqldump, df and docker, none of which exist in the CMS image,
|
||||
# and it must survive CMS deploys (a container is replaced on every release).
|
||||
Description=AtomNext CMS scheduled-job worker
|
||||
Documentation=https://gitlab.epicnabbo.nl/remco/EpicNext-Cms
|
||||
After=network-online.target docker.service mariadb.service
|
||||
Wants=network-online.target
|
||||
# Start ordering only; the worker tolerates the database being briefly absent
|
||||
# and retries, so do not make it hard-fail when mariadb is slow to boot.
|
||||
Wants=docker.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=root
|
||||
WorkingDirectory=/var/www/atom-nexst
|
||||
Environment=NODE_ENV=production
|
||||
ExecStart=/usr/bin/node --conditions=react-server --import tsx scripts/jobs-worker.ts
|
||||
# The worker's own catch-all logs and exits 1 on a fatal error, so a restart is
|
||||
# always wanted. 10s backoff stops a persistent misconfiguration (missing .env,
|
||||
# bad DATABASE_URL) from spinning.
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
# Give a crashed job time to finish its DB transaction before the next start,
|
||||
# otherwise a mid-transaction kill can loop on the same failure.
|
||||
TimeoutStopSec=30
|
||||
KillSignal=SIGTERM
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
SyslogIdentifier=cms-jobs-worker
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,19 +0,0 @@
|
||||
[Service]
|
||||
# systemd's default is 1024:524288, i.e. a *soft* LimitNOFILE of 1024. nginx
|
||||
# inherits that soft limit, so worker_connections 2048 could not actually be
|
||||
# reached and every start logged:
|
||||
# "2048 worker_connections exceed open file resource limit: 1024"
|
||||
# Raise both soft and hard to 65536 so the master's rlimit covers
|
||||
# worker_connections before nginx is even started.
|
||||
LimitNOFILE=65536
|
||||
|
||||
# The packaged unit ships Restart=no, so a crashed or OOM-killed nginx stayed
|
||||
# down until someone noticed. nginx is the only thing serving the site, so it
|
||||
# must come back on its own. `on-failure` restarts only abnormal exits, which
|
||||
# keeps an operator-initiated `systemctl stop` from being undone.
|
||||
Restart=on-failure
|
||||
RestartSec=2
|
||||
|
||||
# Give in-flight requests time to drain on stop/reload instead of severing
|
||||
# keepalive connections and long-polling SSE streams mid-response.
|
||||
TimeoutStopSec=30
|
||||
+40
-3
@@ -1,5 +1,18 @@
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# Next.js CMS — blue/green
|
||||
#
|
||||
# De app draait met `network_mode: host`, dus een replica neemt een host-poort in
|
||||
# plaats van een gedeelde docker-poort. Daarom twee expliciete services in plaats
|
||||
# van `docker compose up --scale cms=2`: die zou op poort 3002 botsen.
|
||||
#
|
||||
# `deploy.sh` start een release op de vrije poort, wacht op /api/health, schrijft
|
||||
# daarna /etc/nginx/snippets/cms_upstream_servers.conf en herlaadt nginx. Pas dan
|
||||
# wordt de oude replica gestopt. De hele release is dus zero-downtime: faalt de
|
||||
# nieuwe replica, dan blijft de oude gewoon draaien.
|
||||
#
|
||||
# De YAML-anchor houdt beide replicas identiek. Wil je ze bewust uit elkaar
|
||||
# halen (bv. één release canary-en), verwijder dan `<<: *cms` en vul de
|
||||
# afwijkende velden opnieuw in.
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
x-cms: &cms
|
||||
image: epicnext-cms:${CMS_RELEASE:-local}
|
||||
@@ -10,6 +23,8 @@ x-cms: &cms
|
||||
NEXT_DEPLOYMENT_ID: ${CMS_RELEASE:-unknown}
|
||||
network: host
|
||||
network_mode: host
|
||||
# 15s: Next moet een lopend request nog netjes kunnen afronden voordat SIGKILL
|
||||
# volgt. Met 10s werden streams en imports afgekapt.
|
||||
stop_grace_period: 15s
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
@@ -21,11 +36,20 @@ x-cms: &cms
|
||||
- /var/www/Gamedata:/var/www/Gamedata
|
||||
|
||||
# ── Resource limits ──
|
||||
mem_limit: 6g
|
||||
memswap_limit: 7g
|
||||
# De limieten waren eerder weggehaald ("Next mag onbeperkt presteren"). Op een
|
||||
# gedeelde host is juist dat gevaarlijk: één geheugenlek vult dan de hele
|
||||
# machine en MariaDB + nginx + Traefik gaan er allemaal onderuit. 4 GiB met
|
||||
# 1 GiB swap geeft de V8-heap ruimte om zich te organiseren voor hij hard wordt
|
||||
# afgesneden, maar houdt de schade begrensd. 2 CPU laat drie keer zoveel
|
||||
# achtergrondwerk toe als de cores, zodat de 6 cores van deze host niet
|
||||
# volledig door twee replicas worden opgeëist.
|
||||
mem_limit: 4g
|
||||
memswap_limit: 5g
|
||||
cpus: 2.0
|
||||
pids_limit: 512
|
||||
|
||||
# Leest de poort uit de eigen omgeving, dus dezelfde healthcheck werkt voor
|
||||
# 3002 én 3003 zonder dat deze tweemaal in de compose hoeft te staan.
|
||||
healthcheck:
|
||||
test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:'+(process.env.PORT||'3002')+'/api/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))"]
|
||||
interval: 15s
|
||||
@@ -34,6 +58,7 @@ x-cms: &cms
|
||||
start_period: 40s
|
||||
|
||||
services:
|
||||
# Blauwe replica: host-poort 3002.
|
||||
cms:
|
||||
<<: *cms
|
||||
container_name: epicnext-cms
|
||||
@@ -41,6 +66,8 @@ services:
|
||||
- HOSTNAME=0.0.0.0
|
||||
- PORT=3002
|
||||
|
||||
# Groene replica: host-poort 3003. Meestal uitgeschakeld; alleen tijdens een
|
||||
# release gestart, totdat nginx hem in de upstream-lijst heeft overgenomen.
|
||||
cms-green:
|
||||
<<: *cms
|
||||
container_name: epicnext-cms-green
|
||||
@@ -49,6 +76,7 @@ services:
|
||||
- HOSTNAME=0.0.0.0
|
||||
- PORT=3003
|
||||
|
||||
# ── Byparr (Cloudflare bypass for clone sources) ──
|
||||
byparr:
|
||||
image: ghcr.io/thephaseless/byparr:latest
|
||||
container_name: byparr
|
||||
@@ -56,10 +84,19 @@ services:
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- LOG_LEVEL=INFO
|
||||
|
||||
# Resource limits verwijderd: Headless Chrome heeft bij zware pagina-scrapes
|
||||
# soms tijdelijk meer dan 1 GB RAM nodig. Nu krijgt hij alle ruimte.
|
||||
pids_limit: 256
|
||||
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "http://localhost:8191/health"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 30s
|
||||
start_period: 30s
|
||||
|
||||
# De database draait niet meer in Docker. `mariadb-turbo` is verwijderd: de
|
||||
# service is nooit gestart, de volume bestond niet, en de echte MariaDB draait
|
||||
# al als host-proces op 127.0.0.1:3306. De optimalisatie-vlaggen daar stonden
|
||||
# dus al langer niets meer in beheer.
|
||||
@@ -85,6 +85,24 @@ The direct template intentionally records the CDN/edge socket address when place
|
||||
|
||||
`pnpm test:integration` additionally starts disposable Nginx containers from the actual templates, supplies a temporary test certificate, and sends real HTTPS requests with forged identity headers. It checks direct-mode replacement even with an inherited real-IP rule, rejection of untrusted peers, and acceptance through an explicitly trusted peer. This requires Docker Engine and the OpenSSL CLI and does not read deployment credentials. The templates must still pass `nginx -t` on the intended host after its hostname/certificate substitution, then the listener and trusted-header checks above; the disposable fixture cannot certify that host or its firewall.
|
||||
|
||||
## Opt-in: CrowdSec on the same Docker host
|
||||
|
||||
A self-contained CrowdSec engine ships in `deployment/crowdsec`. It runs `crowdsecurity/crowdsec:v1.8.1` in its own Compose project in **LAPI-only mode** (`DISABLE_AGENT=true`) and exposes LAPI only on `127.0.0.1:18080`. No reverse-proxy, Traefik, Cloudflare or firewall configuration is changed.
|
||||
|
||||
```sh
|
||||
bash cms security
|
||||
```
|
||||
|
||||
The command generates `CROWDSEC_LAPI_API_KEY`, writes the CrowdSec flags into `.env`, starts the engine and registers the `cms` bouncer. The anti-DDoS gate then consults the local LAPI per client IP (short-cached) and blocks `ban`/`captcha` decisions before its own rate buckets. `bash cms security status` reports engine state and `bash cms security disable` stops the engine and flips the toggle off.
|
||||
|
||||
The engine does not enroll into the CrowdSec Central API (`DISABLE_ONLINE_API=true`) and runs without the agent (`DISABLE_AGENT=true`), so it needs no account and no outbound access to `crowdsec.net` (often blocked on hardened hosts). Blocking comes from the imported blocklists plus the app's own rate buckets; it does not parse the host Nginx log. The app still has its separate opt-in traffic-sharing channel via `CROWDSEC_REPORT_ENABLED`. Change `CROWDSEC_LAPI_PORT` and `CROWDSEC_LAPI_URL` together when `18080` is already in use. `CROWDSEC_NGINX_LOG_DIR` is honored for when the agent is re-enabled.
|
||||
|
||||
This bouncer is application-layer: it sheds known-bad IPs at the CMS process and only for traffic that reaches the Next.js proxy. It does not drop traffic before the origin, does not protect other host ports/services, and depends on the client IP being trustworthy at the ingress. Keep the upstream protections (Cloudflare IP rules, proxy rate limits) for defense before the origin.
|
||||
|
||||
The running CMS loads the new env values on its next restart or deployment. For a CI-managed `epicnext-cms-app`, the next deploy (which sources `.env`) applies them; for a clone, `bash cms update --skip-pull` restarts it. `.env` now holds the LAPI key — keep its permissions restrictive.
|
||||
|
||||
External IP blocklists (Spamhaus, DShield, CINS, blocklist.de, abuse.ch, IPsum, Firehol, Tor exit nodes, …) can be synced into the local LAPI with `bash cms security blocklists`, and hourly with `bash cms security blocklists-install-cron` (no account, but internet to fetch). Configure via `CROWDSEC_BLOCKLIST_*`.
|
||||
|
||||
## Routine and selected-release updates
|
||||
|
||||
```sh
|
||||
|
||||
@@ -12,25 +12,17 @@ The command writes `report.json` and `report.md` and prints the Markdown report.
|
||||
|
||||
For each configured App Router route, resolve its exact app path using `app-path-routes-manifest.json` and `server/app-paths-manifest.json`. Read its generated `page_client-reference-manifest.js` as a JSON assignment **without executing JavaScript**. Use its sibling `page/build-manifest.json`, falling back to the root build manifest only if that sibling is absent.
|
||||
|
||||
The **initial entry envelope** is the union of route bootstrap `rootMainFilesTree[appPath]` (or `rootMainFiles`) and every client chunk that route's client-reference manifest lists. This includes layout, page and boundary/loading entries.
|
||||
|
||||
The manifest exposes those chunks differently per bundler. Turbopack emits an explicit per-segment `entryJSFiles` map; webpack emits no such field and records chunks only per client module, as `clientModules[*].chunks`, in `[chunkId, fileName, chunkId, fileName, …]` order. The report reads `entryJSFiles` when present and otherwise derives the same envelope from `clientModules`, which is the source Next's own `static-routes-info` uses. Numeric chunk ids are skipped; a malformed chunk *path* still fails rather than being dropped, so a broken manifest cannot quietly under-report a route.
|
||||
|
||||
> The build runs webpack (`next build --webpack`), so the `clientModules` path is the live one. An earlier revision only read `entryJSFiles`, and after the switch to webpack every route reported `unavailable` while the command still exited 0 — the budgets were silently not being measured. When a bundler switch changes the manifest layout again, re-check this section rather than trusting a clean exit.
|
||||
|
||||
The definition follows the data exposed by the installed Next 16.3.8 build and the `getLinkAndScriptTags` / `getRequiredScripts` renderer helpers; it is deliberately a build-artifact envelope, not a browser network trace. Conditional rendering, redirects, streaming and browser caches can change actual requests.
|
||||
The **initial entry envelope** is the union of route bootstrap `rootMainFilesTree[appPath]` (or `rootMainFiles`) and every `entryJSFiles` list in that route's client-reference manifest. This includes layout, page and boundary/loading entries. The definition follows the data exposed by the installed Next 16.3.4 Turbopack build and the `getLinkAndScriptTags` / `getRequiredScripts` renderer helpers; it is deliberately a build-artifact envelope, not a browser network trace. Conditional rendering, redirects, streaming and browser caches can change actual requests.
|
||||
|
||||
- Raw bytes are filesystem byte lengths of unique JavaScript assets in that envelope.
|
||||
- Gzip bytes are the **sum of independent gzip level 9 compressions** of those files using the recorded Node/zlib runtime. They are not gzip of concatenated source, nor observed CDN transfer sizes.
|
||||
- Deployment query strings and `/_next/` prefixes are normalized before deduplication. Shared files count once per route; each route is measured independently, with no misleading cross-route total.
|
||||
- Legacy `nomodule` polyfills are measured separately, outside the modern initial budget. CSS, source maps, images, external scripts, HTML/RSC payloads and async-only chunks absent from the manifest's chunk lists are excluded.
|
||||
- Legacy `nomodule` polyfills are measured separately, outside the modern initial budget. CSS, source maps, images, external scripts, HTML/RSC payloads and async-only chunks absent from `entryJSFiles` are excluded.
|
||||
- This report makes no claims about execution cost, LCP, hydration time or real-user performance.
|
||||
|
||||
## Initial limits
|
||||
|
||||
The first limits are **baseline bytes × 1.15, rounded upward to the next 10 KiB (10,240 bytes)** independently for raw and gzip. They are provisional size alerts, not validated speed targets. Baseline: local production build `build-TfctsWXpff2fKS`, Next 16.3.4 **Turbopack**; its source commit was not inferred.
|
||||
|
||||
The production build now runs webpack, so the numbers it reports are not directly comparable to the baseline below. Re-measured on the current webpack build the routes land at `/me` 786138/247738, `/news` 781601/245672, `/events` 782011/245923, `/search` 783262/246578, `/admin/catalog` 1172089/370843, `/admin/studio/furni` 1374128/440546 (raw/gzip). All remain inside the limits below, but `/admin/studio/furni` sits at ~98% of its gzip limit, so the next dependency added to that route will trip it. Recalibrate the table and `scripts/performance-budgets.json` together if the intent is to reset the baseline on webpack.
|
||||
The first limits are **baseline bytes × 1.15, rounded upward to the next 10 KiB (10,240 bytes)** independently for raw and gzip. They are provisional size alerts, not validated speed targets. Baseline: existing local production build `build-TfctsWXpff2fKS`, Next 16.3.4; its source commit was not inferred.
|
||||
|
||||
| Route | Baseline raw bytes | Baseline gzip bytes | Raw limit | Gzip limit |
|
||||
| --- | ---: | ---: | ---: | ---: |
|
||||
|
||||
@@ -156,14 +156,7 @@ beforeAll(async () => {
|
||||
process.env.REDIS_URL = `redis://:${redisPassword}@${redisContainer.getHost()}:${redisContainer.getMappedPort(6379)}/0`;
|
||||
delete process.env.SKIP_ENV_VALIDATION;
|
||||
delete process.env.OPENAI_API_KEY;
|
||||
// Deliberately NOT "test": cache.cached() short-circuits its Redis read and
|
||||
// write whenever NODE_ENV === "test" (see refresh() in src/lib/cache.ts).
|
||||
// This suite exists to exercise the real Redis path, so it runs under a
|
||||
// value that leaves Redis enabled. "development" is used because it is the
|
||||
// only non-production value src/env.ts accepts. Vitest's own environment is
|
||||
// still configured via vitest.integration.config.ts. Object.assign is used
|
||||
// because process.env.NODE_ENV is typed read-only.
|
||||
Object.assign(process.env, { NODE_ENV: "development" });
|
||||
Object.assign(process.env, { NODE_ENV: "test" });
|
||||
process.env.HOTEL_NAME = "Integration";
|
||||
|
||||
await connection.query(
|
||||
@@ -387,8 +380,7 @@ describe("Redis application cache", () => {
|
||||
let fetches = 0;
|
||||
const fetch = async () => ({ revision: ++fetches });
|
||||
expect(await cache.cached(key, 60_000, fetch)).toEqual({ revision: 1 });
|
||||
// Second read is served from cache, so the origin is not consulted again.
|
||||
expect(await cache.cached(key, 60_000, fetch)).toEqual({ revision: 1 });
|
||||
expect(await appRedis?.get(key)).toBe('{"revision":1}');
|
||||
expect(await appRedis?.ttl(key)).toBeGreaterThan(0);
|
||||
cache.invalidateMemory(key);
|
||||
expect(await cache.cached(key, 60_000, fetch)).toEqual({ revision: 1 });
|
||||
@@ -409,9 +401,6 @@ describe("Redis application cache", () => {
|
||||
expect(await cache.cached(first, 60_000, async () => "updated")).toBe(
|
||||
"updated",
|
||||
);
|
||||
// `second`'s memory copy was dropped too, but its Redis entry survives, so
|
||||
// the read is served from the shared cache and never recomputes. This is
|
||||
// what makes the two entries independent.
|
||||
expect(await cache.cached(second, 60_000, async () => "wrong")).toBe(
|
||||
"second",
|
||||
);
|
||||
@@ -629,9 +618,6 @@ describe("real news publication, scheduling and cache delivery", () => {
|
||||
expect(existing.status).toBe("draft");
|
||||
expect(existing.publishedAt).toBeNull();
|
||||
expect(await publicNews.getPublishedArticle(existing.slug)).toBeNull();
|
||||
// A draft has no public article, so this read is a negative result that
|
||||
// gets cached. Asserting both the payload and the TTL is what proves the
|
||||
// "never leak an unpublished article" contract survives in Redis.
|
||||
const negativeRevision = await appRedis?.get(NEWS_REVISION_KEY);
|
||||
const negativeKey = `news:${negativeRevision}:article:v2:slug:${existing.slug}`;
|
||||
expect(await appRedis?.get(negativeKey)).toBe("null");
|
||||
@@ -851,7 +837,6 @@ describe("real news publication, scheduling and cache delivery", () => {
|
||||
expect(await publicNews.getPublishedArticle(existing.slug)).toBeNull();
|
||||
const negativeRevision = await redis.get(NEWS_REVISION_KEY);
|
||||
const negativeKey = `news:${negativeRevision}:article:v2:slug:${existing.slug}`;
|
||||
// Cached negative results are stored as the JSON encoding of null.
|
||||
expect(await redis.get(negativeKey)).toBe("null");
|
||||
const publish = articleForm({
|
||||
id: String(existing.id),
|
||||
|
||||
+35
-35
@@ -5,10 +5,10 @@
|
||||
"engines": {
|
||||
"node": ">=26.10.0 <27"
|
||||
},
|
||||
"packageManager": "pnpm@12.10.1",
|
||||
"packageManager": "pnpm@12.6.0+sha512.3ef68f951cb111ac204b4a5a16f0b2ddf0da56a96e0413e81d855d9f0b55ef926714709028e1cd00c405c2c5fb7b9e8ec4dc46777c805d0373c2f2ff00fd20ec",
|
||||
"scripts": {
|
||||
"dev": "pnpm assets:editor && bash scripts/with-memory-cap.sh 8g next dev",
|
||||
"build": "pnpm assets:editor && bash scripts/with-memory-cap.sh 10g next build --webpack",
|
||||
"dev": "pnpm assets:editor && next dev",
|
||||
"build": "pnpm assets:editor && next build",
|
||||
"start": "next start",
|
||||
"toolchain:check": "node scripts/check-node-toolchain.mjs",
|
||||
"lint": "biome check .",
|
||||
@@ -16,9 +16,9 @@
|
||||
"format": "biome format --write .",
|
||||
"diag:permissions": "tsx scripts/diagnose-permission-page.ts",
|
||||
"jobs:worker": "node --conditions=react-server --import tsx scripts/jobs-worker.ts",
|
||||
"test": "bash scripts/with-memory-cap.sh 8g vitest run --coverage.enabled=false",
|
||||
"test:coverage": "bash scripts/with-memory-cap.sh 8g vitest run",
|
||||
"typecheck": "bash scripts/with-memory-cap.sh 6g tsc --noEmit",
|
||||
"test": "vitest run --coverage.enabled=false",
|
||||
"test:coverage": "vitest run",
|
||||
"typecheck": "tsc --noEmit",
|
||||
"db:generate": "drizzle-kit generate",
|
||||
"db:introspect": "drizzle-kit introspect",
|
||||
"db:bulk": "tsx scripts/bulk-import-json.ts",
|
||||
@@ -30,27 +30,27 @@
|
||||
"db:studio": "drizzle-kit studio",
|
||||
"gamedata:compress": "node scripts/compress-gamedata.mjs",
|
||||
"hk:matrix:check": "tsx scripts/verify-housekeeping-matrix.ts",
|
||||
"test:housekeeping": "bash scripts/with-memory-cap.sh 8g vitest run --coverage.enabled=false src/features/housekeeping src/lib/admin-theme-source-audit.test.ts src/lib/admin/authorization-contract.test.ts",
|
||||
"test:housekeeping": "vitest run --coverage.enabled=false src/features/housekeeping src/lib/admin-theme-source-audit.test.ts src/lib/admin/authorization-contract.test.ts",
|
||||
"assets:editor": "node scripts/copy-editor-assets.mjs",
|
||||
"deps:audit": "pnpm audit --audit-level=high",
|
||||
"analyze": "pnpm assets:editor && bash scripts/with-memory-cap.sh 10g next build --webpack && node scripts/performance-report.mjs --output-dir build-reports",
|
||||
"analyze": "next experimental-analyze",
|
||||
"i18n:check": "node scripts/audit-cms-translations.mjs --check",
|
||||
"i18n:audit": "node scripts/audit-cms-translations.mjs",
|
||||
"test:e2e": "bash scripts/with-memory-cap.sh 8g playwright test",
|
||||
"test:news:real": "bash scripts/with-memory-cap.sh 8g node --import tsx e2e/news-real/run.ts",
|
||||
"test:ui": "bash scripts/with-memory-cap.sh 8g playwright test --config playwright.ui.config.ts",
|
||||
"test:ui:update": "bash scripts/with-memory-cap.sh 8g playwright test --config playwright.ui.config.ts --update-snapshots",
|
||||
"test:e2e": "playwright test",
|
||||
"test:news:real": "node --import tsx e2e/news-real/run.ts",
|
||||
"test:ui": "playwright test --config playwright.ui.config.ts",
|
||||
"test:ui:update": "playwright test --config playwright.ui.config.ts --update-snapshots",
|
||||
"performance:report": "node scripts/performance-report.mjs",
|
||||
"test:integration": "bash scripts/with-memory-cap.sh 8g vitest run --config vitest.integration.config.ts"
|
||||
"test:integration": "vitest run --config vitest.integration.config.ts"
|
||||
},
|
||||
"dependencies": {
|
||||
"@base-ui/react": "1.8.0",
|
||||
"@dnd-kit/core": "6.3.1",
|
||||
"@dnd-kit/sortable": "10.0.0",
|
||||
"@dnd-kit/utilities": "3.2.2",
|
||||
"@formatjs/icu-messageformat-parser": "3.5.21",
|
||||
"@formatjs/icu-messageformat-parser": "3.5.20",
|
||||
"@hookform/resolvers": "5.9.1",
|
||||
"@tanstack/react-query": "5.104.1",
|
||||
"@tanstack/react-query": "5.104.0",
|
||||
"@tanstack/react-virtual": "3.14.13",
|
||||
"class-variance-authority": "0.7.1",
|
||||
"clsx": "2.1.1",
|
||||
@@ -59,53 +59,53 @@
|
||||
"drizzle-orm": "0.45.3",
|
||||
"hash-wasm": "4.12.0",
|
||||
"ioredis": "6.0.0",
|
||||
"isomorphic-dompurify": "^4.5.0",
|
||||
"isomorphic-dompurify": "^4.4.0",
|
||||
"jpeg-js": "0.4.4",
|
||||
"jsonc-parser": "3.3.1",
|
||||
"jszip": "3.10.2",
|
||||
"lucide-react": "1.52.0",
|
||||
"lucide-react": "1.48.0",
|
||||
"lzma-wasm": "1.0.7",
|
||||
"motion": "14.0.0",
|
||||
"music-metadata": "12.0.0",
|
||||
"mysql2": "3.24.5",
|
||||
"next": "16.4.0",
|
||||
"motion": "13.4.4",
|
||||
"music-metadata": "11.16.1",
|
||||
"mysql2": "3.24.4",
|
||||
"next": "16.3.6",
|
||||
"next-auth": "5.0.0-beta.32",
|
||||
"next-intl": "4.14.9",
|
||||
"next-intl": "4.14.7",
|
||||
"otplib": "13.5.0",
|
||||
"pino": "10.4.0",
|
||||
"pino": "10.3.1",
|
||||
"react": "19.3.0",
|
||||
"react-dom": "19.3.0",
|
||||
"react-hook-form": "7.89.0",
|
||||
"resend": "6.32.1",
|
||||
"resend": "6.30.0",
|
||||
"server-only": "0.0.1",
|
||||
"sharp": "^0.35.5",
|
||||
"sonner": "2.0.8",
|
||||
"tailwind-merge": "3.7.0",
|
||||
"tinymce": "8.9.3",
|
||||
"tinymce": "8.9.2",
|
||||
"zod": "4.6.5"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@axe-core/playwright": "4.13.0",
|
||||
"@babel/parser": "8.0.7",
|
||||
"@biomejs/biome": "2.5.15",
|
||||
"@babel/parser": "7.29.9",
|
||||
"@biomejs/biome": "2.5.14",
|
||||
"@playwright/test": "1.63.0",
|
||||
"@tailwindcss/forms": "0.5.11",
|
||||
"@tailwindcss/postcss": "4.3.3",
|
||||
"@tailwindcss/typography": "0.5.20",
|
||||
"@types/node": "26.6.4",
|
||||
"@types/node": "26.6.3",
|
||||
"@types/react": "19.3.0",
|
||||
"@types/react-dom": "19.3.0",
|
||||
"@vitest/coverage-v8": "5.0.3",
|
||||
"@vitest/coverage-v8": "5.0.2",
|
||||
"drizzle-kit": "0.31.11",
|
||||
"esbuild": "0.28.2",
|
||||
"msw": "^2.15.0",
|
||||
"pino-pretty": "13.2.0",
|
||||
"postcss": "8.5.29",
|
||||
"msw": "2.15.0",
|
||||
"pino-pretty": "13.1.3",
|
||||
"postcss": "8.5.28",
|
||||
"tailwindcss": "4.3.3",
|
||||
"testcontainers": "12.2.0",
|
||||
"testcontainers": "12.1.0",
|
||||
"tsx": "4.23.15",
|
||||
"typescript": "7.0.2",
|
||||
"vite": "8.3.3",
|
||||
"vitest": "5.0.3"
|
||||
"vite": "8.3.1",
|
||||
"vitest": "5.0.2"
|
||||
}
|
||||
}
|
||||
Generated
+391
-465
File diff suppressed because it is too large.
Load diff
@@ -16,4 +16,3 @@ overrides:
|
||||
glob: '^11.0.0'
|
||||
'@esbuild-kit/core-utils': 'npm:tsx@^4.23.15'
|
||||
'@esbuild-kit/esm-loader': 'npm:tsx@^4.23.15'
|
||||
source-map-js: '1.2.2'
|
||||
Binary file not shown.
@@ -0,0 +1,3 @@
|
||||
{
|
||||
"$schema": "https://docs.renovatebot.com/renovate-schema.json"
|
||||
}
|
||||
@@ -0,0 +1,258 @@
|
||||
#!/usr/bin/env bash
|
||||
set -Eeuo pipefail
|
||||
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
cd "$DIR"
|
||||
ENV_FILE="$DIR/.env"
|
||||
COMPOSE_FILE="deployment/crowdsec/compose.crowdsec.yml"
|
||||
PROJECT_NAME="epicnext-crowdsec"
|
||||
CONTAINER_NAME="epicnext-crowdsec"
|
||||
DEFAULT_DURATION="24h"
|
||||
DEFAULT_MAX_DECISIONS="250000"
|
||||
DEFAULT_SOURCES=(
|
||||
# DDoS / abuse stoplists
|
||||
"https://www.spamhaus.org/drop/drop.txt"
|
||||
"https://www.spamhaus.org/drop/edrop.txt"
|
||||
"https://www.dshield.org/block.txt"
|
||||
"https://cinsscore.com/list/ci-badguys.txt"
|
||||
"https://blocklist.greensnow.co/greensnow.txt"
|
||||
"https://www.stopforumspam.com/downloads/toxic_ip_cidr.txt"
|
||||
"https://www.binarydefense.com/banlist.txt"
|
||||
# Brute force / credential stuffing
|
||||
"https://lists.blocklist.de/lists/all.txt"
|
||||
"https://lists.blocklist.de/lists/ssh.txt"
|
||||
"https://lists.blocklist.de/lists/apache.txt"
|
||||
"https://rules.emergingthreats.net/blockrules/compromised-ips.txt"
|
||||
"https://danger.rulez.sk/projects/bruteforceblocker/blist.php"
|
||||
# Malware C2 / botnets
|
||||
"https://feodotracker.abuse.ch/downloads/ipblocklist.txt"
|
||||
"https://sslbl.abuse.ch/blacklist/sslipblacklist.txt"
|
||||
"https://www.botvrij.eu/data/ioclist.ip-dst.raw"
|
||||
# Live SSH/spam attackers (last 48h), bare IPs only
|
||||
"https://www.darklist.de/raw.php"
|
||||
# Aggregated threat intel
|
||||
"https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt"
|
||||
"https://raw.githubusercontent.com/stamparm/ipsum/master/levels/2.txt"
|
||||
# Firehol ipsets (security scanners, abusers, proxies, anonymous)
|
||||
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset"
|
||||
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level2.netset"
|
||||
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_abusers_1d.netset"
|
||||
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_abusers_30d.netset"
|
||||
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_proxies.netset"
|
||||
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_anonymous.netset"
|
||||
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level3.netset"
|
||||
# Tor exit nodes
|
||||
"https://check.torproject.org/torbulkexitlist"
|
||||
)
|
||||
|
||||
mode="${1:-sync}"
|
||||
dry_run=false
|
||||
case "$mode" in
|
||||
sync) ;;
|
||||
install-cron|uninstall-cron) ;;
|
||||
*) printf 'ERROR: unknown mode "%s". Modes: sync [--dry-run] | install-cron | uninstall-cron\n' "$mode" >&2; exit 1 ;;
|
||||
esac
|
||||
[[ "${2:-}" = --dry-run ]] && dry_run=true
|
||||
|
||||
umask 077
|
||||
fail() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
|
||||
for command in docker curl flock; do command -v "$command" >/dev/null || fail "Required command: $command"; done
|
||||
docker compose version >/dev/null 2>&1 || fail "Docker Compose plugin required."
|
||||
exec 9>"$DIR/.deploy.lock"
|
||||
flock -w 30 9 || fail "Another installation, update or sync is running."
|
||||
[[ -f "$ENV_FILE" ]] || fail "Create .env first (bash cms install)."
|
||||
|
||||
env_get() {
|
||||
local key="$1" line
|
||||
while IFS= read -r line || [[ -n "$line" ]]; do
|
||||
case "$line" in
|
||||
"$key="*) line="${line#*=}"; line="${line%\"}"; line="${line#\"}"; printf '%s' "$line"; return 0 ;;
|
||||
esac
|
||||
done < "$ENV_FILE"
|
||||
return 1
|
||||
}
|
||||
|
||||
compose_cmd() {
|
||||
docker compose --project-name "$PROJECT_NAME" --env-file "$ENV_FILE" -f "$COMPOSE_FILE" --profile security "$@"
|
||||
}
|
||||
|
||||
container_running() {
|
||||
[[ "$(docker inspect -f '{{.State.Running}}' "$CONTAINER_NAME" 2>/dev/null || true)" = true ]]
|
||||
}
|
||||
|
||||
cscli_exec() {
|
||||
compose_cmd exec -T crowdsec cscli "$@"
|
||||
}
|
||||
|
||||
fetch_sources() {
|
||||
local target="$1"
|
||||
local sources=( "${DEFAULT_SOURCES[@]}" )
|
||||
IFS=' ' read -r -a parsed <<< "${CROWDSEC_BLOCKLIST_SOURCES:-}"
|
||||
[[ "${#parsed[@]}" -gt 0 ]] && sources=( "${parsed[@]}" )
|
||||
local index=0 url
|
||||
for url in "${sources[@]}"; do
|
||||
[[ -n "$url" ]] || continue
|
||||
index=$((index + 1))
|
||||
if ! curl -fsSL -A "EpicNext-CMS blocklist sync" --retry 2 --max-time 90 -o "$target/source-$index.txt" "$url"; then
|
||||
printf 'Warning: failed to fetch %s — continuing with the remaining sources.\n' "$url"
|
||||
else
|
||||
printf 'Fetched %s\n' "$url"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
install_cron() {
|
||||
mkdir -p "$DIR/logs"
|
||||
local cron_line="0 * * * * /usr/bin/env bash $DIR/scripts/blocklists-sync.sh >> $DIR/logs/blocklists-sync.log 2>&1"
|
||||
if crontab -l 2>/dev/null | grep -Fq "$DIR/scripts/blocklists-sync.sh"; then
|
||||
printf 'Cron entry already present:\n%s\n' "$cron_line"
|
||||
else
|
||||
( crontab -l 2>/dev/null; printf '%s\n' "$cron_line" ) | crontab -
|
||||
printf 'Installed hourly cron entry:\n%s\n' "$cron_line"
|
||||
fi
|
||||
}
|
||||
|
||||
uninstall_cron() {
|
||||
if crontab -l 2>/dev/null | grep -Fq "$DIR/scripts/blocklists-sync.sh"; then
|
||||
crontab -l 2>/dev/null | grep -Fv "$DIR/scripts/blocklists-sync.sh" | crontab -
|
||||
printf 'Removed cron entry matching %s.\n' "$DIR/scripts/blocklists-sync.sh"
|
||||
else
|
||||
printf 'No cron entry to remove.\n'
|
||||
fi
|
||||
}
|
||||
|
||||
if [[ "$mode" = install-cron ]]; then
|
||||
install_cron
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [[ "$mode" = uninstall-cron ]]; then
|
||||
uninstall_cron
|
||||
exit 0
|
||||
fi
|
||||
|
||||
duration="$(env_get CROWDSEC_BLOCKLIST_DURATION 2>/dev/null || true)"
|
||||
[[ -n "$duration" ]] || duration="$DEFAULT_DURATION"
|
||||
max_decisions="$(env_get CROWDSEC_BLOCKLIST_MAX_DECISIONS 2>/dev/null || true)"
|
||||
[[ -n "$max_decisions" ]] || max_decisions="$DEFAULT_MAX_DECISIONS"
|
||||
[[ "$max_decisions" =~ ^[0-9]+$ ]] || fail "CROWDSEC_BLOCKLIST_MAX_DECISIONS must be a number."
|
||||
allowlist="${CROWDSEC_BLOCKLIST_ALLOW:-$(env_get CROWDSEC_BLOCKLIST_ALLOW 2>/dev/null || true)}"
|
||||
|
||||
work="$(mktemp -d "$DIR/.blocklists.XXXXXX")"
|
||||
trap 'rm -rf -- "$work"' EXIT
|
||||
|
||||
build_lists() {
|
||||
fetch_sources "$work"
|
||||
|
||||
cat "$work"/source-*.txt 2>/dev/null | awk '{print $1}' \
|
||||
| grep -E '^([0-9]{1,3}\.){3}[0-9]{1,3}(/[0-9]{1,2})?$|^([0-9a-fA-F]{1,4}:){2,}[0-9a-fA-F:]*[0-9a-fA-F](/[0-9]{1,3})?$' \
|
||||
| awk '
|
||||
# Only globally routable attacker space may become a decision. Reserved,
|
||||
# private, loopback, link-local, CGNAT, test and multicast ranges never
|
||||
# represent an external attacker and must not be imported (they could
|
||||
# otherwise block the origin itself or internal traffic).
|
||||
function isReserved4(prefix, a, b, c) {
|
||||
if (a == 0 || a == 127 || a >= 224) return 1
|
||||
if (a == 10) return 1
|
||||
if (a == 100 && (prefix < 10 || (prefix >= 10 && b >= 64 && b <= 127))) return 1
|
||||
if (a == 169 && (prefix < 16 || (prefix >= 16 && b == 254))) return 1
|
||||
if (a == 172 && (prefix < 12 || (prefix >= 12 && b >= 16 && b <= 31))) return 1
|
||||
if (a == 192 && b == 168) return 1
|
||||
if (a == 192 && b == 0) return 1
|
||||
if ((a == 198 && (b == 18 || b == 19)) || (a == 198 && b == 51 && c == 100)) return 1
|
||||
if (a == 203 && b == 0 && c == 113) return 1
|
||||
return 0
|
||||
}
|
||||
function isReserved6(line, prefix, first, h) {
|
||||
if (prefix < 32) return 1
|
||||
if (line ~ /^::/) return 1
|
||||
first = tolower(line); sub(/^::?/, "", first); sub(/:.*/, "", first)
|
||||
h = "0x" substr(first, 1, 2)
|
||||
if (h >= 252) return 1 # ULA fc00::/7, link-local fe80::/10, multicast ff00::/8
|
||||
return 0
|
||||
}
|
||||
{
|
||||
if (index($0, "/") > 0) {
|
||||
n = split($0, seg, "/")
|
||||
if (n != 2 || seg[2] !~ /^[0-9]+$/) next
|
||||
if (index(seg[1], ":") > 0) {
|
||||
pref = seg[2] + 0
|
||||
if (pref < 32 || pref > 128) next
|
||||
if (isReserved6(seg[1], pref)) next
|
||||
print
|
||||
next
|
||||
}
|
||||
pref = seg[2] + 0
|
||||
if (pref < 8 || pref > 32) next
|
||||
split(seg[1], oct, ".")
|
||||
ok = 1
|
||||
for (i = 1; i <= 4; i++) {
|
||||
if (oct[i] !~ /^[0-9]+$/ || oct[i] + 0 > 255) { ok = 0; break }
|
||||
if (length(oct[i]) > 1 && oct[i] ~ /^0/) { ok = 0; break }
|
||||
}
|
||||
if (!ok) next
|
||||
if (isReserved4(pref, oct[1] + 0, oct[2] + 0, oct[3] + 0)) next
|
||||
print
|
||||
next
|
||||
}
|
||||
if (index($0, ":") > 0) {
|
||||
if (isReserved6($0, 128)) next
|
||||
print
|
||||
next
|
||||
}
|
||||
n = split($0, part, ".")
|
||||
if (n != 4) next
|
||||
ok = 1
|
||||
for (i = 1; i <= 4; i++) {
|
||||
if (part[i] !~ /^[0-9]+$/ || part[i] + 0 > 255) { ok = 0; break }
|
||||
if (length(part[i]) > 1 && part[i] ~ /^0/) { ok = 0; break }
|
||||
}
|
||||
if (!ok) next
|
||||
if (isReserved4(32, part[1] + 0, part[2] + 0, part[3] + 0)) next
|
||||
print
|
||||
}' \
|
||||
| sort -u > "$work/candidates.txt"
|
||||
|
||||
if [[ -n "$allowlist" ]]; then
|
||||
printf '%s\n' "$allowlist" | tr ',' '\n' | while IFS= read -r line; do printf '%s\n' "$line"; done | sort -u > "$work/allow.txt"
|
||||
comm -23 "$work/candidates.txt" "$work/allow.txt" > "$work/final.txt"
|
||||
else
|
||||
cp "$work/candidates.txt" "$work/final.txt"
|
||||
fi
|
||||
|
||||
if [[ "$(wc -l < "$work/final.txt" | tr -d ' ')" -gt "$max_decisions" ]]; then
|
||||
sort -u "$work/final.txt" | head -n "$max_decisions" > "$work/final.limited.txt" || true
|
||||
mv "$work/final.limited.txt" "$work/final.txt"
|
||||
printf 'Note: capped the combined list at %s decisions (CROWDSEC_BLOCKLIST_MAX_DECISIONS).\n' "$max_decisions"
|
||||
fi
|
||||
|
||||
count_total=$(wc -l < "$work/final.txt" | tr -d ' ')
|
||||
count_ip=$(grep -cv '/' "$work/final.txt" || true)
|
||||
count_range=$(grep -c '/' "$work/final.txt" || true)
|
||||
if [[ "$count_total" -lt 1 ]]; then
|
||||
fail "No valid addresses could be parsed from the configured sources. Configure CROWDSEC_BLOCKLIST_SOURCES."
|
||||
fi
|
||||
}
|
||||
|
||||
build_lists
|
||||
|
||||
printf 'Parsed %s targets (%s IPs, %s ranges).\n' "$count_total" "$count_ip" "$count_range"
|
||||
|
||||
if $dry_run; then
|
||||
printf 'Dry run: would replace the cscli-import decisions with these %s targets.\n' "$count_total"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
container_running || fail "The CrowdSec engine is not running. Start it first with: bash cms security"
|
||||
|
||||
printf 'Removing previous cscli-import decisions...\n'
|
||||
cscli_exec decisions delete --origin cscli-import >/dev/null 2>&1 || true
|
||||
|
||||
{
|
||||
printf 'duration,scope,value\n'
|
||||
awk -v d="$duration" '{ if (index($0, "/") > 0) printf "%s,range,%s\n", d, $0; else printf "%s,ip,%s\n", d, $0 }' "$work/final.txt"
|
||||
} > "$work/import.csv"
|
||||
|
||||
printf 'Importing %s decisions into the local LAPI (duration %s)...\n' "$count_total" "$duration"
|
||||
cscli_exec decisions import -i - --format csv --batch 1000 < "$work/import.csv"
|
||||
|
||||
printf 'Done. The app bouncer picks these up within a few seconds.\n'
|
||||
@@ -45,28 +45,11 @@ for (const image of nodeImages) {
|
||||
);
|
||||
}
|
||||
|
||||
const cmpVersion = (a, b) => {
|
||||
const pa = a.split(".").map((part) => Number.parseInt(part, 10));
|
||||
const pb = b.split(".").map((part) => Number.parseInt(part, 10));
|
||||
for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
|
||||
const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
|
||||
if (diff !== 0) return diff;
|
||||
}
|
||||
return 0;
|
||||
};
|
||||
|
||||
// `.nvmrc` is the recommended version for reproducible local development and
|
||||
// the exact Docker base image (both asserted above), but the *runtime* we run
|
||||
// on may be any version the package.json engines range accepts. Requiring an
|
||||
// exact patch match here would fail on every Node.js patch release, even when
|
||||
// the version is explicitly supported.
|
||||
if (!process.argv.includes("--static")) {
|
||||
const active = process.versions.node;
|
||||
const upperBound = `${major + 1}.0.0`;
|
||||
assert.ok(
|
||||
cmpVersion(active, pinnedVersion) >= 0 &&
|
||||
cmpVersion(active, upperBound) < 0,
|
||||
`the active Node.js runtime (${active}) must satisfy package.json engines.node (${packageJson.engines.node}); .nvmrc pins ${pinnedVersion} as the recommended version`,
|
||||
assert.equal(
|
||||
process.versions.node,
|
||||
pinnedVersion,
|
||||
"the active Node.js runtime must match .nvmrc",
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
@@ -1,124 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Tests for the port-selection and port-conflict logic in scripts/ci-deploy.sh.
|
||||
#
|
||||
# Background: on a host where both blue/green slots answer /api/health, the
|
||||
# original read_active_port() counted healthy slots and only consulted the nginx
|
||||
# upstream when the count was not exactly 1. With two healthy slots it fell back
|
||||
# to the upstream file, but an operator `docker compose up` can leave an extra
|
||||
# replica behind, after which the fallback picked slot A regardless of which slot
|
||||
# was really live. The candidate then tried to start on an occupied port, and the
|
||||
# health probe answered from the pre-existing container on that port instead of
|
||||
# the candidate — producing 30 failed "expected release never became healthy"
|
||||
# attempts against a release that was never serving.
|
||||
#
|
||||
# The functions are extracted from ci-deploy.sh rather than copied so this test
|
||||
# cannot drift from the script it protects.
|
||||
set -Eeuo pipefail
|
||||
|
||||
deploy_script="$(dirname "$0")/ci-deploy.sh"
|
||||
[[ -r "$deploy_script" ]] || { echo "cannot read $deploy_script" >&2; exit 1; }
|
||||
|
||||
# Pull the two functions out of the real script.
|
||||
extract() {
|
||||
sed -n "/^$1() {/,/^}/p" "$deploy_script"
|
||||
}
|
||||
|
||||
read_active_port_fn="$(extract read_active_port)"
|
||||
assert_port_free_fn="$(extract assert_port_free)"
|
||||
answers_health_fn="$(extract answers_health)"
|
||||
|
||||
if [ -z "$read_active_port_fn" ] || [ -z "$assert_port_free_fn" ] || [ -z "$answers_health_fn" ]; then
|
||||
echo "could not extract functions from $deploy_script" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
slot_a_port=3002
|
||||
slot_b_port=3003
|
||||
|
||||
fail() { echo "FAIL: $*" >&2; exit 1; }
|
||||
|
||||
# ── read_active_port ──────────────────────────────────────────────────────────
|
||||
# $1 = upstream body ("none" for a missing file), $2..$3 = ports that answer.
|
||||
run_read_active_port() {
|
||||
local body="$1" a="$2" b="$3" tmp
|
||||
tmp="$(mktemp)"
|
||||
if [ "$body" = "none" ]; then
|
||||
tmp=/tmp/ci-deploy-test-nonexistent-upstream-$$
|
||||
rm -f "$tmp"
|
||||
else
|
||||
printf '%s\n' "$body" >"$tmp"
|
||||
fi
|
||||
CMS_UPSTREAM_FILE="$tmp" \
|
||||
PORT_A_HEALTHY="$a" PORT_B_HEALTHY="$b" \
|
||||
bash -c "
|
||||
slot_a_port=$slot_a_port
|
||||
slot_b_port=$slot_b_port
|
||||
upstream_file=\"\$CMS_UPSTREAM_FILE\"
|
||||
$read_active_port_fn
|
||||
# Defined after the extracted function on purpose: answers_health is a
|
||||
# collaborator here, and the test substitutes a deterministic stub for it.
|
||||
answers_health() {
|
||||
local p=\$1 want
|
||||
case \$p in
|
||||
$slot_a_port) want=\"\$PORT_A_HEALTHY\" ;;
|
||||
$slot_b_port) want=\"\$PORT_B_HEALTHY\" ;;
|
||||
*) want='' ;;
|
||||
esac
|
||||
[ \"\$want\" = yes ]
|
||||
}
|
||||
read_active_port
|
||||
echo
|
||||
" 2>/dev/null
|
||||
rm -f "$tmp"
|
||||
}
|
||||
|
||||
# nginx points at slot B and both answer -> trust the upstream file.
|
||||
got="$(run_read_active_port 'server 127.0.0.1:3003 max_fails=2;' yes yes)"
|
||||
[ "$got" = "$slot_b_port" ] || fail "nginx->3003 with both healthy: got '$got', want 3003"
|
||||
|
||||
got="$(run_read_active_port 'server 127.0.0.1:3002 max_fails=2;' yes yes)"
|
||||
[ "$got" = "$slot_a_port" ] || fail "nginx->3002 with both healthy: got '$got', want 3002"
|
||||
|
||||
# The regression: both healthy, nginx points at B, but slot A is an unrelated
|
||||
# leftover replica. The upstream file is the only thing that knows which slot is
|
||||
# live, so it must win.
|
||||
got="$(run_read_active_port 'server 127.0.0.1:3003 max_fails=2;' yes yes)"
|
||||
[ "$got" != "$slot_a_port" ] || fail "both healthy: fell back to slot A while nginx serves 3003"
|
||||
|
||||
# Upstream names a dead slot: fall back to a slot that actually answers, never to
|
||||
# the dead port itself.
|
||||
got="$(run_read_active_port 'server 127.0.0.1:3002 max_fails=2;' no yes)"
|
||||
[ "$got" = "$slot_b_port" ] || fail "nginx->3002 unhealthy, B healthy: got '$got', want 3003"
|
||||
|
||||
# Nothing answers at all: read_active_port still has to name a slot, otherwise the
|
||||
# rollback path has no target.
|
||||
got="$(run_read_active_port 'server 127.0.0.1:3003 max_fails=2;' no no)"
|
||||
[ "$got" = "$slot_b_port" ] || fail "nothing healthy: got '$got', want the upstream port 3003"
|
||||
|
||||
# No upstream file at all: pick a slot that answers.
|
||||
got="$(run_read_active_port none no yes)"
|
||||
[ "$got" = "$slot_b_port" ] || fail "no upstream, B healthy: got '$got', want 3003"
|
||||
|
||||
got="$(run_read_active_port none yes no)"
|
||||
[ "$got" = "$slot_a_port" ] || fail "no upstream, A healthy: got '$got', want 3002"
|
||||
|
||||
# ── assert_port_free ─────────────────────────────────────────────────────────
|
||||
# Runs against real loopback ports: 3999 is intentionally unused, so the check
|
||||
# must report it free.
|
||||
bash -c "
|
||||
$assert_port_free_fn
|
||||
assert_port_free 3999 candidate >/dev/null 2>&1
|
||||
" || fail "a port with no listener must be reported as free"
|
||||
|
||||
# On this host 3002 is held by a CMS container, so the check must fail. Skip when
|
||||
# it genuinely is free, otherwise the assertion would be meaningless.
|
||||
if ss -ltn 2>/dev/null | grep -qE '127\.0\.0\.1:3002|0\.0\.0\.0:3002'; then
|
||||
if bash -c "
|
||||
$assert_port_free_fn
|
||||
assert_port_free 3002 candidate >/dev/null 2>&1
|
||||
"; then
|
||||
fail "an occupied port must be rejected, but assert_port_free returned success"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo 'Deploy port-selection tests passed'
|
||||
+28
-181
@@ -76,13 +76,6 @@ healthy() {
|
||||
return 1
|
||||
}
|
||||
|
||||
# Zelfde check als `healthy`, maar zonder retries. Voor het bepalen van de
|
||||
# actieve poort willen we geen 90 seconden per slot wachten: daar gaat het om
|
||||
# een al draaiend proces dat nu of nooit antwoordt.
|
||||
answers_health() {
|
||||
curl -sf --max-time 5 "http://127.0.0.1:$1/api/health" | grep -q '"database":true'
|
||||
}
|
||||
|
||||
# Staat er een blue/green-upstream? Zonder die bestanden blijft dit script op de
|
||||
# oude, in-place cutover vallen, zodat een host met een andere nginx-indeling
|
||||
# niet stilvalt op een upgrade.
|
||||
@@ -92,156 +85,29 @@ detect_blue_green() {
|
||||
return 0
|
||||
}
|
||||
|
||||
# Welke poort is op dit moment ÉCHT live?
|
||||
#
|
||||
# Volgorde van vertrouwen:
|
||||
# 1. Het nginx-upstream-bestand. Dat is de enige bron die aangeeft wáár het
|
||||
# publieke verkeer daadwerkelijk binnenkomt; alles daaronder is gevolg.
|
||||
# 2. Een gezond slot dat overeenkomt met die aanwijzing.
|
||||
# 3. Precies één gezond slot (een verse host met geen upstream-bestand).
|
||||
#
|
||||
# De eerdere versie telde gezonde slots en gebruikte de fallback pas als er 0 of
|
||||
# 2+ waren. Op een host waar beide slots tegelijk gezond zijn — bijvoorbeeld
|
||||
# doordat een losse `docker compose up` een extra replica heeft achtergelaten —
|
||||
# gaf dat een willekeurige keuze, en dan kon de kandidaat op een bezette poort
|
||||
# starten (EADDRINUSE) terwijl de health-check de reeds draaiende container op
|
||||
# die poort beantwoordde. De release-vergelijking faalde dan 30 keer op een
|
||||
# container die toevallig een andere release draaide.
|
||||
# Welke poort is op dit moment ÉCHT live? Kijk niet naar het upstream-bestand
|
||||
# (dat kan door een losse `docker compose up` zijn ingehaald en naar een dood
|
||||
# slot wijzen), maar test welk slot werkelijk antwoordt op /api/health. Alleen
|
||||
# in een dubbelzinnige situatie (geen óf beide slots gezond) valt het script
|
||||
# terug op de huidige nginx-pointer; onbekend = slot A (eerste release op 3002).
|
||||
read_active_port() {
|
||||
local port="" pointed=""
|
||||
|
||||
if [ -r "$upstream_file" ]; then
|
||||
port="$(grep -oE '127\.0\.0\.1:(3002|3003)' "$upstream_file" 2>/dev/null | head -1 | cut -d: -f2 || true)"
|
||||
fi
|
||||
|
||||
if [ -n "$port" ] && answers_health "$port"; then
|
||||
printf '%s' "$port"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Het upstream-bestand wijst naar een slot dat niet antwoordt. Kies dan het
|
||||
# enige andere gezonde slot, anders is er niets om op te bouwen.
|
||||
for candidate in "$slot_a_port" "$slot_b_port"; do
|
||||
[ "$candidate" = "$port" ] && continue
|
||||
if answers_health "$candidate"; then
|
||||
echo "nginx points at ${port:-unknown}, which is unhealthy; ${candidate} answers instead" >&2
|
||||
printf '%s' "$candidate"
|
||||
return 0
|
||||
local live="" port="" result=""
|
||||
local count=0
|
||||
for port in "$slot_a_port" "$slot_b_port"; do
|
||||
if curl -sf --max-time 3 "http://127.0.0.1:$port/api/health" | grep -q '"database":true'; then
|
||||
live="$live $port"
|
||||
fi
|
||||
done
|
||||
|
||||
# Geen enkel slot antwoordt. Vertrouw dan op het bestand, zodat een
|
||||
# rollback-poging toch het vorige slot kan starten.
|
||||
if [ -n "$port" ]; then
|
||||
printf '%s' "$port"
|
||||
for port in $live; do count=$((count + 1)); result="$port"; done
|
||||
if [ "$count" -eq 1 ]; then
|
||||
printf '%s' "$result"
|
||||
return 0
|
||||
fi
|
||||
|
||||
printf '%s' "$slot_a_port"
|
||||
}
|
||||
|
||||
# Poort-bezetting controleren vóór het starten van de kandidaat.
|
||||
#
|
||||
# Zonder deze check zorgt `docker run` er stilzwijgend voor dat de kandidaat
|
||||
# dood gaat op EADDRINUSE, terwijl de health-check ondertussen de reeds draaiende
|
||||
# container op diezelfde poort beantwoordt. Dat levert een misleidende
|
||||
# "expected release never became healthy" op in plaats van de echte oorzaak.
|
||||
# Elke listener wordt hierboven concreet genoemd, inclusief de container die
|
||||
# hem vasthoudt.
|
||||
assert_port_free() {
|
||||
local port="$1" name="$2"
|
||||
local holders=""
|
||||
# `type`, niet `command -v`: de deploy-simulatietests leveren `ss` als
|
||||
# shell-functie via BASH_ENV, en `command -v` herkent die wel op Bash maar de
|
||||
# functie is niet geëxporteerd naar de subshell van start_candidate. Met `type`
|
||||
# blijft de stub ook daar zichtbaar, zodat de test geen echte hostpoorten
|
||||
# hoeft te zien.
|
||||
if type ss >/dev/null 2>&1; then
|
||||
# `ss` drukt altijd een kolomkop af, ook als er geen listener is. Filter op
|
||||
# LISTEN, anders zou elke vrije poort als bezet gemeld worden.
|
||||
holders="$(ss -ltnp "sport = :$port" 2>/dev/null | grep -F 'LISTEN' || true)"
|
||||
fi
|
||||
[ -z "$holders" ] && return 0
|
||||
echo "Port $port is already in use, cannot start candidate $name" >&2
|
||||
printf '%s\n' "$holders" >&2
|
||||
|
||||
# Noem exact het container dat de poort vasthoudt.
|
||||
#
|
||||
# `docker ps --filter publish=` werkt niet: de app draait met --net=host en
|
||||
# publiceert dus geen poorten, dus die filter levert altijd niets op. In plaats
|
||||
# daarvan volgen we de luisterende PID uit `ss` terug naar de container via
|
||||
# /proc/<pid>/cgroup. Een eerdere versie noemde álle draaiende containers als
|
||||
# belkenners, wat de echte boosdochter (epicnext-cms) onder een zee van
|
||||
# onschuldige containers begraven.
|
||||
local squatter="squatter_pids"
|
||||
squatter_pids="$(printf '%s\n' "$holders" | grep -oP 'pid=\K[0-9]+' | sort -u || true)"
|
||||
if [ -n "$squatter_pids" ]; then
|
||||
local pid cid owner=""
|
||||
for pid in $squatter_pids; do
|
||||
cid="$(sed -n 's#.*docker-\([0-9a-f]\{64\}\)\.scope#\1#p' "/proc/$pid/cgroup" 2>/dev/null | head -1)"
|
||||
[ -n "$cid" ] || continue
|
||||
owner="$(docker inspect --format '{{.Name}} ({{.Config.Image}})' "$cid" 2>/dev/null || true)"
|
||||
[ -n "$owner" ] && printf 'Held by container: %s\n' "${owner#/}" >&2
|
||||
done
|
||||
fi
|
||||
echo "" >&2
|
||||
# Blauwe/groene releases beheren hun eigen slots. Een container met een andere
|
||||
# naam die toevallig op een van deze poorten draait — meestal een
|
||||
# `docker compose up`-replica — staat los van de pipeline en blokkeert de
|
||||
# release. Live verkeer loopt via het nginx-upstream over het andere slot en is
|
||||
# dus niet geraakt.
|
||||
case "$owner" in
|
||||
*"/$name"*|*"/$slot_b_container"*)
|
||||
echo "Note: the holder looks like a managed slot container; re-check the port mapping above." >&2 ;;
|
||||
*)
|
||||
cat >&2 <<EOF
|
||||
This port is held by a container that is not a blue/green slot, so the deploy
|
||||
cannot start the candidate. Live traffic is unaffected: nginx keeps serving
|
||||
the other slot until cutover.
|
||||
|
||||
Remove the stray container and re-run the deploy:
|
||||
|
||||
docker rm -f $(printf '%s' "$owner" | sed -n 's#.*/\([^ ]*\).*#\1#p')
|
||||
|
||||
If it comes back after a reboot, it is started by docker-compose.yml rather
|
||||
than by this script; delete or disable that service.
|
||||
EOF
|
||||
;;
|
||||
port="$(grep -oE '127\.0\.0\.1:[0-9]+' "$upstream_file" 2>/dev/null | head -1 | cut -d: -f2 || true)"
|
||||
case "$port" in
|
||||
"$slot_b_port") printf '%s' "$slot_b_port" ;;
|
||||
*) printf '%s' "$slot_a_port" ;;
|
||||
esac
|
||||
return 1
|
||||
}
|
||||
|
||||
# Ruim een compose-replica op die een blauwe/groene slot bezet.
|
||||
#
|
||||
# Een `docker compose up` — of de dagelijkse `scripts/docker-update.sh`, waarvan
|
||||
# de CI-eigendomscontrole per slot wankelde — laat een replica met container_name
|
||||
# `epicnext-cms` achter op poort 3002. Die draait nooit live: nginx wijst naar de
|
||||
# poort van een slot-container die dit script zelf heeft gestart, en die staat per
|
||||
# definitie aan de andere kant dan de kandidaat. Zonder deze opruimstap loopt elke
|
||||
# release vast op een bezette poort totdat iemand de container met de hand
|
||||
# verwijdert.
|
||||
#
|
||||
# Bewust smal, want een container van een ander deployment is niet van ons:
|
||||
# - alleen een replica die uit precies deze checkout komt
|
||||
# (com.docker.compose.project.config_files), niet een losse compose-project;
|
||||
# - nooit een slot-container, want die beheert dit script zelf;
|
||||
# - nooit de poort waar nginx naar wijst.
|
||||
# Wat daarnaast nog op de doel-poort zit, laat assert_port_free() met zijn eigen
|
||||
# foutmelding staan in plaats van stilzwijgend verdwijnen.
|
||||
retire_compose_replicas() {
|
||||
local live_port="$1" cid name="" config_files="" port=""
|
||||
while read -r cid; do
|
||||
[ -n "$cid" ] || continue
|
||||
name="$(docker inspect --format '{{.Name}}' "$cid" 2>/dev/null | sed -n 's#^/##p' || true)"
|
||||
case "$name" in ''|"$slot_a_container"|"$slot_b_container") continue ;; esac
|
||||
config_files="$(docker inspect --format '{{index .Config.Labels "com.docker.compose.project.config_files"}}' "$cid" 2>/dev/null || true)"
|
||||
[ "$config_files" = "$deploy_dir/docker-compose.yml" ] || continue
|
||||
port="$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$cid" 2>/dev/null | sed -n 's#^PORT=##p' | head -1 || true)"
|
||||
[ -n "$port" ] && [ "$port" != "$live_port" ] || continue
|
||||
echo "Removing compose replica $name on port $port: it squats a blue/green slot and is not the live release (nginx serves $live_port)"
|
||||
docker rm -f "$name" || return 1
|
||||
done < <(docker ps --filter "label=com.docker.compose.project.config_files=$deploy_dir/docker-compose.yml" --format '{{.ID}}')
|
||||
return 0
|
||||
}
|
||||
|
||||
# Zet de nginx-upstream op de nieuwe poort en herlaadt graceful.
|
||||
@@ -287,7 +153,6 @@ switch_upstream() {
|
||||
# gelden.
|
||||
start_candidate() {
|
||||
local port="$1" name="$2"
|
||||
assert_port_free "$port" "$name"
|
||||
(
|
||||
set -a
|
||||
# shellcheck disable=SC1091
|
||||
@@ -318,7 +183,7 @@ finish() {
|
||||
if [ "$cutover_started" -eq 0 ]; then
|
||||
# De live release draait nog ongestoord; alleen de kandidaat opruimen.
|
||||
echo "Deployment failed before cutover; the live release was never stopped" >&2
|
||||
if [ "$candidate_attempted" -eq 1 ] && [ -n "$new_container" ] && docker inspect "$new_container" >/dev/null 2>&1; then
|
||||
if [ "$candidate_attempted" -eq 1 ] && [ -n "$new_container" ]; then
|
||||
docker logs "$new_container" --tail 50 >&2 || true
|
||||
docker rm -f "$new_container" || true
|
||||
fi
|
||||
@@ -326,9 +191,9 @@ finish() {
|
||||
# nginx wijst nu naar de kandidaat. Eerst het verkeer terug, dan pas de
|
||||
# kandidaat weghalen, anders zou de site 502-en terwijl we terugdraaien.
|
||||
echo "Deployment failed after cutover; rolling back to port $old_port" >&2
|
||||
if [ -n "$new_container" ] && docker inspect "$new_container" >/dev/null 2>&1; then docker logs "$new_container" --tail 50 >&2 || true; fi
|
||||
if [ -n "$new_container" ]; then docker logs "$new_container" --tail 50 >&2 || true; fi
|
||||
if [ -n "$old_port" ]; then switch_upstream "$old_port" || true; fi
|
||||
if [ -n "$new_container" ] && docker inspect "$new_container" >/dev/null 2>&1; then docker rm -f "$new_container" || true; fi
|
||||
if [ -n "$new_container" ]; then docker rm -f "$new_container" || true; fi
|
||||
if [ -n "$old_container" ] && docker start "$old_container" >/dev/null 2>&1; then
|
||||
if healthy "$old_port"; then
|
||||
echo "Rollback verified on port $old_port"
|
||||
@@ -473,28 +338,15 @@ if docker inspect "$backup_name" >/dev/null 2>&1; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# The application writes everything under storage/ as uid 33, but storage is a
|
||||
# host bind so the image's own ownership is irrelevant. Any path that is not
|
||||
# uid 33 makes the write fail with EACCES, and because most of these writes are
|
||||
# inside a try/catch the failure is silent: the avatar cache just never fills
|
||||
# (each avatar becomes a fresh live render) and the catalog export reports
|
||||
# "delivery failed" while the emulator never receives the update. The old code
|
||||
# only repaired storage/imaging, so storage/catalog-git/hotel-status.json kept
|
||||
# coming back root:root and /api/admin/catalog/status kept throwing EACCES.
|
||||
for owned_dir in imaging catalog-git cms-errors furniture-imports logs media \
|
||||
nitro-cleanup config-backups nitro-scale32-backups; do
|
||||
target="$deploy_dir/storage/$owned_dir"
|
||||
[ -e "$target" ] || mkdir -p "$target" 2>/dev/null || true
|
||||
[ -d "$target" ] || continue
|
||||
chown -R 33:33 "$target" 2>/dev/null || true
|
||||
done
|
||||
# The avatar/badge cache needs its leaf directories to exist before first use;
|
||||
# the cache misses (and re-renders live) rather than erroring when they do not.
|
||||
# The avatar/badge disk cache lives on the host bind and is written by uid 33
|
||||
# inside the container. Root-owned directories make every cache write fail
|
||||
# silently, which turns each avatar into a fresh live render.
|
||||
for cache_dir in avatars badges; do
|
||||
if ! install -d -o 33 -g 33 -m 0750 "$deploy_dir/storage/imaging/$cache_dir" 2>/dev/null; then
|
||||
mkdir -p "$deploy_dir/storage/imaging/$cache_dir" 2>/dev/null || true
|
||||
fi
|
||||
done
|
||||
chown -R 33:33 "$deploy_dir/storage/imaging" 2>/dev/null || true
|
||||
|
||||
if [ "$blue_green" -eq 1 ]; then
|
||||
# 1. Maak de doel-poort vrij. Alles wat daar draait is per definitie niet live,
|
||||
@@ -504,28 +356,23 @@ if [ "$blue_green" -eq 1 ]; then
|
||||
docker rm -f "$new_container"
|
||||
fi
|
||||
|
||||
# 2. Een compose-replica die ooit is achtergebleven zit hier nog op de
|
||||
# doel-poort. Hij draait niet live en wordt dus opgeruimd, zodat de release
|
||||
# niet op een bezette poort stukloopt.
|
||||
retire_compose_replicas "$old_port"
|
||||
|
||||
# 3. Start de kandidaat ernaast. De live release draait ononderbroken door.
|
||||
# 2. Start de kandidaat ernaast. De live release draait ononderbroken door.
|
||||
candidate_attempted=1
|
||||
start_candidate "$new_port" "$new_container"
|
||||
|
||||
# 4. Gezond? Release-hash klopt? Browsersmoke-test? Pas dan hoeft het oude
|
||||
# 3. Gezond? Release-hash klopt? Browsersmoke-test? Pas dan hoeft het oude
|
||||
# release het veld te ruimen — anders zou een mislukte e2e-test pas ná de
|
||||
# cutover de productie breken in plaats van ervoor.
|
||||
healthy "$new_port"
|
||||
node scripts/verify-deployed-release.mjs "http://127.0.0.1:$new_port/api/health" "$sha"
|
||||
PLAYWRIGHT_BASE_URL="http://127.0.0.1:$new_port" pnpm test:e2e
|
||||
|
||||
# 5. Het enige onomkeerbare moment: vanaf hier wijst nginx naar de kandidaat.
|
||||
# 4. Het enige onomkeerbare moment: vanaf hier wijst nginx naar de kandidaat.
|
||||
cutover_started=1
|
||||
switch_upstream "$new_port"
|
||||
echo "Cut over to port $new_port; retiring port $old_port"
|
||||
|
||||
# 6. Nu mag de oude release weg. Pas ná de swap, zodat er nooit een moment is
|
||||
# 5. Nu mag de oude release weg. Pas ná de swap, zodat er nooit een moment is
|
||||
# waarop er geen enkele container draait.
|
||||
if [ -n "$old_container" ] && docker inspect "$old_container" >/dev/null 2>&1; then
|
||||
docker stop "$old_container"
|
||||
|
||||
@@ -0,0 +1,154 @@
|
||||
#!/usr/bin/env bash
|
||||
set -Eeuo pipefail
|
||||
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
cd "$DIR"
|
||||
ENV_FILE="$DIR/.env"
|
||||
COMPOSE_FILE="deployment/crowdsec/compose.crowdsec.yml"
|
||||
PROJECT_NAME="epicnext-crowdsec"
|
||||
CONTAINER_NAME="epicnext-crowdsec"
|
||||
DEFAULT_PORT="18080"
|
||||
|
||||
mode="${1:-enable}"
|
||||
case "$mode" in
|
||||
enable|--enable) ;;
|
||||
status|--status) ;;
|
||||
disable|--disable) ;;
|
||||
blocklists|blocklists-install-cron|blocklists-uninstall-cron) ;;
|
||||
*) echo "Usage: bash cms security [enable|status|disable|blocklists|blocklists-install-cron|blocklists-uninstall-cron]" >&2; exit 1 ;;
|
||||
esac
|
||||
|
||||
umask 077
|
||||
fail() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
|
||||
for command in docker flock; do command -v "$command" >/dev/null || fail "Required command: $command"; done
|
||||
docker info >/dev/null 2>&1 || fail "Docker is not reachable."
|
||||
docker compose version >/dev/null 2>&1 || fail "Docker Compose plugin required."
|
||||
exec 9>"$DIR/.deploy.lock"
|
||||
flock -w 30 9 || fail "Another installation or update is running."
|
||||
[[ -f "$ENV_FILE" ]] || fail "Create .env first (bash cms install)."
|
||||
|
||||
case "$mode" in
|
||||
blocklists) exec bash "$DIR/scripts/blocklists-sync.sh" sync "${2:-}" ;;
|
||||
blocklists-install-cron) exec bash "$DIR/scripts/blocklists-sync.sh" install-cron ;;
|
||||
blocklists-uninstall-cron) exec bash "$DIR/scripts/blocklists-sync.sh" uninstall-cron ;;
|
||||
esac
|
||||
|
||||
env_get() {
|
||||
local key="$1" line
|
||||
while IFS= read -r line || [[ -n "$line" ]]; do
|
||||
case "$line" in
|
||||
"$key="*) line="${line#*=}"; line="${line%\"}"; line="${line#\"}"; printf '%s' "$line"; return 0 ;;
|
||||
esac
|
||||
done < "$ENV_FILE"
|
||||
return 1
|
||||
}
|
||||
|
||||
env_set() {
|
||||
local key="$1" value="$2" tmp
|
||||
tmp="$(mktemp "$DIR/.env.crowdsec.XXXXXX")"
|
||||
if awk -v k="$key" -v v="$value" 'BEGIN{FS=OFS="=";done=0} { if ($1==k) { print k "=" v; done=1 } else print } END { if (!done) print k "=" v }' "$ENV_FILE" > "$tmp"; then
|
||||
chmod 600 "$tmp"
|
||||
mv -f -- "$tmp" "$ENV_FILE"
|
||||
else
|
||||
rm -f -- "$tmp"
|
||||
fail "Could not update .env"
|
||||
fi
|
||||
}
|
||||
|
||||
compose_cmd() {
|
||||
docker compose --project-name "$PROJECT_NAME" --env-file "$ENV_FILE" -f "$COMPOSE_FILE" --profile security "$@"
|
||||
}
|
||||
|
||||
health_probe() {
|
||||
local url="$1"
|
||||
if command -v curl >/dev/null 2>&1; then
|
||||
curl -fsS --max-time 3 "$url" >/dev/null 2>&1
|
||||
else
|
||||
compose_cmd exec -T crowdsec wget -q -O - "$url" >/dev/null 2>&1
|
||||
fi
|
||||
}
|
||||
|
||||
container_running() {
|
||||
[[ "$(docker inspect -f '{{.State.Running}}' "$CONTAINER_NAME" 2>/dev/null || true)" = true ]]
|
||||
}
|
||||
|
||||
if [[ "$mode" = disable || "$mode" = --disable ]]; then
|
||||
set +e
|
||||
compose_cmd stop crowdsec
|
||||
rc=$?
|
||||
set -e
|
||||
[[ $rc -eq 0 ]] || printf 'CrowdSec engine was not running or could not be stopped.\n'
|
||||
env_set CROWDSEC_LOCAL_ENABLED false
|
||||
printf 'CrowdSec local stack disabled. The engine container is stopped; volumes and .env key were kept.\n'
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [[ "$mode" = status || "$mode" = --status ]]; then
|
||||
enabled=no
|
||||
[[ "$(env_get CROWDSEC_LOCAL_ENABLED 2>/dev/null || true)" = true ]] && enabled=yes
|
||||
port="$(env_get CROWDSEC_LAPI_PORT 2>/dev/null || true)"
|
||||
[[ -z "$port" ]] && port="$DEFAULT_PORT"
|
||||
printf 'CROWDSEC_LOCAL_ENABLED=%s\n' "$enabled"
|
||||
if container_running; then
|
||||
printf 'Engine: running\n'
|
||||
if health_probe "http://127.0.0.1:$port/health"; then
|
||||
printf 'LAPI health: OK (127.0.0.1:%s)\n' "$port"
|
||||
else
|
||||
printf 'LAPI health: UNREACHABLE (127.0.0.1:%s)\n' "$port"
|
||||
fi
|
||||
else
|
||||
printf 'Engine: not running\n'
|
||||
printf 'Start with: bash cms security\n'
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
|
||||
port="$(env_get CROWDSEC_LAPI_PORT 2>/dev/null || true)"
|
||||
[[ -n "$port" ]] || port="$DEFAULT_PORT"
|
||||
[[ "$port" =~ ^[0-9]{1,5}$ ]] || fail "CROWDSEC_LAPI_PORT must be a port number."
|
||||
if (( port < 1024 || port > 65535 )); then
|
||||
fail "CROWDSEC_LAPI_PORT must be within 1024-65535."
|
||||
fi
|
||||
key="$(env_get CROWDSEC_LAPI_API_KEY 2>/dev/null || true)"
|
||||
[[ -n "$key" ]] || key="$(od -An -N32 -tx1 /dev/urandom | tr -d ' \n')"
|
||||
url="$(env_get CROWDSEC_LAPI_URL 2>/dev/null || true)"
|
||||
[[ -n "$url" ]] || url="http://127.0.0.1:$port"
|
||||
log_dir="${CROWDSEC_NGINX_LOG_DIR:-$(env_get CROWDSEC_NGINX_LOG_DIR 2>/dev/null || true)}"
|
||||
[[ -n "$log_dir" ]] || log_dir="/var/log/nginx"
|
||||
|
||||
if ! container_running && command -v ss >/dev/null 2>&1; then
|
||||
if ss -ltn "( sport = :$port )" 2>/dev/null | grep -q LISTEN; then
|
||||
fail "Port $port is already in use. Set CROWDSEC_LAPI_PORT (and CROWDSEC_LAPI_URL) in .env to a free port and re-run."
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ! -r "$log_dir/access.log" ]]; then
|
||||
printf 'Warning: %s/access.log is not readable. The engine will run but has no detections until an access log is available.\n' "$log_dir"
|
||||
fi
|
||||
|
||||
env_set CROWDSEC_LOCAL_ENABLED true
|
||||
env_set CROWDSEC_LAPI_URL "$url"
|
||||
env_set CROWDSEC_LAPI_PORT "$port"
|
||||
env_set CROWDSEC_LAPI_API_KEY "$key"
|
||||
env_set CROWDSEC_NGINX_LOG_DIR "$log_dir"
|
||||
|
||||
compose_cmd config --quiet || fail "CrowdSec Compose configuration is invalid; fix CROWDSEC_* settings in .env."
|
||||
set +e
|
||||
compose_cmd up -d --wait crowdsec
|
||||
rc=$?
|
||||
set -e
|
||||
if [[ $rc -ne 0 ]]; then
|
||||
compose_cmd up -d crowdsec
|
||||
fi
|
||||
|
||||
attempt=0
|
||||
while ! health_probe "http://127.0.0.1:$port/health"; do
|
||||
attempt=$((attempt + 1))
|
||||
[[ $attempt -lt 30 ]] || fail "CrowdSec LAPI did not become healthy on port $port."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
printf 'CrowdSec engine running in LAPI-only mode on 127.0.0.1:%s (container %s).\n' "$port" "$CONTAINER_NAME"
|
||||
compose_cmd exec -T crowdsec cscli bouncers list >/dev/null 2>&1 \
|
||||
&& printf 'Bouncer "cms" was registered against the local LAPI.\n' \
|
||||
|| printf 'Warning: could not list bouncers. Diagnose with: docker compose exec -T %s cscli bouncers list\n' "$CONTAINER_NAME"
|
||||
printf 'Restart the CMS container (or run your next deployment) so it loads the new bouncer env. For a clone: bash cms update --skip-pull\n'
|
||||
+2
-94
@@ -3,21 +3,15 @@
|
||||
#
|
||||
# Modes:
|
||||
# (default) — post-deploy cleanup (safe, fast):
|
||||
# - Build cache capped at 4 GB max used space (CMS_BUILD_CACHE_MAX), evicting
|
||||
# least-recently-used entries. This cap is the actual bound.
|
||||
# - Build cache older than 72h, capped at 4 GB max used space.
|
||||
# - Unreferenced images older than 7 days (keeps rollback images around).
|
||||
# - Stopped containers older than 24h.
|
||||
# - Dangling images, which are always unreferenced.
|
||||
# - Orphaned Firefox profiles in byparr's writable layer (BYPARR_CONTAINERS).
|
||||
# --force — emergency mode ("never let the disk max out"): drops everything
|
||||
# with no age windows:
|
||||
# - ALL unreferenced build cache,
|
||||
# - ALL unreferenced images (no age grace),
|
||||
# - ALL stopped containers.
|
||||
#
|
||||
# The default mode escalates to --force on its own when / drops below 8 GB free,
|
||||
# so the bound holds even if this stops running on schedule.
|
||||
#
|
||||
# Volumes are NEVER pruned in either mode: mariadb-turbo-data is a database.
|
||||
# Idempotent; exits 0 when Docker is unavailable.
|
||||
set -Eeuo pipefail
|
||||
@@ -40,101 +34,15 @@ command -v docker >/dev/null 2>&1 || {
|
||||
printf '\n[%s] === docker prune start%s ===\n' "$(now)" "$( (( FORCE )) && printf ' (FORCE)' )" >>"$LOG_FILE"
|
||||
docker system df >>"$LOG_FILE" 2>&1 || true
|
||||
|
||||
# A hard ceiling on the root filesystem is what actually bounds the growth, so
|
||||
# the emergency path is reached on disk pressure rather than only on a timer.
|
||||
# The image/container passes stay age-gated: a rollback image and a stopped
|
||||
# container are cheap to keep for a week and expensive to lose.
|
||||
FREE_KB=$(df -Pk / | awk 'NR==2 {print $4}')
|
||||
# 8 GB free is comfortable for a database plus a release swap.
|
||||
if (( FREE_KB < 8 * 1024 * 1024 )); then
|
||||
FORCE=1
|
||||
printf '[%s] only %s KB free on /; switching to FORCE prune\n' \
|
||||
"$(now)" "$FREE_KB" >>"$LOG_FILE"
|
||||
fi
|
||||
|
||||
if (( FORCE )); then
|
||||
docker builder prune -af >>"$LOG_FILE" 2>&1 || true
|
||||
docker image prune -af >>"$LOG_FILE" 2>&1 || true
|
||||
docker container prune -f >>"$LOG_FILE" 2>&1 || true
|
||||
else
|
||||
# --max-used-space and --filter are mutually exclusive in buildx: passing
|
||||
# both makes the cap a no-op and the cache grows without bound. The cap alone
|
||||
# is the bound, and it evicts least-recently-used entries to get there.
|
||||
docker builder prune -af --max-used-space="${CMS_BUILD_CACHE_MAX:-4g}" >>"$LOG_FILE" 2>&1 || true
|
||||
docker builder prune -af --filter "until=72h" --max-used-space=4g >>"$LOG_FILE" 2>&1 || true
|
||||
docker image prune -af --filter "until=168h" >>"$LOG_FILE" 2>&1 || true
|
||||
docker container prune -f --filter "until=24h" >>"$LOG_FILE" 2>&1 || true
|
||||
fi
|
||||
|
||||
# Dangling images have no tag and no container, so nothing can reference them.
|
||||
# They are what repeated local builds leave behind.
|
||||
docker image prune -f >>"$LOG_FILE" 2>&1 || true
|
||||
|
||||
# ── Interrupted git gc leftovers ─────────────────────────────────
|
||||
# A `git gc` that gets OOM-killed mid-repack leaves its tmp_pack behind, and
|
||||
# nothing reclaims it: git only clears those on the next successful gc. One such
|
||||
# file held 7.7 GB here while the whole object store was 83 MB. Only files older
|
||||
# than a day are considered, so a gc running right now is never touched.
|
||||
repo_dir="${CMS_REPO_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
|
||||
if [[ -d "$repo_dir/.git/objects/pack" ]]; then
|
||||
while IFS= read -r -d '' tmp; do
|
||||
size=$(du -h "$tmp" | cut -f1)
|
||||
rm -f "$tmp"
|
||||
printf '[%s] removed leftover tmp_pack %s (%s) from an interrupted git gc\n' \
|
||||
"$(now)" "$tmp" "$size" >>"$LOG_FILE"
|
||||
done < <(find "$repo_dir/.git/objects/pack" -maxdepth 1 -name 'tmp_*' -mmin +1440 -print0 2>/dev/null)
|
||||
fi
|
||||
|
||||
# ── Orphaned browser profiles ─────────────────────────────────────
|
||||
# byparr launches a real Firefox per request, and each launch leaves a
|
||||
# ~10-140 MB profile behind in the container's writable layer. Nothing ever
|
||||
# removes them, so the layer grows without bound: 716 profiles / 6.8 GB after two
|
||||
# days on this host, ~1.7 GB/day.
|
||||
#
|
||||
# Deleting a profile out from under a running browser kills that job, so live
|
||||
# ones are identified the only way that is reliable rather than by age: a
|
||||
# browser keeps its profile open, which shows up as a /proc/<pid>/fd symlink
|
||||
# pointing into the directory. Anything not referenced that way, and untouched
|
||||
# for BYPARR_PROFILE_MIN_AGE_MIN minutes, is an orphan.
|
||||
#
|
||||
# Age alone is not a safe signal here: browsers stay warm for ~27 hours, so an
|
||||
# age window that is safe for the leak is far too wide for the disk.
|
||||
BYPARR_TMP_MIN_AGE_MIN="${BYPARR_TMP_MIN_AGE_MIN:-30}"
|
||||
for container in ${BYPARR_CONTAINERS:-byparr}; do
|
||||
docker inspect -f '{{.State.Running}}' "$container" >/dev/null 2>&1 || continue
|
||||
[[ "$(docker inspect -f '{{.State.Running}}' "$container" 2>/dev/null)" == "true" ]] || continue
|
||||
|
||||
removed=$(
|
||||
docker exec -e BYPARR_TMP_MIN_AGE_MIN="$BYPARR_TMP_MIN_AGE_MIN" "$container" sh -c '
|
||||
set -u
|
||||
min_age="${BYPARR_TMP_MIN_AGE_MIN:-30}"
|
||||
base="${1:-/tmp}"
|
||||
live_file=$(mktemp)
|
||||
# Live profiles are the ones a running process still holds open.
|
||||
for p in $(ps -eo pid= 2>/dev/null); do
|
||||
ls -l "/proc/$p/fd" 2>/dev/null
|
||||
done | grep -o "$base/playwright_firefoxdev_profile-[A-Za-z0-9]*" | sort -u >"$live_file"
|
||||
|
||||
count=0
|
||||
for dir in "$base"/playwright_firefoxdev_profile-*; do
|
||||
[ -d "$dir" ] || continue
|
||||
# Never touch something a process is still using.
|
||||
grep -Fxq "$dir" "$live_file" && continue
|
||||
# A profile a browser is still writing to is not an orphan
|
||||
# yet, even if the directory itself looks old.
|
||||
if find "$dir" -newermt "-${min_age} minutes" -print -quit 2>/dev/null | grep -q .; then
|
||||
continue
|
||||
fi
|
||||
rm -rf "$dir" 2>/dev/null && count=$((count + 1))
|
||||
done
|
||||
rm -f "$live_file"
|
||||
printf "%s" "$count"
|
||||
' sh /tmp 2>/dev/null || printf '0'
|
||||
)
|
||||
if [[ "${removed:-0}" -gt 0 ]]; then
|
||||
printf '[%s] removed %s orphaned browser profiles from %s\n' \
|
||||
"$(now)" "$removed" "$container" >>"$LOG_FILE"
|
||||
fi
|
||||
done
|
||||
|
||||
printf '\n[%s] === docker prune complete%s ===\n' "$(now)" "$( (( FORCE )) && printf ' (FORCE)' )" >>"$LOG_FILE"
|
||||
docker system df >>"$LOG_FILE" 2>&1 || true
|
||||
@@ -1,13 +1,7 @@
|
||||
import assert from "node:assert/strict";
|
||||
import { spawnSync } from "node:child_process";
|
||||
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
import {
|
||||
detectMemoryLimitMb,
|
||||
heapLimitMb,
|
||||
runtimeNodeOptions,
|
||||
} from "./docker-start.mjs";
|
||||
import { it } from "vitest";
|
||||
|
||||
it("imports runtime validation without starting the CMS", () => {
|
||||
const result = spawnSync(
|
||||
@@ -22,88 +16,28 @@ it("imports runtime validation without starting the CMS", () => {
|
||||
assert.equal(result.status, 0, result.stderr);
|
||||
});
|
||||
|
||||
describe("heap limit", () => {
|
||||
it("leaves headroom for the memory V8 does not account for", () => {
|
||||
// 4 GB cgroup limit -> a 2867 MB heap, well under the ceiling.
|
||||
expect(heapLimitMb(4 * 1024 ** 3)).toBe(2867);
|
||||
expect(heapLimitMb(6 * 1024 ** 3)).toBe(4300);
|
||||
});
|
||||
|
||||
it("clamps to a floor and a ceiling", () => {
|
||||
// Too small to run a Next.js server at all: floor wins.
|
||||
expect(heapLimitMb(256 * 1024 ** 2)).toBe(512);
|
||||
// A huge or absent limit must not turn into a 100 GB heap.
|
||||
expect(heapLimitMb(64 * 1024 ** 3)).toBe(8192);
|
||||
expect(heapLimitMb(Number.NaN)).toBe(8192);
|
||||
expect(heapLimitMb(0)).toBe(8192);
|
||||
});
|
||||
it("rejects the local CrowdSec bouncer without a key", () => {
|
||||
const result = spawnSync(
|
||||
process.execPath,
|
||||
[
|
||||
"--input-type=module",
|
||||
"-e",
|
||||
"import {validateRuntime} from './scripts/docker-start.mjs';try{validateRuntime({HOTEL_NAME:'x',AUTH_SECRET:'01234567890123456789012345678901',DATABASE_URL:'mysql://u:p@h/db',APP_URL:'http://h',CROWDSEC_LOCAL_ENABLED:'true'});process.exit(1)}catch(error){if(!String(error.message).includes('CROWDSEC_LAPI_API_KEY'))throw error}",
|
||||
],
|
||||
{ encoding: "utf8" },
|
||||
);
|
||||
assert.equal(result.status, 0, result.stderr);
|
||||
});
|
||||
|
||||
describe("cgroup detection", () => {
|
||||
const asReader = (contents) => (path) => {
|
||||
if (!(path in contents)) throw new Error(`ENOENT: ${path}`);
|
||||
return contents[path];
|
||||
};
|
||||
|
||||
it("reads the cgroup v2 limit", () => {
|
||||
expect(
|
||||
detectMemoryLimitMb(
|
||||
asReader({ "/sys/fs/cgroup/memory.max": "4294967296" }),
|
||||
),
|
||||
).toBe(2867);
|
||||
});
|
||||
|
||||
it("falls back to cgroup v1 when v2 is absent", () => {
|
||||
expect(
|
||||
detectMemoryLimitMb(
|
||||
asReader({
|
||||
"/sys/fs/cgroup/memory.max": "",
|
||||
"/sys/fs/cgroup/memory/memory.limit_in_bytes": "6442450944",
|
||||
}),
|
||||
),
|
||||
).toBe(4300);
|
||||
});
|
||||
|
||||
it("treats an unlimited cgroup as no limit at all", () => {
|
||||
// cgroup v1 reports "max"; a bare sentinel means the same thing.
|
||||
expect(
|
||||
detectMemoryLimitMb(asReader({ "/sys/fs/cgroup/memory.max": "max" })),
|
||||
).toBe(8192);
|
||||
expect(
|
||||
detectMemoryLimitMb(
|
||||
asReader({
|
||||
"/sys/fs/cgroup/memory/memory.limit_in_bytes": "9223372036854771712",
|
||||
}),
|
||||
),
|
||||
).toBe(8192);
|
||||
});
|
||||
|
||||
it("falls back when neither cgroup file is readable", () => {
|
||||
expect(
|
||||
detectMemoryLimitMb(() => {
|
||||
throw new Error("ENOENT");
|
||||
}),
|
||||
).toBe(8192);
|
||||
});
|
||||
});
|
||||
|
||||
describe("NODE_OPTIONS", () => {
|
||||
it("adds the cap when none is set", () => {
|
||||
expect(runtimeNodeOptions("", 2867)).toBe("--max-old-space-size=2867");
|
||||
expect(runtimeNodeOptions(undefined, 2867)).toBe(
|
||||
"--max-old-space-size=2867",
|
||||
);
|
||||
});
|
||||
|
||||
it("keeps unrelated options already present", () => {
|
||||
expect(runtimeNodeOptions("--no-warnings", 2867)).toBe(
|
||||
"--no-warnings --max-old-space-size=2867",
|
||||
);
|
||||
});
|
||||
|
||||
it("never overrides an explicit operator choice", () => {
|
||||
expect(runtimeNodeOptions("--max-old-space-size=8192", 2867)).toBe(
|
||||
"--max-old-space-size=8192",
|
||||
);
|
||||
});
|
||||
it("accepts a complete local CrowdSec configuration", () => {
|
||||
const result = spawnSync(
|
||||
process.execPath,
|
||||
[
|
||||
"--input-type=module",
|
||||
"-e",
|
||||
"import {validateRuntime} from './scripts/docker-start.mjs';validateRuntime({HOTEL_NAME:'x',AUTH_SECRET:'01234567890123456789012345678901',DATABASE_URL:'mysql://u:p@h/db',APP_URL:'http://h',CROWDSEC_LOCAL_ENABLED:'true',CROWDSEC_LAPI_API_KEY:'fixture-key',CROWDSEC_LAPI_URL:'http://127.0.0.1:18080'})",
|
||||
],
|
||||
{ encoding: "utf8" },
|
||||
);
|
||||
assert.equal(result.status, 0, result.stderr);
|
||||
});
|
||||
+17
-70
@@ -1,70 +1,7 @@
|
||||
// Fail before listening if an installation has no valid runtime configuration.
|
||||
import { spawn } from "node:child_process";
|
||||
import { readFileSync } from "node:fs";
|
||||
import { pathToFileURL } from "node:url";
|
||||
|
||||
/** Fraction of the container memory limit V8 is allowed to use for its heap.
|
||||
* The rest has to cover native allocations the JS heap cannot account for:
|
||||
* the mysql2 pool buffers, sharp's image pipeline, and zlib during a burst of
|
||||
* RSC rendering. */
|
||||
const HEAP_FRACTION = 0.7;
|
||||
const MIN_HEAP_MB = 512;
|
||||
/** Backstop only. The fraction is the real policy: on a 6 GB container it asks
|
||||
* for 4300 MB, and a backstop at or below that would silently turn the fraction
|
||||
* into a fixed number and make the two limits disagree. This exists purely so a
|
||||
* nonsensical cgroup reading cannot ask for an unbounded heap. */
|
||||
const MAX_HEAP_MB = 8192;
|
||||
|
||||
export function heapLimitMb(cgroupLimitBytes) {
|
||||
if (!Number.isFinite(cgroupLimitBytes) || cgroupLimitBytes <= 0)
|
||||
return MAX_HEAP_MB;
|
||||
const mb = Math.floor((cgroupLimitBytes * HEAP_FRACTION) / (1024 * 1024));
|
||||
return Math.min(MAX_HEAP_MB, Math.max(MIN_HEAP_MB, mb));
|
||||
}
|
||||
|
||||
/**
|
||||
* Read this container's memory ceiling from cgroup v2, falling back to v1.
|
||||
* Without this the V8 heap defaults to a quarter of *host* memory, so a 4 GB
|
||||
* container on a 24 GB host lets the heap grow past the limit and the kernel
|
||||
* OOM-kills the process mid-request — which is what produced the
|
||||
* `next-build (v16)` kills in the host logs. A container that GCs before it
|
||||
* reaches the ceiling degrades to a slower page instead of a killed process.
|
||||
*/
|
||||
export function detectMemoryLimitMb(readFile = readFileSync) {
|
||||
const candidates = [
|
||||
"/sys/fs/cgroup/memory.max",
|
||||
"/sys/fs/cgroup/memory/memory.limit_in_bytes",
|
||||
];
|
||||
for (const path of candidates) {
|
||||
let raw;
|
||||
try {
|
||||
raw = readFile(path, "utf8").trim();
|
||||
} catch {
|
||||
continue;
|
||||
}
|
||||
// cgroup v1 reports "max" for an unlimited cgroup; v2 uses a bare
|
||||
// sentinel of a very large number on some kernels.
|
||||
if (raw === "max" || raw === "") continue;
|
||||
const bytes = Number(raw);
|
||||
if (!Number.isFinite(bytes) || bytes <= 0) continue;
|
||||
// A host-sized "limit" means no cgroup ceiling was applied.
|
||||
if (bytes >= Number.MAX_SAFE_INTEGER) continue;
|
||||
return heapLimitMb(bytes);
|
||||
}
|
||||
return heapLimitMb(Number.NaN);
|
||||
}
|
||||
|
||||
export function runtimeNodeOptions(
|
||||
existing = "",
|
||||
heapMb = detectMemoryLimitMb(),
|
||||
) {
|
||||
const flag = `--max-old-space-size=${heapMb}`;
|
||||
if (!existing.trim()) return flag;
|
||||
// Respect an explicit operator override; only add the cap when absent.
|
||||
if (existing.includes("--max-old-space-size")) return existing;
|
||||
return `${existing} ${flag}`;
|
||||
}
|
||||
|
||||
export function validateRuntime(settings) {
|
||||
const invalid = [];
|
||||
if (!settings.HOTEL_NAME?.trim() || settings.HOTEL_NAME === "Build fixture")
|
||||
@@ -86,6 +23,22 @@ export function validateRuntime(settings) {
|
||||
invalid.push(key);
|
||||
}
|
||||
}
|
||||
const localEnabled = ["true", "1"].includes(
|
||||
String(settings.CROWDSEC_LOCAL_ENABLED ?? "")
|
||||
.trim()
|
||||
.toLowerCase(),
|
||||
);
|
||||
if (localEnabled) {
|
||||
if (!settings.CROWDSEC_LAPI_API_KEY?.trim())
|
||||
invalid.push("CROWDSEC_LAPI_API_KEY");
|
||||
if (settings.CROWDSEC_LAPI_URL) {
|
||||
try {
|
||||
new URL(settings.CROWDSEC_LAPI_URL);
|
||||
} catch {
|
||||
invalid.push("CROWDSEC_LAPI_URL");
|
||||
}
|
||||
}
|
||||
}
|
||||
if (invalid.length)
|
||||
throw new Error(`Invalid runtime configuration: ${invalid.join(", ")}`);
|
||||
}
|
||||
@@ -96,13 +49,7 @@ if (
|
||||
) {
|
||||
try {
|
||||
validateRuntime(process.env);
|
||||
const heapMb = detectMemoryLimitMb();
|
||||
const nodeOptions = runtimeNodeOptions(process.env.NODE_OPTIONS, heapMb);
|
||||
console.log(`Starting CMS with a ${heapMb} MB V8 heap cap`);
|
||||
const child = spawn(process.execPath, ["server.js"], {
|
||||
stdio: "inherit",
|
||||
env: { ...process.env, NODE_OPTIONS: nodeOptions },
|
||||
});
|
||||
const child = spawn(process.execPath, ["server.js"], { stdio: "inherit" });
|
||||
for (const signal of ["SIGTERM", "SIGINT"])
|
||||
process.on(signal, () => child.kill(signal));
|
||||
child.on("error", () => {
|
||||
|
||||
@@ -58,27 +58,10 @@ trap 'exit 130' INT
|
||||
trap 'exit 143' TERM
|
||||
trap 'log "Update failed; inspect $LOG_FILE. No volumes or local files were deleted."' ERR
|
||||
|
||||
# This host belongs to CI: the blue/green deploy owns both host ports (3002 and
|
||||
# 3003) and one of the two slot containers is always the live release. Compose
|
||||
# may only run where CI does not.
|
||||
#
|
||||
# Checking epicnext-cms-app alone was not enough. After a cutover to the green
|
||||
# slot the blue container is stopped, renamed and deleted, so the guard stopped
|
||||
# firing while the host stayed CI-managed. `docker compose up` then recreated a
|
||||
# replica named epicnext-cms on port 3002 — the blue slot, exactly where the next
|
||||
# candidate has to start — and every later release failed on a busy port until
|
||||
# someone removed that container by hand (see logs/docker-update.cron.log).
|
||||
# Therefore: both slot containers count, and so does the nginx upstream, which is
|
||||
# the only thing that still marks the host as blue/green when a slot is idle.
|
||||
ci_upstream_file="${CMS_UPSTREAM_FILE:-/etc/nginx/snippets/cms_upstream_servers.conf}"
|
||||
if [ -r "$ci_upstream_file" ] && grep -qsE '127\.0\.0\.1:(3002|3003)' "$ci_upstream_file"; then
|
||||
die "This host is managed by CI ($ci_upstream_file points at a blue/green slot). Update through CI, not a second Compose deployment."
|
||||
# An existing CI deployment is a different owner of the same host port.
|
||||
if [ "$(docker inspect --format '{{.State.Running}}' epicnext-cms-app 2>/dev/null || true)" = true ]; then
|
||||
die "This host is managed by CI (epicnext-cms-app). Update through CI, not a second Compose deployment."
|
||||
fi
|
||||
for slot_container in epicnext-cms-app epicnext-cms-green; do
|
||||
if [ "$(docker inspect --format '{{.State.Running}}' "$slot_container" 2>/dev/null || true)" = true ]; then
|
||||
die "This host is managed by CI ($slot_container). Update through CI, not a second Compose deployment."
|
||||
fi
|
||||
done
|
||||
[[ -z "$(git status --porcelain --untracked-files=normal)" ]] || die "Working tree is not clean. Commit or stash local work first."
|
||||
if [[ "$UPDATE_SKIP_PULL" = 0 ]]; then
|
||||
git rev-parse --abbrev-ref --symbolic-full-name '@{upstream}' >/dev/null || die "Configure this branch's Git upstream before updating."
|
||||
|
||||
+5
-71
@@ -1,17 +1,9 @@
|
||||
// Must stay the first import. ESM evaluates a module's imports in source
|
||||
// order, and `../src/features/operations/worker` reaches `@/env`, which parses
|
||||
// process.env at import time. With this import further down the tree, load-env
|
||||
// ran *after* the schema validation had already thrown on a missing
|
||||
// DATABASE_URL, so the worker could only ever start from an environment that
|
||||
// already exported the config — which is why `pnpm jobs:worker` died
|
||||
// immediately and nothing supervised it.
|
||||
import { drainOperationEffects } from "../src/features/operations/worker";
|
||||
import { drainFurnitureImports } from "../src/lib/services/furni-job-worker";
|
||||
import "./load-env";
|
||||
import * as nodeFs from "node:fs";
|
||||
import * as nodePath from "node:path";
|
||||
import { Cron } from "croner";
|
||||
import { lt, sql } from "drizzle-orm";
|
||||
import { env } from "../src/env";
|
||||
import { drainOperationEffects } from "../src/features/operations/worker";
|
||||
import { db, PasswordReset, WebsiteLoginLogs } from "../src/lib/db";
|
||||
import { logger } from "../src/lib/logger";
|
||||
import { redis } from "../src/lib/redis";
|
||||
@@ -26,7 +18,6 @@ import {
|
||||
diskLevel,
|
||||
parseDfOutput,
|
||||
} from "../src/lib/services/disk-usage";
|
||||
import { drainFurnitureImports } from "../src/lib/services/furni-job-worker";
|
||||
import { publishDueArticles } from "../src/lib/services/news-scheduler";
|
||||
import { scheduledAutoCleanFakeNitros } from "../src/lib/services/nitro-cleanup";
|
||||
import { rcon } from "../src/lib/services/rcon";
|
||||
@@ -170,69 +161,13 @@ async function checkDiskUsage(): Promise<void> {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve the JAR to back up. `EMULATOR_JAR_PATH` may point at the file itself
|
||||
* or at a directory of release JARs, because the emulator's own unit file
|
||||
* launches `ls -t Polaris-*-jar-with-dependencies.jar` — a path pinned to one
|
||||
* release filename goes stale on the next emulator upgrade, and a stale path
|
||||
* fails as a bare ENOENT from copyFile that gives no hint what is wrong. A
|
||||
* directory (or a path with a `*`) resolves to the most recently modified JAR,
|
||||
* matching how the emulator actually picks its build.
|
||||
*/
|
||||
export function resolveEmulatorJar(
|
||||
configuredPath: string,
|
||||
fs: typeof import("node:fs") = nodeFs,
|
||||
{ resolve }: typeof import("node:path") = nodePath,
|
||||
): string | null {
|
||||
const { existsSync, readdirSync, statSync } = fs;
|
||||
if (configuredPath.includes("*")) {
|
||||
const dir = configuredPath.slice(0, configuredPath.lastIndexOf("/") + 1);
|
||||
const pattern = configuredPath.slice(dir.length);
|
||||
if (!existsSync(dir)) return null;
|
||||
return (
|
||||
readdirSync(dir)
|
||||
.filter((name: string) => name.startsWith(pattern.split("*")[0] ?? ""))
|
||||
.map((name: string) => resolve(dir, name))
|
||||
.filter((path: string) => existsSync(path))
|
||||
.sort(
|
||||
(a: string, b: string) => statSync(b).mtimeMs - statSync(a).mtimeMs,
|
||||
)[0] ?? null
|
||||
);
|
||||
}
|
||||
if (existsSync(configuredPath) && statSync(configuredPath).isFile())
|
||||
return configuredPath;
|
||||
// A directory: take the newest JAR in it.
|
||||
if (existsSync(configuredPath) && statSync(configuredPath).isDirectory()) {
|
||||
return (
|
||||
readdirSync(configuredPath)
|
||||
.filter((name: string) => name.endsWith(".jar"))
|
||||
.map((name: string) => resolve(configuredPath, name))
|
||||
.sort(
|
||||
(a: string, b: string) => statSync(b).mtimeMs - statSync(a).mtimeMs,
|
||||
)[0] ?? null
|
||||
);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
async function backupEmulatorJar(): Promise<void> {
|
||||
if (!env.EMULATOR_JAR_PATH || !env.EMULATOR_BACKUP_DIR) return;
|
||||
|
||||
const fs = await import("node:fs");
|
||||
const { copyFileSync, mkdirSync, readdirSync, unlinkSync, existsSync } = fs;
|
||||
const { copyFileSync, mkdirSync, readdirSync, unlinkSync, existsSync } =
|
||||
await import("node:fs");
|
||||
const { resolve } = await import("node:path");
|
||||
|
||||
const jarPath = resolveEmulatorJar(env.EMULATOR_JAR_PATH, fs, nodePath);
|
||||
if (!jarPath) {
|
||||
// Configured but unusable: say so once, loudly, instead of every night
|
||||
// logging an opaque copyFile ENOENT that reads like a permissions bug.
|
||||
logger.error(
|
||||
"Emulator JAR backup skipped: EMULATOR_JAR_PATH does not resolve to a JAR",
|
||||
{ module: "jobs", configured: env.EMULATOR_JAR_PATH },
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
const timestamp = new Date().toISOString().slice(0, 19).replace(/[T:]/g, "-");
|
||||
const backupFile = resolve(
|
||||
env.EMULATOR_BACKUP_DIR,
|
||||
@@ -244,11 +179,10 @@ async function backupEmulatorJar(): Promise<void> {
|
||||
}
|
||||
|
||||
try {
|
||||
copyFileSync(jarPath, backupFile);
|
||||
copyFileSync(env.EMULATOR_JAR_PATH, backupFile);
|
||||
logger.info("Backed up emulator JAR", {
|
||||
module: "jobs",
|
||||
backupFile,
|
||||
source: jarPath,
|
||||
});
|
||||
|
||||
const keep = env.EMULATOR_BACKUP_KEEP ?? 7;
|
||||
|
||||
@@ -101,15 +101,6 @@ fi
|
||||
if [[ ! -d /var/log/nginx ]]; then
|
||||
install -d -o root -g adm -m 750 /var/log/nginx
|
||||
fi
|
||||
# nginx-cms.conf sets `root /var/www/html` so that disk-backed locations
|
||||
# (favicon.ico) resolve somewhere the www-data worker can actually traverse.
|
||||
# The previous implicit root was /etc/nginx/html, which sits behind /etc/nginx
|
||||
# (0750 root:root): the worker got EACCES on every stat, and nginx logs a
|
||||
# failed stat at crit, so each crawler probe wrote a crit line.
|
||||
if [[ ! -d /var/www/html ]]; then
|
||||
install -d -o root -g root -m 755 /var/www/html
|
||||
echo "+ created /var/www/html (document root)"
|
||||
fi
|
||||
for f in /var/log/nginx/access.log /var/log/nginx/error.log; do
|
||||
[[ -f "$f" ]] || touch "$f"
|
||||
done
|
||||
|
||||
@@ -79,27 +79,6 @@ function filesFrom(values) {
|
||||
return values.map(normalizeAsset);
|
||||
}
|
||||
|
||||
/**
|
||||
* Webpack interleaves numeric chunk ids with file names in `chunks` arrays, so
|
||||
* a real file has to be separated from its id. An id is rejected by
|
||||
* normalizeAsset for the right reason (it has no `static/` prefix and no `.js`
|
||||
* suffix), which makes it a usable filter — but only for ids. A malformed
|
||||
* *path* must still fail loudly rather than be silently dropped, or a broken
|
||||
* manifest would quietly under-report a route's real weight.
|
||||
*/
|
||||
function assetFilesFromChunkList(values) {
|
||||
if (!Array.isArray(values))
|
||||
throw new Error("Unsupported JavaScript chunk list.");
|
||||
const files = [];
|
||||
for (const value of values) {
|
||||
if (typeof value !== "string")
|
||||
throw new Error("Non-string JavaScript asset.");
|
||||
if (/^\d+$/.test(value)) continue;
|
||||
files.push(normalizeAsset(value));
|
||||
}
|
||||
return files;
|
||||
}
|
||||
|
||||
export function measureRoute({
|
||||
budget,
|
||||
appPath,
|
||||
@@ -107,44 +86,18 @@ export function measureRoute({
|
||||
clientManifest,
|
||||
readAsset,
|
||||
}) {
|
||||
// Turbopack emits an explicit per-segment `entryJSFiles` list. Webpack does
|
||||
// not — it only records chunks per client module — so after the build moved
|
||||
// to webpack (3d828a61) every route reported "unavailable" and the report
|
||||
// silently stopped measuring anything. Fall back to the same source Next's
|
||||
// own `static-routes-info` uses for webpack builds.
|
||||
const entries = clientManifest?.entryJSFiles;
|
||||
const webpackModules = clientManifest?.clientModules;
|
||||
let filesBySource;
|
||||
let webpackLayout = false;
|
||||
if (entries && typeof entries === "object" && !Array.isArray(entries)) {
|
||||
const sourceEntries = Object.keys(entries);
|
||||
if (
|
||||
!sourceEntries.some((key) =>
|
||||
key.replaceAll("\\", "/").endsWith(`/app${appPath}`),
|
||||
)
|
||||
)
|
||||
throw new Error("Route page entry is absent from entryJSFiles.");
|
||||
filesBySource = Object.entries(entries);
|
||||
} else if (webpackModules && typeof webpackModules === "object") {
|
||||
webpackLayout = true;
|
||||
// Each `chunks` array is `[chunkId, fileName, chunkId, fileName, ...]`.
|
||||
filesBySource = [];
|
||||
for (const node of Object.values(webpackModules)) {
|
||||
if (!Array.isArray(node?.chunks) || node.chunks.length === 0) continue;
|
||||
// One shared origin label instead of the module path: the per-chunk
|
||||
// `sources` list is written into report.json, and webpack records
|
||||
// absolute node_modules paths for every client module on the route.
|
||||
filesBySource.push(["client-module", node.chunks]);
|
||||
}
|
||||
if (filesBySource.length === 0)
|
||||
throw new Error(
|
||||
"Neither entryJSFiles nor clientModules chunk data is available; this manifest layout is not supported.",
|
||||
);
|
||||
} else {
|
||||
if (!entries || typeof entries !== "object" || Array.isArray(entries))
|
||||
throw new Error(
|
||||
"entryJSFiles is unavailable; this manifest layout is not supported.",
|
||||
);
|
||||
}
|
||||
const sourceEntries = Object.keys(entries);
|
||||
if (
|
||||
!sourceEntries.some((key) =>
|
||||
key.replaceAll("\\", "/").endsWith(`/app${appPath}`),
|
||||
)
|
||||
)
|
||||
throw new Error("Route page entry is absent from entryJSFiles.");
|
||||
const bootstrap = filesFrom(
|
||||
buildManifest.rootMainFilesTree?.[appPath] ?? buildManifest.rootMainFiles,
|
||||
);
|
||||
@@ -157,9 +110,8 @@ export function measureRoute({
|
||||
origins.set(file, sources);
|
||||
};
|
||||
for (const file of bootstrap) add(file, "bootstrap");
|
||||
const readChunkList = webpackLayout ? assetFilesFromChunkList : filesFrom;
|
||||
for (const [entry, values] of filesBySource)
|
||||
for (const file of readChunkList(values)) add(file, entry);
|
||||
for (const [entry, values] of Object.entries(entries))
|
||||
for (const file of filesFrom(values)) add(file, entry);
|
||||
const size = (file, sources) => {
|
||||
const bytes = readAsset(file);
|
||||
return {
|
||||
@@ -296,13 +248,12 @@ export function collectReport(nextDir, config, metadata = {}) {
|
||||
"Optional PERFORMANCE_COMMIT_SHA supplied by the build caller; not inferred from current checkout.",
|
||||
nodeVersion: process.version,
|
||||
zlibVersion: process.versions.zlib,
|
||||
manifestFormat:
|
||||
"Turbopack: client-reference entryJSFiles. Webpack: deduplicated clientModules[*].chunks.",
|
||||
manifestFormat: "Next App Router client-reference entryJSFiles",
|
||||
definition:
|
||||
"Initial entry envelope: deduplicated rootMainFiles bootstrap plus every client chunk this route's client-reference manifest lists, including boundary/loading entries. Turbopack exposes these as entryJSFiles; webpack exposes them only through clientModules[*].chunks, so the same envelope is derived from whichever the build emitted. This is emitted file size, not measured browser traffic or a load-time benchmark.",
|
||||
"Initial entry envelope: deduplicated rootMainFiles bootstrap plus all entryJSFiles in this route's client-reference manifest, including boundary/loading entries. This is emitted file size, not measured browser traffic or a load-time benchmark.",
|
||||
gzip: "Sum of each unique JavaScript file independently compressed with Node gzip level 9. Excludes HTTP headers and shared-cache reuse.",
|
||||
excluded:
|
||||
"CSS, source maps, images, RSC/HTML payloads, external scripts, async-only chunks absent from the manifest's chunk lists; legacy nomodule polyfills are reported separately.",
|
||||
"CSS, source maps, images, RSC/HTML payloads, external scripts, async-only chunks absent from entryJSFiles; legacy nomodule polyfills are reported separately.",
|
||||
routes,
|
||||
};
|
||||
}
|
||||
|
||||
@@ -216,135 +216,6 @@ describe("route JS measurement", () => {
|
||||
);
|
||||
expect(collectReport(dir, config).routes[0].status).toBe("unavailable");
|
||||
});
|
||||
// The regression: after the build moved to webpack (3d828a61) the manifest
|
||||
// has no entryJSFiles, only clientModules[*].chunks. Every route then
|
||||
// reported "unavailable" and the report measured nothing at all while still
|
||||
// exiting zero, so the budgets silently stopped being enforced.
|
||||
describe("webpack manifests without entryJSFiles", () => {
|
||||
const webpackManifest = {
|
||||
clientModules: {
|
||||
"[project]/src/components/header.tsx": {
|
||||
chunks: [
|
||||
"4269",
|
||||
"static/chunks/4269-shared.js?dpl=abc",
|
||||
"6726",
|
||||
"static/chunks/header-entry.js?dpl=abc",
|
||||
],
|
||||
},
|
||||
"[project]/src/app/(site)/news/page.tsx": {
|
||||
chunks: [
|
||||
"4269",
|
||||
"static/chunks/4269-shared.js?dpl=abc",
|
||||
"7777",
|
||||
"/_next/static/chunks/page.js?dpl=abc",
|
||||
],
|
||||
},
|
||||
// Async-only modules are recorded with an empty chunk list.
|
||||
"[project]/src/components/lazy.tsx": { chunks: [] },
|
||||
},
|
||||
};
|
||||
const webpackFiles = {
|
||||
// buildManifest.rootMainFiles lists runtime.js and shared.js, so both
|
||||
// bootstrap assets must exist or the read fails.
|
||||
"static/chunks/runtime.js": Buffer.from("const runtime = true;"),
|
||||
"static/chunks/shared.js": Buffer.from("bootstrap".repeat(10)),
|
||||
"static/chunks/4269-shared.js": Buffer.from("shared".repeat(50)),
|
||||
"static/chunks/header-entry.js": Buffer.from("header"),
|
||||
"static/chunks/page.js": Buffer.from("page"),
|
||||
"static/chunks/polyfill.js": Buffer.from("legacy"),
|
||||
};
|
||||
const measure = () =>
|
||||
measureRoute({
|
||||
budget,
|
||||
appPath,
|
||||
buildManifest,
|
||||
clientManifest: webpackManifest,
|
||||
readAsset: (file) => webpackFiles[file],
|
||||
});
|
||||
|
||||
it("derives the envelope from clientModules and ignores chunk ids", () => {
|
||||
const row = measure();
|
||||
expect(row.status).toBe("measured");
|
||||
// 2 bootstrap + shared + header-entry + page; the numeric chunk ids
|
||||
// are not assets and must not throw or be counted.
|
||||
expect(row.initial.chunkCount).toBe(5);
|
||||
expect(row.initial.chunks.map((f) => f.path).sort()).toEqual([
|
||||
"static/chunks/4269-shared.js",
|
||||
"static/chunks/header-entry.js",
|
||||
"static/chunks/page.js",
|
||||
"static/chunks/runtime.js",
|
||||
"static/chunks/shared.js",
|
||||
]);
|
||||
// Same bytes as the Turbopack fixture would produce for these files.
|
||||
expect(row.initial.rawBytes).toBe(
|
||||
Object.values(webpackFiles)
|
||||
.filter((b) => !b.includes("legacy"))
|
||||
.reduce((n, b) => n + b.length, 0),
|
||||
);
|
||||
});
|
||||
|
||||
it("counts a chunk reached by several client modules only once", () => {
|
||||
const shared = measure().initial.chunks.find(
|
||||
(f) => f.path === "static/chunks/4269-shared.js",
|
||||
);
|
||||
expect(shared).toBeDefined();
|
||||
expect(measure().initial.chunkCount).toBe(5);
|
||||
});
|
||||
|
||||
it("does not leak absolute module paths into the report", () => {
|
||||
const sources = new Set(
|
||||
measure().initial.chunks.flatMap((chunk) => chunk.sources),
|
||||
);
|
||||
// Only the two known origin labels; no node_modules path may appear.
|
||||
expect([...sources].sort()).toEqual(["bootstrap", "client-module"]);
|
||||
});
|
||||
|
||||
it("still fails rather than under-reporting a malformed chunk path", () => {
|
||||
expect(() =>
|
||||
measureRoute({
|
||||
budget,
|
||||
appPath,
|
||||
buildManifest,
|
||||
clientManifest: {
|
||||
clientModules: {
|
||||
x: { chunks: ["static/chunks/../../etc/passwd"] },
|
||||
},
|
||||
},
|
||||
readAsset: (file) => webpackFiles[file],
|
||||
}),
|
||||
).toThrow("Unsupported JavaScript asset");
|
||||
});
|
||||
|
||||
it("reports unavailable when webpack recorded no chunks at all", () => {
|
||||
expect(() =>
|
||||
measureRoute({
|
||||
budget,
|
||||
appPath,
|
||||
buildManifest,
|
||||
clientManifest: { clientModules: { x: { chunks: [] } } },
|
||||
readAsset: (file) => webpackFiles[file],
|
||||
}),
|
||||
).toThrow("Neither entryJSFiles nor clientModules");
|
||||
});
|
||||
|
||||
it("prefers entryJSFiles when a manifest carries both", () => {
|
||||
// A future Next version could emit both; the explicit list wins
|
||||
// because it is per-segment and therefore the tighter envelope.
|
||||
const row = measureRoute({
|
||||
budget,
|
||||
appPath,
|
||||
buildManifest,
|
||||
clientManifest: {
|
||||
...webpackManifest,
|
||||
entryJSFiles: {
|
||||
"[project]/src/app/(site)/news/page": ["static/chunks/page.js"],
|
||||
},
|
||||
},
|
||||
readAsset: (file) => webpackFiles[file],
|
||||
});
|
||||
expect(row.initial.chunkCount).toBe(3);
|
||||
});
|
||||
});
|
||||
it("does not deduplicate shared files across independent cold route totals", () => {
|
||||
const row = measureRoute({
|
||||
budget,
|
||||
|
||||
@@ -3,6 +3,7 @@ import {
|
||||
copyFileSync,
|
||||
mkdirSync,
|
||||
mkdtempSync,
|
||||
readFileSync,
|
||||
rmSync,
|
||||
writeFileSync,
|
||||
} from "node:fs";
|
||||
@@ -84,3 +85,93 @@ it.skipIf(!hasCompose)(
|
||||
},
|
||||
30_000,
|
||||
);
|
||||
|
||||
it("documents the local CrowdSec switches in .env.example", () => {
|
||||
const examples = readFileSync(path.join(root, ".env.example"), "utf8");
|
||||
for (const key of [
|
||||
"CROWDSEC_LOCAL_ENABLED",
|
||||
"CROWDSEC_LAPI_URL",
|
||||
"CROWDSEC_LAPI_PORT",
|
||||
"CROWDSEC_LAPI_API_KEY",
|
||||
"CROWDSEC_NGINX_LOG_DIR",
|
||||
]) {
|
||||
expect(examples).toContain(key);
|
||||
}
|
||||
});
|
||||
|
||||
it.skipIf(!hasCompose)(
|
||||
"renders the standalone CrowdSec stack with a loopback-only LAPI",
|
||||
() => {
|
||||
const directory = mkdtempSync(path.join(tmpdir(), "cms-crowdsec-"));
|
||||
try {
|
||||
mkdirSync(path.join(directory, "deployment/crowdsec/acquis.d"), {
|
||||
recursive: true,
|
||||
});
|
||||
copyFileSync(
|
||||
path.join(root, "deployment/crowdsec/compose.crowdsec.yml"),
|
||||
path.join(directory, "deployment/crowdsec/compose.crowdsec.yml"),
|
||||
);
|
||||
copyFileSync(
|
||||
path.join(root, "deployment/crowdsec/acquis.d/nginx.yaml"),
|
||||
path.join(directory, "deployment/crowdsec/acquis.d/nginx.yaml"),
|
||||
);
|
||||
writeFileSync(
|
||||
path.join(directory, ".env"),
|
||||
[
|
||||
"CROWDSEC_LAPI_API_KEY=fixture-key",
|
||||
"CROWDSEC_LAPI_PORT=18080",
|
||||
"CROWDSEC_LAPI_URL=http://127.0.0.1:18080",
|
||||
"CROWDSEC_NGINX_LOG_DIR=/var/log/nginx",
|
||||
].join("\n"),
|
||||
);
|
||||
const environment = { ...process.env };
|
||||
for (const key of Object.keys(environment))
|
||||
if (
|
||||
key.startsWith("COMPOSE_") ||
|
||||
key.startsWith("CROWDSEC_") ||
|
||||
key.startsWith("TZ")
|
||||
)
|
||||
delete environment[key];
|
||||
const result = spawnSync(
|
||||
"docker",
|
||||
[
|
||||
"compose",
|
||||
"--project-name",
|
||||
"crowdsec-fixture",
|
||||
"--env-file",
|
||||
".env",
|
||||
"-f",
|
||||
"deployment/crowdsec/compose.crowdsec.yml",
|
||||
"--profile",
|
||||
"security",
|
||||
"config",
|
||||
"--format",
|
||||
"json",
|
||||
],
|
||||
{ cwd: directory, env: environment, encoding: "utf8", timeout: 15_000 },
|
||||
);
|
||||
expect(result.status, result.stderr).toBe(0);
|
||||
const config = JSON.parse(result.stdout);
|
||||
const service = config.services.crowdsec;
|
||||
expect(service).toBeDefined();
|
||||
expect(service.image).toContain("crowdsecurity/crowdsec:");
|
||||
expect(service.environment.BOUNCER_KEY_cms).toBe("fixture-key");
|
||||
expect(service.environment.DISABLE_ONLINE_API).toBe("true");
|
||||
expect(
|
||||
service.ports.some(
|
||||
(published) =>
|
||||
published.host_ip === "127.0.0.1" &&
|
||||
published.published === "18080" &&
|
||||
published.target === 8080,
|
||||
),
|
||||
).toBe(true);
|
||||
const targets = service.volumes.map((volume) => volume.target);
|
||||
expect(targets).toContain("/var/log/nginx");
|
||||
expect(targets).toContain("/etc/crowdsec/acquis.d");
|
||||
expect(service.healthcheck.test.join(" ")).toContain("wget");
|
||||
} finally {
|
||||
rmSync(directory, { recursive: true, force: true });
|
||||
}
|
||||
},
|
||||
30_000,
|
||||
);
|
||||
+3
-28
@@ -1,35 +1,10 @@
|
||||
#!/usr/bin/env bash
|
||||
# Setup cron jobs for maintenance
|
||||
#
|
||||
# Appends to the existing crontab. `crontab -` replaces the whole file, so a
|
||||
# script that pipes one job at a time silently drops every other scheduled job.
|
||||
# Entries are matched by their command, so re-running this is idempotent.
|
||||
set -Eeuo pipefail
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
# Adds one schedule line to the crontab unless its command is already present.
|
||||
add_job() {
|
||||
local schedule="$1" command
|
||||
command="${schedule##* }"
|
||||
local current
|
||||
current="$(crontab -l 2>/dev/null || true)"
|
||||
if grep -Fq "$command" <<<"$current"; then
|
||||
echo "Already scheduled: $command"
|
||||
return
|
||||
fi
|
||||
if [[ -z "$current" ]]; then
|
||||
printf '%s\n' "$schedule" | crontab -
|
||||
else
|
||||
printf '%s\n%s\n' "$current" "$schedule" | crontab -
|
||||
fi
|
||||
echo "Scheduled: $schedule"
|
||||
}
|
||||
|
||||
# Run backup every day at 03:00
|
||||
add_job "0 3 * * * $SCRIPT_DIR/backup.sh"
|
||||
# Run prune every day at 04:00. Daily rather than weekly: byparr leaks roughly
|
||||
# 1.7 GB/day of orphaned browser profiles into its writable layer, so a weekly
|
||||
# run would let ~12 GB accumulate before anything reclaimed it.
|
||||
add_job "0 4 * * * $SCRIPT_DIR/docker-prune.sh"
|
||||
echo "0 3 * * * $SCRIPT_DIR/backup.sh" | crontab -
|
||||
# Run prune every Sunday at 04:00
|
||||
echo "0 4 * * 0 $SCRIPT_DIR/docker-prune.sh" | crontab -
|
||||
|
||||
echo "Cron jobs configured."
|
||||
@@ -1,166 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Voer een zwaar commando uit onder een harde geheugenplafond.
|
||||
#
|
||||
# Waarom dit bestaat:
|
||||
# De host draait met `vm.overcommit_memory=0` en ZONDER swap. Vraagt een
|
||||
# proces meer geheugen dan er vrij is, dan geeft de kernel niets weg en
|
||||
# roept hij meteen de OOM-killer aan. Die kiest zijn slachtoffer over de
|
||||
# héle machine, niet alleen in het schuldige proces — dus een build kan de
|
||||
# database, nginx of de live release meenemen.
|
||||
#
|
||||
# `next build` op Turbopack groeit op dit 329-route app voorbij 12GB RSS
|
||||
# en is ook met 4GB swap nog steeds dood. Zie commit 3d828a61.
|
||||
#
|
||||
# Wat dit doet:
|
||||
# Het commando komt in zijn eigen cgroup met `MemoryMax`. Als het door die
|
||||
# grens heen groeit krijgt alleen die cgroup een OOM-signaal: het commando
|
||||
# zelf sterft, de rest van de machine leeft. Dat is precies het gedrag dat
|
||||
# je wilt — de build faalt, de site blijft staan.
|
||||
#
|
||||
# Met `--max-old-space-size` lukt dat niet. Die limiet zit op de V8-heap en
|
||||
# Turbopack-geheugen is native Rust-geheugen; met een 2GB cap piekte de RSS
|
||||
# alsnog op 8GB. Zie het commentaar in de Dockerfile.
|
||||
#
|
||||
# Backends:
|
||||
#
|
||||
# systemd (cgroup MemoryMax)
|
||||
# Meet RSS over de héle procesboom. Dit is de echte garantie en wordt
|
||||
# overal gebruikt waar systemd beschikbaar is (de host waar deze
|
||||
# CMS draait). De RSS-plafonds in package.json zijn hierop gekozen:
|
||||
# `next build` piekte op 6,5GB, dus 10GB laat ruimte over terwijl er
|
||||
# 6GB basislast naast blijft passen binnen de 23,5GB van deze machine.
|
||||
#
|
||||
# ulimit -v (per proces, virtuele adresruimte)
|
||||
# Alleen als expliciet gevraagd. Meet virtuele adresruimte, NIET RSS, en
|
||||
# kan de boom helemaal niet begrenzen: elke worker krijgt z'n eigen
|
||||
# limiet. Op moderne V8 is het bovendien een vergiftigde gift: `-v 10g`
|
||||
# laat V8 de heaplimiet terugbrengen naar 2,25GB (webpack sterft met
|
||||
# std::bad_alloc), en `-v 20g` laat de v8-wasm-memory-toewijzing falen
|
||||
# tijdens `next build`. Zet CMS_MEMORY_CAP_VIRTUAL ruim boven de fysieke
|
||||
# RAM als je het echt wilt gebruiken.
|
||||
#
|
||||
# Geen van beide -> weigeren. Stil onbegrensd doorlopen zou precies de
|
||||
# valse geruststelling zijn waar 3d828a61 voor waarschuwt. Omgevingen
|
||||
# zonder systemd (de Docker-build, de GitLab-runner) kiezen daarom
|
||||
# expliciet voor CMS_MEMORY_CAP_BACKEND=none — met een waarschuwing,
|
||||
# en met als rechtvaardiging dat die builds al begrensd zijn door
|
||||
# `next build --webpack` + `--max-old-space-size` en in hun eigen
|
||||
# geïsoleerde container draaien, niet op de host.
|
||||
#
|
||||
# Gebruik: bash scripts/with-memory-cap.sh 10g <command...>
|
||||
# Backend kiezen: CMS_MEMORY_CAP_BACKEND=systemd|ulimit|none|auto
|
||||
# ulimit-waarde kiezen: CMS_MEMORY_CAP_VIRTUAL=40g
|
||||
set -Eeuo pipefail
|
||||
|
||||
usage() {
|
||||
echo "gebruik: $0 <plafond, bv. 10g> <command...>" >&2
|
||||
exit 64
|
||||
}
|
||||
|
||||
[ "$#" -ge 2 ] || usage
|
||||
cap="$1"
|
||||
shift
|
||||
|
||||
# Zet 10g / 512m / 2G / 1234567 om in bytes. Alleen bytes gaan naar
|
||||
# systemd: MemoryMax accepteert `10G` maar weigert `10g`, en die
|
||||
# hoofdletterval is te makkelijk om per ongeluk te treffen.
|
||||
to_bytes() {
|
||||
local value="$1" number suffix
|
||||
if [[ "$value" =~ ^([0-9]+)([kKmMgGtT]?)$ ]]; then
|
||||
number="${BASH_REMATCH[1]}"
|
||||
suffix="${BASH_REMATCH[2]}"
|
||||
else
|
||||
echo "onbekend plafond-formaat: $value" >&2
|
||||
return 1
|
||||
fi
|
||||
case "$suffix" in
|
||||
k | K) echo $((number * 1024)) ;;
|
||||
m | M) echo $((number * 1024 * 1024)) ;;
|
||||
g | G) echo $((number * 1024 * 1024 * 1024)) ;;
|
||||
t | T) echo $((number * 1024 * 1024 * 1024 * 1024)) ;;
|
||||
*) echo "$number" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
bytes="$(to_bytes "$cap")" || exit 64
|
||||
kilobytes=$((bytes / 1024))
|
||||
|
||||
# De virtuele waarde voor ulimit -v. Bewust los van `cap`: zie de toelichting
|
||||
# hierboven, 10g -v breekt de webpack-build.
|
||||
virtual_bytes="$(to_bytes "${CMS_MEMORY_CAP_VIRTUAL:-40g}")" || exit 64
|
||||
virtual_kb=$((virtual_bytes / 1024))
|
||||
|
||||
backend="${CMS_MEMORY_CAP_BACKEND:-auto}"
|
||||
systemd_cmd=()
|
||||
|
||||
# Echt proberen, niet alleen uitzoeken of het bestand bestaat: `systemd-run`
|
||||
# zonder rechten faalt met "Access denied", en dat moet dan een nette
|
||||
# terugval naar ulimit worden in plaats van een kapotte build.
|
||||
probe_systemd() {
|
||||
command -v systemd-run >/dev/null 2>&1 || return 1
|
||||
[ -d /run/systemd/system ] || return 1
|
||||
if systemd-run --scope --quiet true 2>/dev/null; then
|
||||
systemd_cmd=(systemd-run --scope --quiet)
|
||||
return 0
|
||||
fi
|
||||
if systemd-run --user --scope --quiet true 2>/dev/null; then
|
||||
systemd_cmd=(systemd-run --user --scope --quiet)
|
||||
return 0
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
|
||||
run_systemd() {
|
||||
echo "[mem-cap] systemd cgroup MemoryMax=$((bytes / 1024 / 1024 / 1024))GB: $*" >&2
|
||||
exec "${systemd_cmd[@]}" -p "MemoryMax=$bytes" "$@"
|
||||
}
|
||||
|
||||
run_ulimit() {
|
||||
echo "[mem-cap] ulimit -v ${virtual_kb}KB per proces (geen systemd; RSS-plafond ${cap} niet meetbaar zonder cgroup): $*" >&2
|
||||
if [ "$virtual_bytes" -lt $((16 * 1024 * 1024 * 1024)) ]; then
|
||||
echo "[mem-cap] let op: -v onder 16g verlaagt V8's heaplimiet en breekt de build; verhoog CMS_MEMORY_CAP_VIRTUAL" >&2
|
||||
fi
|
||||
ulimit -v "$virtual_kb" || {
|
||||
echo "[mem-cap] ulimit -v $virtual_kb werd geweigerd" >&2
|
||||
return 1
|
||||
}
|
||||
exec "$@"
|
||||
}
|
||||
|
||||
run_refuse() {
|
||||
echo "[mem-cap] geen systemd hier; weiger onbegrensd te draaien." >&2
|
||||
echo "[mem-cap] zet CMS_MEMORY_CAP_BACKEND=none om dit bewust te accepteren, of =ulimit voor een per-proces vangnet." >&2
|
||||
return 1
|
||||
}
|
||||
|
||||
run_opted_out() {
|
||||
echo "[mem-cap] WAARSCHUWING: plafond bewust uitgeschakeld, dit commando kan de machine laten OOM-killed worden: $*" >&2
|
||||
exec "$@"
|
||||
}
|
||||
|
||||
case "$backend" in
|
||||
systemd)
|
||||
probe_systemd || {
|
||||
echo "[mem-cap] CMS_MEMORY_CAP_BACKEND=systemd maar systemd-run reageert niet" >&2
|
||||
exit 70
|
||||
}
|
||||
run_systemd "$@"
|
||||
;;
|
||||
ulimit)
|
||||
run_ulimit "$@"
|
||||
;;
|
||||
none | off)
|
||||
run_opted_out "$@"
|
||||
;;
|
||||
auto)
|
||||
if probe_systemd; then
|
||||
run_systemd "$@"
|
||||
else
|
||||
run_refuse "$@"
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
echo "[mem-cap] onbekende backend: $backend" >&2
|
||||
exit 64
|
||||
;;
|
||||
esac
|
||||
@@ -15,6 +15,14 @@ import {
|
||||
setLastCloudflareVerify,
|
||||
verifyCloudflareConnection,
|
||||
} from "@/lib/cloudflare-api";
|
||||
import {
|
||||
setLastCrowdsecVerify,
|
||||
verifyCrowdsecConnection,
|
||||
} from "@/lib/crowdsec-api";
|
||||
import {
|
||||
setLastCrowdsecReport,
|
||||
verifyCrowdsecReporting,
|
||||
} from "@/lib/crowdsec-report";
|
||||
import { db, WebsiteSetting } from "@/lib/db";
|
||||
import { logger } from "@/lib/logger";
|
||||
import { PERMS } from "@/lib/permissions";
|
||||
@@ -33,6 +41,17 @@ function positiveInt(raw: FormDataEntryValue | null, fallback: number): number {
|
||||
return Math.floor(n);
|
||||
}
|
||||
|
||||
function clampInt(
|
||||
raw: FormDataEntryValue | null,
|
||||
fallback: number,
|
||||
min: number,
|
||||
max: number,
|
||||
): number {
|
||||
const n = Number(str(raw));
|
||||
if (!Number.isFinite(n)) return fallback;
|
||||
return Math.min(max, Math.max(min, Math.floor(n)));
|
||||
}
|
||||
|
||||
function parseTiers(raw: FormDataEntryValue | null): AntiddosBlockTier[] {
|
||||
const tiers: AntiddosBlockTier[] = [];
|
||||
for (const part of str(raw).split(",")) {
|
||||
@@ -99,6 +118,17 @@ function configFromForm(formData: FormData): AntiddosConfig {
|
||||
defaults.globalHaltMs,
|
||||
),
|
||||
cloudflareAutoBlock: str(formData.get("cfa_auto_block")) === "1",
|
||||
crowdsecAutoBlock: str(formData.get("cs_auto_block")) === "1",
|
||||
crowdsecBlockScore: clampInt(
|
||||
formData.get("cs_block_score"),
|
||||
defaults.crowdsecBlockScore,
|
||||
0,
|
||||
5,
|
||||
),
|
||||
crowdsecBlockTtlSeconds: positiveInt(
|
||||
formData.get("cs_block_ttl_sec"),
|
||||
defaults.crowdsecBlockTtlSeconds,
|
||||
),
|
||||
};
|
||||
}
|
||||
|
||||
@@ -123,6 +153,9 @@ async function persistSettings(config: AntiddosConfig): Promise<void> {
|
||||
],
|
||||
["antiddos_global_halt_ms", String(config.globalHaltMs)],
|
||||
["antiddos_cfa_auto_block", config.cloudflareAutoBlock ? "1" : "0"],
|
||||
["antiddos_cs_auto_block", config.crowdsecAutoBlock ? "1" : "0"],
|
||||
["antiddos_cs_block_score", String(config.crowdsecBlockScore)],
|
||||
["antiddos_cs_block_ttl", String(config.crowdsecBlockTtlSeconds)],
|
||||
];
|
||||
await Promise.all(
|
||||
entries.map(([key, value]) =>
|
||||
@@ -195,6 +228,7 @@ export async function unbanAntiddosIp(formData: FormData): Promise<void> {
|
||||
await Promise.all([
|
||||
redis.del(`antiddos:block:${ip}`),
|
||||
redis.del(`antiddos:block:meta:${ip}`),
|
||||
redis.del(`crowdsec:report:${ip}`),
|
||||
redis.del(`antiddos:v:${ip}`),
|
||||
]);
|
||||
}
|
||||
@@ -231,6 +265,32 @@ export async function removeCloudflareRule(formData: FormData): Promise<void> {
|
||||
revalidatePath("/admin/devops/antiddos");
|
||||
}
|
||||
|
||||
/** Test the configured CrowdSec API credentials against the CTI endpoint. */
|
||||
export async function verifyCrowdsecConfiguration(): Promise<void> {
|
||||
const staff = await requirePermission(PERMS.SETTINGS_VIEW);
|
||||
const status = await verifyCrowdsecConnection();
|
||||
await setLastCrowdsecVerify(status);
|
||||
logger.info("CrowdSec API configuration verified", {
|
||||
staff: staff.username,
|
||||
ok: status.ok,
|
||||
message: status.message,
|
||||
});
|
||||
revalidatePath("/admin/devops/antiddos");
|
||||
}
|
||||
|
||||
/** Test the CrowdSec signal-push (CAPI watcher) channel. */
|
||||
export async function verifyCrowdsecReportingConfiguration(): Promise<void> {
|
||||
const staff = await requirePermission(PERMS.SETTINGS_VIEW);
|
||||
const status = await verifyCrowdsecReporting();
|
||||
await setLastCrowdsecReport(status);
|
||||
logger.info("CrowdSec reporting configuration verified", {
|
||||
staff: staff.username,
|
||||
ok: status.ok,
|
||||
message: status.message,
|
||||
});
|
||||
revalidatePath("/admin/devops/antiddos");
|
||||
}
|
||||
|
||||
/** Test the configured Cloudflare API credentials against the zone. */
|
||||
export async function verifyCloudflareConfiguration(): Promise<void> {
|
||||
const staff = await requirePermission(PERMS.SETTINGS_VIEW);
|
||||
|
||||
@@ -86,7 +86,7 @@ export async function resetPassword(formData: FormData): Promise<void> {
|
||||
}
|
||||
|
||||
let error: string | null = null;
|
||||
if (password.length < 12) error = "Password must be at least 12 characters";
|
||||
if (password.length < 6) error = "Password must be at least 6 characters";
|
||||
|
||||
if (!error) {
|
||||
try {
|
||||
|
||||
@@ -184,7 +184,6 @@ describe("register", () => {
|
||||
expect(result).toEqual({
|
||||
error: "Username must be at least 3 characters",
|
||||
ok: false,
|
||||
code: "usernameMinLength",
|
||||
});
|
||||
expect(state.insert).not.toHaveBeenCalled();
|
||||
});
|
||||
@@ -192,7 +191,6 @@ describe("register", () => {
|
||||
it("rejects usernames containing characters outside the allowed set", async () => {
|
||||
const result = await register(PREV, buildForm({ username: "bad name!" }));
|
||||
expect(result.error).toContain("letters, numbers, underscore and hyphen");
|
||||
expect(result.code).toBe("usernamePattern");
|
||||
expect(state.insert).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
@@ -201,7 +199,6 @@ describe("register", () => {
|
||||
expect(result).toEqual({
|
||||
error: "Enter a valid email address",
|
||||
ok: false,
|
||||
code: "emailValid",
|
||||
});
|
||||
});
|
||||
|
||||
@@ -210,7 +207,6 @@ describe("register", () => {
|
||||
expect(result).toEqual({
|
||||
error: "Password must be at least 12 characters",
|
||||
ok: false,
|
||||
code: "passwordMinLength",
|
||||
});
|
||||
expect(state.insert).not.toHaveBeenCalled();
|
||||
});
|
||||
@@ -224,7 +220,6 @@ describe("register", () => {
|
||||
}),
|
||||
);
|
||||
expect(result.error).toContain("uppercase");
|
||||
expect(result.code).toBe("passwordUpper");
|
||||
});
|
||||
|
||||
it("rejects passwords without a digit", async () => {
|
||||
@@ -236,7 +231,6 @@ describe("register", () => {
|
||||
}),
|
||||
);
|
||||
expect(result.error).toContain("digit");
|
||||
expect(result.code).toBe("passwordDigit");
|
||||
});
|
||||
|
||||
it("rejects passwords without a special character", async () => {
|
||||
@@ -248,7 +242,6 @@ describe("register", () => {
|
||||
}),
|
||||
);
|
||||
expect(result.error).toContain("special");
|
||||
expect(result.code).toBe("passwordSpecial");
|
||||
});
|
||||
|
||||
it("rejects mismatched password confirmations", async () => {
|
||||
@@ -256,18 +249,13 @@ describe("register", () => {
|
||||
PREV,
|
||||
buildForm({ password_confirmation: "Different1" }),
|
||||
);
|
||||
expect(result).toEqual({
|
||||
error: "Passwords do not match",
|
||||
ok: false,
|
||||
code: "passwordsMatch",
|
||||
});
|
||||
expect(result).toEqual({ error: "Passwords do not match", ok: false });
|
||||
});
|
||||
|
||||
it("throttles sign-ups per IP", async () => {
|
||||
state.rateLimit.mockResolvedValueOnce({ ok: false, retryAfter: 120 });
|
||||
const result = await runValidRegistration();
|
||||
expect(result.error).toContain("Too many sign-up attempts");
|
||||
expect(result.code).toBe("rateLimited");
|
||||
expect(state.insert).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
@@ -285,7 +273,6 @@ describe("register", () => {
|
||||
expect(result).toEqual({
|
||||
error: "Captcha verification failed. Please try again.",
|
||||
ok: false,
|
||||
code: "captchaFailed",
|
||||
});
|
||||
expect(state.verifyCaptcha).toHaveBeenCalledWith("token", "203.0.113.9");
|
||||
expect(state.insert).not.toHaveBeenCalled();
|
||||
@@ -303,7 +290,6 @@ describe("register", () => {
|
||||
expect(result).toEqual({
|
||||
error: "You must accept the terms and conditions to register.",
|
||||
ok: false,
|
||||
code: "termsRequired",
|
||||
});
|
||||
expect(state.insert).not.toHaveBeenCalled();
|
||||
});
|
||||
@@ -312,11 +298,7 @@ describe("register", () => {
|
||||
state.checkVpn.mockResolvedValue({ blocked: true });
|
||||
state.siteGet.mockResolvedValueOnce("Custom VPN message");
|
||||
const result = await runValidRegistration();
|
||||
expect(result).toEqual({
|
||||
error: "Custom VPN message",
|
||||
ok: false,
|
||||
code: "vpnBlocked",
|
||||
});
|
||||
expect(result).toEqual({ error: "Custom VPN message", ok: false });
|
||||
expect(state.insert).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
@@ -335,7 +317,6 @@ describe("register", () => {
|
||||
state.countTotal = 2;
|
||||
const result = await runValidRegistration();
|
||||
expect(result.error).toContain("maximum number of accounts");
|
||||
expect(result.code).toBe("maxAccountsPerIp");
|
||||
expect(state.insert).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
@@ -359,7 +340,6 @@ describe("register", () => {
|
||||
expect(result).toEqual({
|
||||
error: "That username is already taken",
|
||||
ok: false,
|
||||
code: "usernameTaken",
|
||||
});
|
||||
expect(state.insert).not.toHaveBeenCalled();
|
||||
});
|
||||
@@ -370,7 +350,6 @@ describe("register", () => {
|
||||
expect(result).toEqual({
|
||||
error: "Registration is temporarily unavailable",
|
||||
ok: false,
|
||||
code: "unavailable",
|
||||
});
|
||||
expect(state.logger.warn).toHaveBeenCalledWith(
|
||||
"Username uniqueness check failed during registration",
|
||||
@@ -386,7 +365,6 @@ describe("register", () => {
|
||||
expect(result).toEqual({
|
||||
error: "That username is already taken",
|
||||
ok: false,
|
||||
code: "usernameTaken",
|
||||
});
|
||||
expect(state.logger.error).not.toHaveBeenCalled();
|
||||
});
|
||||
@@ -395,7 +373,6 @@ describe("register", () => {
|
||||
state.insert.mockRejectedValueOnce(new Error("db exploded"));
|
||||
const result = await runValidRegistration();
|
||||
expect(result.error).toContain("Could not create the account");
|
||||
expect(result.code).toBe("createFailed");
|
||||
expect(state.logger.error).toHaveBeenCalledWith(
|
||||
"Account creation failed",
|
||||
expect.objectContaining({ message: "db exploded" }),
|
||||
|
||||
+7
-72
@@ -121,72 +121,19 @@ const registerSchema = z
|
||||
path: ["passwordConfirmation"],
|
||||
});
|
||||
|
||||
/**
|
||||
* Stable, locale-independent reason for a failed sign-up. The client maps these
|
||||
* onto `pages.register.<code>` so the form speaks the visitor's language; the
|
||||
* English `error` string stays as a fallback and for API/log consumers.
|
||||
*/
|
||||
export type RegisterErrorCode =
|
||||
| "usernameMinLength"
|
||||
| "usernameMaxLength"
|
||||
| "usernamePattern"
|
||||
| "usernameReserved"
|
||||
| "usernameTaken"
|
||||
| "emailValid"
|
||||
| "emailDisposable"
|
||||
| "passwordMinLength"
|
||||
| "passwordMaxLength"
|
||||
| "passwordUpper"
|
||||
| "passwordLower"
|
||||
| "passwordDigit"
|
||||
| "passwordSpecial"
|
||||
| "passwordsMatch"
|
||||
| "termsRequired"
|
||||
| "captchaFailed"
|
||||
| "rateLimited"
|
||||
| "vpnBlocked"
|
||||
| "maxAccountsPerIp"
|
||||
| "unavailable"
|
||||
| "createFailed"
|
||||
| "invalidInput";
|
||||
|
||||
/** Maps the schema's English messages onto locale-independent codes. */
|
||||
const ZOD_MESSAGE_CODES: Record<string, RegisterErrorCode> = {
|
||||
"Username must be at least 3 characters": "usernameMinLength",
|
||||
"Username must be at most 25 characters": "usernameMaxLength",
|
||||
"Username may only contain letters, numbers, underscore and hyphen":
|
||||
"usernamePattern",
|
||||
"This username is reserved": "usernameReserved",
|
||||
"Enter a valid email address": "emailValid",
|
||||
"Temporary email domains are not allowed": "emailDisposable",
|
||||
"Password must be at least 12 characters": "passwordMinLength",
|
||||
"Password is too long": "passwordMaxLength",
|
||||
"Password must contain at least one uppercase letter": "passwordUpper",
|
||||
"Password must contain at least one lowercase letter": "passwordLower",
|
||||
"Password must contain at least one digit": "passwordDigit",
|
||||
"Password must contain at least one special character": "passwordSpecial",
|
||||
"Passwords do not match": "passwordsMatch",
|
||||
};
|
||||
|
||||
// A valid starter Habbo figure so the avatar renders in-client immediately.
|
||||
const DEFAULT_LOOK = "hr-100-.hd-180-1.ch-255-66.lg-280-110.sh-305-62";
|
||||
|
||||
export interface RegisterState {
|
||||
error: string | null;
|
||||
ok: boolean;
|
||||
/** Locale-independent reason, present on every failure. */
|
||||
code?: RegisterErrorCode;
|
||||
}
|
||||
|
||||
export async function register(
|
||||
_prevState: RegisterState,
|
||||
formData: FormData,
|
||||
): Promise<RegisterState> {
|
||||
const fail = (error: string, code: RegisterErrorCode): RegisterState => ({
|
||||
error,
|
||||
ok: false,
|
||||
code,
|
||||
});
|
||||
const fail = (error: string): RegisterState => ({ error, ok: false });
|
||||
const raw = {
|
||||
username: String(formData.get("username") ?? "")
|
||||
.normalize("NFC")
|
||||
@@ -208,8 +155,7 @@ export async function register(
|
||||
|
||||
const parsed = registerSchema.safeParse(raw);
|
||||
if (!parsed.success) {
|
||||
const message = parsed.error.issues[0]?.message ?? "Invalid input";
|
||||
return fail(message, ZOD_MESSAGE_CODES[message] ?? "invalidInput");
|
||||
return fail(parsed.error.issues[0]?.message ?? "Invalid input");
|
||||
}
|
||||
|
||||
const { username, mail, password, look } = parsed.data;
|
||||
@@ -220,7 +166,6 @@ export async function register(
|
||||
if (!(await rateLimit(`register:${ip}`, 5, 10 * 60_000)).ok) {
|
||||
return fail(
|
||||
"Too many sign-up attempts. Please wait a few minutes and try again.",
|
||||
"rateLimited",
|
||||
);
|
||||
}
|
||||
|
||||
@@ -229,25 +174,18 @@ export async function register(
|
||||
if (cfg.provider !== "none") {
|
||||
const token = String(formData.get(cfg.field) ?? "").normalize("NFC");
|
||||
if (!(await verifyCaptcha(token, ip)))
|
||||
return fail(
|
||||
"Captcha verification failed. Please try again.",
|
||||
"captchaFailed",
|
||||
);
|
||||
return fail("Captcha verification failed. Please try again.");
|
||||
}
|
||||
|
||||
// Terms acceptance check.
|
||||
if (!raw.termsAccepted)
|
||||
return fail(
|
||||
"You must accept the terms and conditions to register.",
|
||||
"termsRequired",
|
||||
);
|
||||
return fail("You must accept the terms and conditions to register.");
|
||||
|
||||
// VPN/proxy block (only when enabled in /admin/vpn).
|
||||
if ((await checkVpn(ip)).blocked) {
|
||||
return fail(
|
||||
(await siteSettings.get("vpn_block_message", "")) ||
|
||||
"Registrations from VPN/proxy connections are not allowed.",
|
||||
"vpnBlocked",
|
||||
);
|
||||
}
|
||||
|
||||
@@ -262,7 +200,6 @@ export async function register(
|
||||
if (Number(row?.total ?? 0) >= max)
|
||||
return fail(
|
||||
"You have reached the maximum number of accounts for your connection.",
|
||||
"maxAccountsPerIp",
|
||||
);
|
||||
}
|
||||
|
||||
@@ -273,11 +210,10 @@ export async function register(
|
||||
.from(User)
|
||||
.where(eq(User.username, username))
|
||||
.limit(1);
|
||||
if (existing)
|
||||
return fail("That username is already taken", "usernameTaken");
|
||||
if (existing) return fail("That username is already taken");
|
||||
} catch {
|
||||
logger.warn("Username uniqueness check failed during registration");
|
||||
return fail("Registration is temporarily unavailable", "unavailable");
|
||||
return fail("Registration is temporarily unavailable");
|
||||
}
|
||||
|
||||
const now = Math.floor(Date.now() / 1000);
|
||||
@@ -297,7 +233,7 @@ export async function register(
|
||||
} catch (err) {
|
||||
const code = (err as { cause?: { code?: string } }).cause?.code;
|
||||
if (code === "ER_DUP_ENTRY") {
|
||||
return fail("That username is already taken", "usernameTaken");
|
||||
return fail("That username is already taken");
|
||||
}
|
||||
logger.error("Account creation failed", {
|
||||
code,
|
||||
@@ -305,7 +241,6 @@ export async function register(
|
||||
});
|
||||
return fail(
|
||||
"Could not create the account. Please try again or contact staff.",
|
||||
"createFailed",
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
@@ -1,54 +0,0 @@
|
||||
"use server";
|
||||
|
||||
import { eq } from "drizzle-orm";
|
||||
import { sendVerification } from "@/lib/auth/email-verification";
|
||||
import { db, User } from "@/lib/db";
|
||||
import { clientIp, rateLimit } from "@/lib/rate-limit";
|
||||
|
||||
export interface ResendVerificationState {
|
||||
ok: boolean;
|
||||
error: string | null;
|
||||
}
|
||||
|
||||
const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
|
||||
|
||||
/**
|
||||
* Re-send a verification e-mail for an address the visitor typed on /verify.
|
||||
*
|
||||
* Deliberately reports success even when no matching unverified account exists:
|
||||
* a distinct failure would let anyone probe which addresses are registered. The
|
||||
* identical-privacy behaviour also applies to the e-mail templates, which are
|
||||
* only sent for real accounts. Rate limiting is the spam defence.
|
||||
*/
|
||||
export async function resendVerification(
|
||||
_prevState: ResendVerificationState,
|
||||
formData: FormData,
|
||||
): Promise<ResendVerificationState> {
|
||||
const email = String(formData.get("email") ?? "")
|
||||
.normalize("NFC")
|
||||
.trim()
|
||||
.toLowerCase();
|
||||
if (!EMAIL_RE.test(email)) {
|
||||
return { ok: false, error: "invalid" };
|
||||
}
|
||||
|
||||
const ip = await clientIp();
|
||||
if (!(await rateLimit(`verify:resend:${ip}`, 3, 10 * 60_000)).ok) {
|
||||
return { ok: false, error: "rateLimited" };
|
||||
}
|
||||
|
||||
try {
|
||||
const [user] = await db
|
||||
.select({ id: User.id, mailVerified: User.mailVerified })
|
||||
.from(User)
|
||||
.where(eq(User.mail, email))
|
||||
.limit(1);
|
||||
if (user && user.mailVerified !== "1") {
|
||||
await sendVerification(email);
|
||||
}
|
||||
} catch {
|
||||
return { ok: false, error: "unavailable" };
|
||||
}
|
||||
|
||||
return { ok: true, error: null };
|
||||
}
|
||||
+190
-178
@@ -1,41 +1,20 @@
|
||||
import { count, desc, eq } from "drizzle-orm";
|
||||
import type { Metadata } from "next";
|
||||
import { headers } from "next/headers";
|
||||
import Image from "next/image";
|
||||
import { redirect } from "next/navigation";
|
||||
import { getTranslations } from "next-intl/server";
|
||||
import {
|
||||
AuthPageFrame,
|
||||
AuthUsersCards,
|
||||
} from "@/components/auth/auth-page-frame";
|
||||
import { AuthTopBar } from "@/components/auth/auth-top-bar";
|
||||
import { LoginForm } from "@/components/auth/login-form";
|
||||
import { Reveal } from "@/components/motion-reveal";
|
||||
import { UserAvatarThumbnail } from "@/components/shared/user-avatar-thumbnail";
|
||||
import { SurfaceCard } from "@/components/surface-card";
|
||||
import { auth } from "@/lib/auth";
|
||||
import { safeRedirectPath } from "@/lib/auth/safe-redirect";
|
||||
import { cached } from "@/lib/cache";
|
||||
import { db, User } from "@/lib/db";
|
||||
import { resolveHotelName } from "@/lib/hotel-name";
|
||||
import { captchaConfig } from "@/lib/services/captcha";
|
||||
import { siteSettings } from "@/lib/services/site-settings";
|
||||
import { ICON_FRIENDS, ICON_NAV_GOODY, ICON_NAV_ME } from "@/lib/site-icons";
|
||||
|
||||
export async function generateMetadata(): Promise<Metadata> {
|
||||
const t = await getTranslations("pages.login");
|
||||
const title = t("title");
|
||||
const description = t("subtitle");
|
||||
return {
|
||||
title,
|
||||
description,
|
||||
// Sign-in is a dead end for crawlers and duplicates the homepage copy.
|
||||
robots: { index: false, follow: false },
|
||||
openGraph: { title, description, type: "website" },
|
||||
};
|
||||
}
|
||||
|
||||
export default async function LoginPage({
|
||||
searchParams,
|
||||
}: {
|
||||
searchParams: Promise<{ from?: string; registered?: string }>;
|
||||
}) {
|
||||
export default async function LoginPage() {
|
||||
const t = await getTranslations("pages.login");
|
||||
const [hotelName, cfg, logo] = await Promise.all([
|
||||
resolveHotelName(),
|
||||
@@ -44,14 +23,6 @@ export default async function LoginPage({
|
||||
]);
|
||||
const nonce = (await headers()).get("x-nonce") ?? undefined;
|
||||
|
||||
const sp = await searchParams;
|
||||
const redirectTo = safeRedirectPath(sp.from);
|
||||
|
||||
// Already signed in: the form has nothing to do here. Honour `from` first so
|
||||
// an admin bounced off /admin lands back where they were heading.
|
||||
const session = await auth();
|
||||
if (session?.user?.id) redirect(redirectTo);
|
||||
|
||||
const [online, recentUsers, latestUsers] = await Promise.all([
|
||||
cached("online_count", 10_000, () =>
|
||||
db
|
||||
@@ -60,153 +31,194 @@ export default async function LoginPage({
|
||||
.where(eq(User.online, "1"))
|
||||
.then((rows) => rows[0]?.total ?? 0),
|
||||
).catch(() => 0),
|
||||
cached(
|
||||
"auth_online_users",
|
||||
10_000,
|
||||
() =>
|
||||
db
|
||||
.select({ username: User.username, look: User.look })
|
||||
.from(User)
|
||||
.where(eq(User.online, "1"))
|
||||
.limit(8),
|
||||
{ staleMs: 30000 },
|
||||
).catch(() => []),
|
||||
cached(
|
||||
"auth_latest_users",
|
||||
30_000,
|
||||
() =>
|
||||
db
|
||||
.select({ username: User.username, look: User.look })
|
||||
.from(User)
|
||||
.orderBy(desc(User.accountCreated))
|
||||
.limit(8),
|
||||
{ staleMs: 60000 },
|
||||
).catch(() => []),
|
||||
db
|
||||
.select({ username: User.username, look: User.look })
|
||||
.from(User)
|
||||
.where(eq(User.online, "1"))
|
||||
.limit(8)
|
||||
.catch(() => []),
|
||||
db
|
||||
.select({ username: User.username, look: User.look })
|
||||
.from(User)
|
||||
.orderBy(desc(User.accountCreated))
|
||||
.limit(8)
|
||||
.catch(() => []),
|
||||
]);
|
||||
|
||||
// `/login?registered=1` is where the sign-up form lands when it could not
|
||||
// auto sign-in (e-mail verification still pending). Without this notice the
|
||||
// visitor would only see an empty login form and no sign their account
|
||||
// exists.
|
||||
const notice =
|
||||
sp.registered === "1" ? (
|
||||
<p
|
||||
role="status"
|
||||
className="auth-alert auth-alert--success animate-fade-in-up m-0 mb-4"
|
||||
>
|
||||
{t("registeredSuccess")}
|
||||
</p>
|
||||
) : undefined;
|
||||
|
||||
return (
|
||||
<AuthPageFrame
|
||||
hotelName={hotelName}
|
||||
logo={logo}
|
||||
title={t("title")}
|
||||
subtitle={t("subtitle")}
|
||||
notice={notice}
|
||||
form={
|
||||
<LoginForm
|
||||
redirectTo={redirectTo}
|
||||
captcha={{
|
||||
provider: cfg.provider,
|
||||
siteKey: cfg.siteKey || undefined,
|
||||
field: cfg.field || undefined,
|
||||
}}
|
||||
nonce={nonce}
|
||||
/>
|
||||
}
|
||||
>
|
||||
<SurfaceCard
|
||||
className="card-glow relative overflow-hidden p-6 text-center"
|
||||
style={{
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 20%, transparent)",
|
||||
}}
|
||||
>
|
||||
<div
|
||||
className="absolute inset-0"
|
||||
style={{
|
||||
background:
|
||||
"linear-gradient(135deg, color-mix(in srgb, var(--color-primary) 10%, transparent), color-mix(in srgb, var(--color-accent) 10%, transparent))",
|
||||
}}
|
||||
/>
|
||||
<div aria-hidden="true" className="absolute inset-0 overflow-hidden">
|
||||
<div className="brand-halo left-1/2 top-0 h-64 w-[460px] max-w-full -translate-x-1/2 -translate-y-1/2" />
|
||||
<div
|
||||
className="aurora-blob -left-16 top-10 h-56 w-56"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 45%, transparent)",
|
||||
}}
|
||||
/>
|
||||
<div
|
||||
className="aurora-blob -right-16 bottom-0 h-56 w-56"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-accent) 40%, transparent)",
|
||||
animationDelay: "-8s",
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
<div className="relative">
|
||||
<div className="brand-halo left-1/2 top-8 h-52 w-52 -translate-x-1/2" />
|
||||
<Image
|
||||
src="/assets/images/FrankwithBag.gif"
|
||||
alt="Frank"
|
||||
width={130}
|
||||
height={170}
|
||||
className="relative object-contain mx-auto drop-shadow-xl animate-float"
|
||||
unoptimized
|
||||
/>
|
||||
<div
|
||||
className="inline-flex items-center gap-2 px-3.5 py-1 rounded-full text-xs font-bold uppercase tracking-wider mt-4 mb-3 border"
|
||||
style={{
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 30%, transparent)",
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-surface) 72%, transparent)",
|
||||
color: "var(--color-primary-readable, var(--color-primary))",
|
||||
boxShadow:
|
||||
"0 8px 20px -12px color-mix(in srgb, var(--color-primary) 70%, transparent)",
|
||||
}}
|
||||
>
|
||||
<span className="relative flex h-2 w-2">
|
||||
<span
|
||||
className="animate-ping absolute inline-flex h-full w-full rounded-full opacity-75"
|
||||
style={{ background: "var(--color-primary)" }}
|
||||
/>
|
||||
<span
|
||||
className="relative inline-flex rounded-full h-2 w-2"
|
||||
style={{ background: "var(--color-primary)" }}
|
||||
/>
|
||||
</span>
|
||||
{t("usersOnline", { count: online })}
|
||||
</div>
|
||||
<h1
|
||||
className="text-xl font-black"
|
||||
style={{
|
||||
color: "var(--color-text-readable)",
|
||||
fontFamily: "var(--font-nunito)",
|
||||
}}
|
||||
>
|
||||
{t("welcomeBack")}
|
||||
</h1>
|
||||
<p
|
||||
className="text-xs mt-1.5 mx-auto max-w-[220px] leading-relaxed"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{t("welcomeBackSub", { hotelName })}
|
||||
</p>
|
||||
</div>
|
||||
</SurfaceCard>
|
||||
<div className="mx-auto w-full max-w-6xl flex flex-col gap-8 pb-16">
|
||||
<AuthTopBar hotelName={hotelName} logo={logo} />
|
||||
|
||||
<AuthUsersCards
|
||||
recentUsers={recentUsers}
|
||||
latestUsers={latestUsers}
|
||||
recentTitle={t("whoIsOnline")}
|
||||
latestTitle={t("newestCitizens")}
|
||||
/>
|
||||
</AuthPageFrame>
|
||||
<Reveal>
|
||||
<div className="flex flex-col gap-8 lg:flex-row lg:items-start">
|
||||
{/* Left panel */}
|
||||
<div className="lg:w-96 shrink-0 space-y-4">
|
||||
<SurfaceCard
|
||||
className="card-glow relative overflow-hidden p-6 text-center"
|
||||
style={{
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 20%, transparent)",
|
||||
}}
|
||||
>
|
||||
<div
|
||||
className="absolute inset-0"
|
||||
style={{
|
||||
background:
|
||||
"linear-gradient(135deg, color-mix(in srgb, var(--color-primary) 10%, transparent), color-mix(in srgb, var(--color-accent) 10%, transparent))",
|
||||
}}
|
||||
/>
|
||||
<div
|
||||
aria-hidden="true"
|
||||
className="absolute inset-0 overflow-hidden"
|
||||
>
|
||||
<div className="brand-halo left-1/2 top-0 h-64 w-[460px] max-w-full -translate-x-1/2 -translate-y-1/2" />
|
||||
</div>
|
||||
<div className="relative">
|
||||
<div className="brand-halo left-1/2 top-8 h-52 w-52 -translate-x-1/2" />
|
||||
<Image
|
||||
src="/assets/images/FrankwithBag.gif"
|
||||
alt="Frank"
|
||||
width={130}
|
||||
height={170}
|
||||
className="relative object-contain mx-auto drop-shadow-xl animate-float"
|
||||
unoptimized
|
||||
priority
|
||||
/>
|
||||
<div
|
||||
className="inline-flex items-center gap-2 px-3.5 py-1 rounded-full text-xs font-bold uppercase tracking-wider mt-4 mb-3 border"
|
||||
style={{
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 18%, transparent)",
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 10%, transparent)",
|
||||
color:
|
||||
"var(--color-primary-readable, var(--color-primary))",
|
||||
}}
|
||||
>
|
||||
<span className="relative flex h-2 w-2">
|
||||
<span className="animate-ping absolute inline-flex h-full w-full rounded-full bg-primary opacity-75" />
|
||||
<span className="relative inline-flex rounded-full h-2 w-2 bg-primary" />
|
||||
</span>
|
||||
{t("usersOnline", { count: online })}
|
||||
</div>
|
||||
<h1
|
||||
className="text-xl font-black"
|
||||
style={{
|
||||
color: "var(--color-text-readable)",
|
||||
fontFamily: "var(--font-nunito)",
|
||||
}}
|
||||
>
|
||||
{t("welcomeBack")}
|
||||
</h1>
|
||||
<p
|
||||
className="text-xs mt-1 mx-auto max-w-[200px] leading-relaxed"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{t("welcomeBackSub", { hotelName })}
|
||||
</p>
|
||||
</div>
|
||||
</SurfaceCard>
|
||||
|
||||
{recentUsers.length > 0 && (
|
||||
<SurfaceCard
|
||||
title={t("whoIsOnline")}
|
||||
icon={ICON_NAV_GOODY}
|
||||
bodyClassName="p-4"
|
||||
className="card-glow"
|
||||
>
|
||||
<div className="grid grid-cols-4 gap-1.5 sm:gap-2">
|
||||
{recentUsers.map((u) => (
|
||||
<div
|
||||
key={u.username}
|
||||
className="flex flex-col items-center gap-1.5 rounded-xl border px-1 py-2 transition-all duration-200 hover:-translate-y-0.5 hover:ring-1 hover:ring-[color-mix(in_srgb,var(--color-primary)_35%,transparent)]"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 4%, transparent)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 10%, transparent)",
|
||||
}}
|
||||
>
|
||||
<UserAvatarThumbnail
|
||||
figure={u.look}
|
||||
alt=""
|
||||
options={{ direction: 2 }}
|
||||
className="rounded-lg"
|
||||
/>
|
||||
<span
|
||||
className="w-full truncate text-center text-[9px] font-bold leading-tight"
|
||||
style={{ color: "var(--color-text-readable)" }}
|
||||
>
|
||||
{u.username}
|
||||
</span>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</SurfaceCard>
|
||||
)}
|
||||
|
||||
{latestUsers.length > 0 && (
|
||||
<SurfaceCard
|
||||
title={t("newestCitizens")}
|
||||
icon={ICON_FRIENDS}
|
||||
bodyClassName="p-4"
|
||||
className="card-glow"
|
||||
>
|
||||
<div className="grid grid-cols-4 gap-1.5 sm:gap-2">
|
||||
{latestUsers.map((u) => (
|
||||
<div
|
||||
key={u.username}
|
||||
className="flex flex-col items-center gap-1.5 rounded-xl border px-1 py-2 transition-all duration-200 hover:-translate-y-0.5 hover:ring-1 hover:ring-[color-mix(in_srgb,var(--color-primary)_35%,transparent)]"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 4%, transparent)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 10%, transparent)",
|
||||
}}
|
||||
>
|
||||
<UserAvatarThumbnail
|
||||
figure={u.look}
|
||||
alt=""
|
||||
options={{ direction: 2 }}
|
||||
className="rounded-lg"
|
||||
/>
|
||||
<span
|
||||
className="w-full truncate text-center text-[9px] font-bold leading-tight"
|
||||
style={{ color: "var(--color-text-readable)" }}
|
||||
>
|
||||
{u.username}
|
||||
</span>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</SurfaceCard>
|
||||
)}
|
||||
</div>
|
||||
|
||||
{/* Right: form */}
|
||||
<div className="flex-1 lg:sticky lg:top-6">
|
||||
<SurfaceCard
|
||||
title={t("title")}
|
||||
icon={ICON_NAV_ME}
|
||||
bodyClassName="p-6 sm:p-7"
|
||||
>
|
||||
<p
|
||||
className="text-sm mb-6"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{t("subtitle")}
|
||||
</p>
|
||||
<LoginForm
|
||||
captcha={{
|
||||
provider: cfg.provider,
|
||||
siteKey: cfg.siteKey || undefined,
|
||||
field: cfg.field || undefined,
|
||||
}}
|
||||
nonce={nonce}
|
||||
/>
|
||||
</SurfaceCard>
|
||||
</div>
|
||||
</div>
|
||||
</Reveal>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
+148
-220
@@ -1,5 +1,4 @@
|
||||
import { count, desc, eq } from "drizzle-orm";
|
||||
import { ArrowRight, ChevronDown } from "lucide-react";
|
||||
import type { Metadata } from "next";
|
||||
import { headers } from "next/headers";
|
||||
import Image from "next/image";
|
||||
@@ -7,7 +6,7 @@ import { redirect } from "next/navigation";
|
||||
import { getTranslations } from "next-intl/server";
|
||||
import type { CSSProperties, ReactNode } from "react";
|
||||
import { AnimatedCounter } from "@/components/animated-counter";
|
||||
import { LoginForm } from "@/components/auth/login-form";
|
||||
import { HomeLoginForm } from "@/components/auth/home-login-form";
|
||||
import { Clock } from "@/components/clock";
|
||||
import { LanguageSwitcher } from "@/components/language-switcher";
|
||||
import Link from "@/components/link";
|
||||
@@ -15,7 +14,6 @@ import { LiveOnlineCounter } from "@/components/live-online-counter";
|
||||
import { Reveal } from "@/components/motion-reveal";
|
||||
import { PublicLoadError } from "@/components/public/load-error";
|
||||
import { UserAvatarThumbnail } from "@/components/shared/user-avatar-thumbnail";
|
||||
import { SpotlightCard } from "@/components/spotlight-card";
|
||||
import { ThemeSwitcher } from "@/components/theme-switcher";
|
||||
import { TypewriterText } from "@/components/typewriter-text";
|
||||
import { auth } from "@/lib/auth";
|
||||
@@ -26,7 +24,6 @@ import { resolveHotelName } from "@/lib/hotel-name";
|
||||
import { captchaConfig } from "@/lib/services/captcha";
|
||||
import { getNewsList } from "@/lib/services/news-list";
|
||||
import {
|
||||
countArticles,
|
||||
countPhotos,
|
||||
countRooms,
|
||||
countUsers,
|
||||
@@ -43,17 +40,17 @@ import {
|
||||
ICON_NAV_ME,
|
||||
} from "@/lib/site-icons";
|
||||
|
||||
export async function generateMetadata(): Promise<Metadata> {
|
||||
const tn = await getTranslations("nav");
|
||||
const tp = await getTranslations("pages.home");
|
||||
const title = tn("home");
|
||||
const description = tp("welcomeBody");
|
||||
return {
|
||||
title,
|
||||
description,
|
||||
openGraph: { title, description, type: "website" },
|
||||
};
|
||||
}
|
||||
export const metadata: Metadata = {
|
||||
title: "Home",
|
||||
description:
|
||||
"An online virtual world where you can create your own avatar, make friends, chat, and build your own rooms.",
|
||||
openGraph: {
|
||||
title: "Home",
|
||||
description:
|
||||
"An online virtual world where you can create your own avatar, make friends, chat, and build your own rooms.",
|
||||
type: "website",
|
||||
},
|
||||
};
|
||||
|
||||
// ── Local visual language (theme-aware, no big white blocks) ──────────
|
||||
const PANEL_BG =
|
||||
@@ -178,7 +175,6 @@ async function getHotelData() {
|
||||
users,
|
||||
rooms,
|
||||
totalPhotos,
|
||||
articleCount,
|
||||
articles,
|
||||
recentUsers,
|
||||
recentPhotos,
|
||||
@@ -199,9 +195,6 @@ async function getHotelData() {
|
||||
cached("total_photos", 300_000, countPhotos, { staleMs: 300000 }).catch(
|
||||
publicReadFailure("home.photos-count"),
|
||||
),
|
||||
cached("total_articles", 300_000, countArticles, {
|
||||
staleMs: 300000,
|
||||
}).catch(publicReadFailure("home.articles-count")),
|
||||
getNewsList(4, { throwOnError: true }).catch(
|
||||
publicReadFailure("home.news"),
|
||||
),
|
||||
@@ -235,7 +228,6 @@ async function getHotelData() {
|
||||
users,
|
||||
rooms,
|
||||
totalPhotos,
|
||||
articleCount,
|
||||
articles,
|
||||
recentUsers,
|
||||
recentPhotos,
|
||||
@@ -257,7 +249,6 @@ export default async function Home() {
|
||||
users,
|
||||
rooms,
|
||||
totalPhotos,
|
||||
articleCount,
|
||||
articles,
|
||||
recentUsers,
|
||||
recentPhotos,
|
||||
@@ -319,7 +310,7 @@ export default async function Home() {
|
||||
className="text-sm font-bold"
|
||||
style={{ color: "rgba(255,255,255,0.95)" }}
|
||||
>
|
||||
<ArrowRight className="h-4 w-4" aria-hidden="true" />
|
||||
→
|
||||
</span>
|
||||
</div>
|
||||
<div
|
||||
@@ -351,6 +342,12 @@ export default async function Home() {
|
||||
>
|
||||
{a.title}
|
||||
</h3>
|
||||
<p
|
||||
className="mt-0.5 text-[10px] sm:text-[11px] font-semibold opacity-80"
|
||||
style={{ color: "#cbd5e1" }}
|
||||
>
|
||||
{formatDate(a.createdAt, "date", "")}
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</Link>
|
||||
@@ -374,7 +371,7 @@ export default async function Home() {
|
||||
color: "var(--color-primary)",
|
||||
},
|
||||
{
|
||||
value: articleCount,
|
||||
value: articles?.length ?? null,
|
||||
label: tp("statsArticles"),
|
||||
color: "var(--color-accent)",
|
||||
},
|
||||
@@ -487,29 +484,6 @@ export default async function Home() {
|
||||
"linear-gradient(180deg, rgba(8,11,24,0.74) 0%, rgba(8,11,24,0.55) 38%, rgba(8,11,24,0.38) 62%, rgba(8,11,24,0.55) 85%, color-mix(in srgb, var(--color-background) 94%, transparent) 100%)",
|
||||
}}
|
||||
/>
|
||||
{/* Drifting brand-tinted aurora behind the copy */}
|
||||
<div
|
||||
aria-hidden="true"
|
||||
className="pointer-events-none absolute inset-0 overflow-hidden"
|
||||
>
|
||||
<div
|
||||
className="aurora-blob -left-24 top-1/4 h-[420px] w-[420px]"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 35%, transparent)",
|
||||
opacity: 0.5,
|
||||
}}
|
||||
/>
|
||||
<div
|
||||
className="aurora-blob -right-24 top-1/3 h-[380px] w-[380px]"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-accent) 32%, transparent)",
|
||||
animationDelay: "-7s",
|
||||
opacity: 0.45,
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
<div
|
||||
aria-hidden="true"
|
||||
className="brand-halo left-1/2 top-1/2 h-[420px] w-[720px] max-w-full -translate-x-1/2 -translate-y-1/2"
|
||||
@@ -579,16 +553,7 @@ export default async function Home() {
|
||||
</p>
|
||||
|
||||
{recentUsers !== null && recentUsers.length > 0 && (
|
||||
<div
|
||||
className="animate-fade-in-up mt-7 inline-flex items-center gap-3 rounded-full border px-3 py-1.5"
|
||||
style={{
|
||||
background: "rgba(255,255,255,0.08)",
|
||||
borderColor: "rgba(255,255,255,0.22)",
|
||||
backdropFilter: "blur(12px)",
|
||||
WebkitBackdropFilter: "blur(12px)",
|
||||
animationDelay: "0.08s",
|
||||
}}
|
||||
>
|
||||
<div className="mt-7 flex items-center justify-center gap-3">
|
||||
<div className="flex -space-x-2.5">
|
||||
{recentUsers.slice(0, 4).map((u) => (
|
||||
<UserAvatarThumbnail
|
||||
@@ -601,21 +566,25 @@ export default async function Home() {
|
||||
))}
|
||||
</div>
|
||||
<span
|
||||
className="pr-1 text-[10px] font-extrabold uppercase tracking-[0.22em]"
|
||||
style={{ color: "rgba(255,255,255,0.75)" }}
|
||||
className="text-[10px] font-extrabold uppercase tracking-[0.22em]"
|
||||
style={{ color: "rgba(255,255,255,0.72)" }}
|
||||
>
|
||||
{tp("recentUsers")}
|
||||
</span>
|
||||
</div>
|
||||
)}
|
||||
|
||||
<div
|
||||
className="animate-fade-in-up mt-9 flex flex-wrap items-center justify-center gap-3"
|
||||
style={{ animationDelay: "0.2s" }}
|
||||
>
|
||||
<div className="mt-9 flex flex-wrap items-center justify-center gap-3">
|
||||
<Link
|
||||
href="/register"
|
||||
className="btn-brand btn-shine px-8 py-4 text-sm font-black uppercase tracking-wider"
|
||||
className="btn-shine inline-flex items-center gap-2.5 rounded-2xl px-8 py-4 text-sm font-black uppercase tracking-wider transition-all duration-300 ease-out hover:-translate-y-1 hover:scale-[1.02] active:scale-95"
|
||||
style={{
|
||||
background:
|
||||
"linear-gradient(120deg, var(--color-primary), color-mix(in srgb, var(--color-accent) 55%, var(--color-primary)))",
|
||||
color: "var(--color-primary-foreground)",
|
||||
boxShadow:
|
||||
"0 12px 40px -8px color-mix(in srgb, var(--color-primary) 55%, transparent), 0 0 0 1px color-mix(in srgb, var(--color-primary) 55%, transparent)",
|
||||
}}
|
||||
>
|
||||
<Image
|
||||
src="/assets/images/EnterHubbly.png"
|
||||
@@ -628,23 +597,21 @@ export default async function Home() {
|
||||
</Link>
|
||||
<Link
|
||||
href="/login"
|
||||
className="btn-glass-dark px-8 py-4 text-sm font-bold"
|
||||
className="inline-flex items-center gap-2 rounded-2xl px-8 py-4 text-sm font-bold transition-all duration-300 ease-out hover:-translate-y-1 hover:brightness-110 active:scale-95"
|
||||
style={{
|
||||
color: "#fff",
|
||||
background: "rgba(255,255,255,0.07)",
|
||||
border: "1px solid rgba(255,255,255,0.24)",
|
||||
backdropFilter: "blur(8px)",
|
||||
WebkitBackdropFilter: "blur(8px)",
|
||||
}}
|
||||
>
|
||||
{th("login")}
|
||||
<span
|
||||
aria-hidden="true"
|
||||
className="inline-flex transition-transform duration-300 group-hover:translate-x-1"
|
||||
>
|
||||
<ArrowRight className="h-4 w-4" />
|
||||
</span>
|
||||
{th("login")} →
|
||||
</Link>
|
||||
</div>
|
||||
|
||||
{/* Floating stat chips */}
|
||||
<div
|
||||
className="animate-fade-in-up mt-12 flex flex-wrap items-center justify-center gap-2.5 sm:gap-3"
|
||||
style={{ animationDelay: "0.32s" }}
|
||||
>
|
||||
<div className="mt-12 flex flex-wrap items-center justify-center gap-2.5 sm:gap-3">
|
||||
{statChips.map((s) => (
|
||||
<span key={s.label} className="glass-chip">
|
||||
<span
|
||||
@@ -666,28 +633,6 @@ export default async function Home() {
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{/* Scroll cue */}
|
||||
<div
|
||||
aria-hidden="true"
|
||||
className="pointer-events-none absolute bottom-6 left-1/2 hidden -translate-x-1/2 sm:block"
|
||||
style={{ zIndex: 2 }}
|
||||
>
|
||||
<div
|
||||
className="hero-cue flex h-10 w-10 items-center justify-center rounded-full"
|
||||
style={{
|
||||
background: "rgba(255,255,255,0.09)",
|
||||
border: "1px solid rgba(255,255,255,0.3)",
|
||||
backdropFilter: "blur(10px)",
|
||||
WebkitBackdropFilter: "blur(10px)",
|
||||
}}
|
||||
>
|
||||
<ChevronDown
|
||||
className="h-5 w-5"
|
||||
style={{ color: "rgba(255,255,255,0.88)" }}
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{/* Floating mascot — decorative, hidden on smaller screens. */}
|
||||
<div
|
||||
aria-hidden="true"
|
||||
@@ -700,6 +645,7 @@ export default async function Home() {
|
||||
alt=""
|
||||
width={96}
|
||||
height={128}
|
||||
priority
|
||||
unoptimized
|
||||
className="relative animate-float object-contain drop-shadow-2xl"
|
||||
/>
|
||||
@@ -715,29 +661,32 @@ export default async function Home() {
|
||||
aria-label={tp("exploreLabel")}
|
||||
className="flex flex-wrap items-center justify-center gap-2.5 sm:gap-3"
|
||||
>
|
||||
{exploreLinks.map((l, i) => (
|
||||
<Link key={l.href} href={l.href} className="explore-pill group">
|
||||
<span
|
||||
aria-hidden="true"
|
||||
className="h-1.5 w-1.5 shrink-0 rounded-full"
|
||||
style={{
|
||||
background:
|
||||
i % 2 === 0
|
||||
? "var(--color-primary)"
|
||||
: "var(--color-accent)",
|
||||
boxShadow: `0 0 8px color-mix(in srgb, ${
|
||||
i % 2 === 0 ? "var(--color-primary)" : "var(--color-accent)"
|
||||
} 70%, transparent)`,
|
||||
}}
|
||||
/>
|
||||
{exploreLinks.map((l) => (
|
||||
<Link
|
||||
key={l.href}
|
||||
href={l.href}
|
||||
className="group inline-flex items-center gap-1.5 rounded-full px-5 py-2.5 text-xs font-bold transition-all duration-300 hover:-translate-y-0.5 sm:text-sm"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-surface) 55%, transparent)",
|
||||
border:
|
||||
"1px solid color-mix(in srgb, var(--color-text-muted) 12%, transparent)",
|
||||
color: "var(--color-text-readable)",
|
||||
backdropFilter: "blur(10px)",
|
||||
WebkitBackdropFilter: "blur(10px)",
|
||||
boxShadow:
|
||||
"0 2px 8px -2px color-mix(in srgb, #000 8%, transparent)",
|
||||
}}
|
||||
>
|
||||
{l.label}
|
||||
<ArrowRight
|
||||
aria-hidden="true"
|
||||
className="pill-arrow h-3.5 w-3.5"
|
||||
<span
|
||||
className="-translate-x-1 text-[10px] opacity-0 transition-all duration-300 group-hover:translate-x-0 group-hover:opacity-100"
|
||||
style={{
|
||||
color: "var(--color-primary-readable, var(--color-primary))",
|
||||
}}
|
||||
/>
|
||||
>
|
||||
→
|
||||
</span>
|
||||
</Link>
|
||||
))}
|
||||
</nav>
|
||||
@@ -762,9 +711,9 @@ export default async function Home() {
|
||||
const accentVar =
|
||||
i % 2 === 0 ? "var(--color-primary)" : "var(--color-accent)";
|
||||
return (
|
||||
<SpotlightCard
|
||||
<div
|
||||
key={f.title}
|
||||
className="spotlight card-glow card-hairline group relative overflow-hidden rounded-2xl border p-6 transition-all duration-500 hover:-translate-y-1.5 hover:shadow-2xl sm:p-7"
|
||||
className="card-glow card-hairline group relative overflow-hidden rounded-2xl border p-6 transition-all duration-500 hover:-translate-y-1.5 hover:shadow-2xl sm:p-7"
|
||||
style={{
|
||||
background: GLASS_TILE_BG,
|
||||
backdropFilter: "blur(16px)",
|
||||
@@ -789,8 +738,8 @@ export default async function Home() {
|
||||
<div
|
||||
className="relative flex h-12 w-12 items-center justify-center rounded-2xl transition-transform duration-300 group-hover:scale-110 group-hover:-rotate-3"
|
||||
style={{
|
||||
background: `linear-gradient(135deg, color-mix(in srgb, ${accentVar} 30%, transparent), color-mix(in srgb, ${accentVar} 12%, transparent))`,
|
||||
boxShadow: `inset 0 0 0 1px color-mix(in srgb, ${accentVar} 30%, transparent), 0 8px 18px -10px color-mix(in srgb, ${accentVar} 70%, transparent)`,
|
||||
background: `color-mix(in srgb, ${accentVar} 16%, transparent)`,
|
||||
boxShadow: `inset 0 0 0 1px color-mix(in srgb, ${accentVar} 22%, transparent)`,
|
||||
borderRadius: 14,
|
||||
}}
|
||||
>
|
||||
@@ -817,7 +766,7 @@ export default async function Home() {
|
||||
>
|
||||
{f.desc}
|
||||
</p>
|
||||
</SpotlightCard>
|
||||
</div>
|
||||
);
|
||||
})}
|
||||
</div>
|
||||
@@ -838,73 +787,64 @@ export default async function Home() {
|
||||
</h2>
|
||||
</div>
|
||||
</div>
|
||||
<div
|
||||
className="card-hairline overflow-hidden rounded-2xl border"
|
||||
style={PANEL_STYLE}
|
||||
>
|
||||
<div className="grid grid-cols-2 gap-x-4 gap-y-8 p-6 sm:p-8 lg:grid-cols-4">
|
||||
{[
|
||||
{
|
||||
value: users,
|
||||
label: tp("statsCitizens"),
|
||||
icon: ICON_FRIENDS,
|
||||
},
|
||||
{ value: rooms, label: tp("statsRooms"), icon: ICON_CATALOG },
|
||||
{
|
||||
value: totalPhotos,
|
||||
label: tp("statsPhotos"),
|
||||
icon: ICON_CAMERA,
|
||||
},
|
||||
{
|
||||
value: articleCount,
|
||||
label: tp("statsArticles"),
|
||||
icon: ICON_ARTICLE,
|
||||
},
|
||||
].map((s) => (
|
||||
<div className="grid grid-cols-2 gap-x-4 gap-y-8 lg:grid-cols-4">
|
||||
{[
|
||||
{ value: users, label: tp("statsCitizens"), icon: ICON_FRIENDS },
|
||||
{ value: rooms, label: tp("statsRooms"), icon: ICON_CATALOG },
|
||||
{
|
||||
value: totalPhotos,
|
||||
label: tp("statsPhotos"),
|
||||
icon: ICON_CAMERA,
|
||||
},
|
||||
{
|
||||
value: articles?.length ?? null,
|
||||
label: tp("statsArticles"),
|
||||
icon: ICON_ARTICLE,
|
||||
},
|
||||
].map((s) => (
|
||||
<div
|
||||
key={s.label}
|
||||
className="group relative flex flex-col items-center gap-2.5 text-center"
|
||||
>
|
||||
<div
|
||||
key={s.label}
|
||||
className="stat-cell group relative flex flex-col items-center gap-2.5 text-center"
|
||||
className="flex h-10 w-10 items-center justify-center rounded-xl transition-transform duration-300 group-hover:scale-110"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 14%, transparent)",
|
||||
boxShadow:
|
||||
"inset 0 0 0 1px color-mix(in srgb, var(--color-primary) 18%, transparent)",
|
||||
}}
|
||||
>
|
||||
<div
|
||||
className="flex h-10 w-10 items-center justify-center rounded-xl transition-transform duration-300 group-hover:scale-110"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 14%, transparent)",
|
||||
boxShadow:
|
||||
"inset 0 0 0 1px color-mix(in srgb, var(--color-primary) 18%, transparent)",
|
||||
}}
|
||||
>
|
||||
<Image
|
||||
src={s.icon}
|
||||
alt=""
|
||||
width={20}
|
||||
height={20}
|
||||
unoptimized
|
||||
/>
|
||||
</div>
|
||||
<div
|
||||
className="gradient-text text-4xl font-black tracking-tight sm:text-5xl"
|
||||
style={{ fontVariantNumeric: "tabular-nums" }}
|
||||
>
|
||||
{s.value === null ? (
|
||||
<span className="text-base">{te("unavailable")}</span>
|
||||
) : (
|
||||
<AnimatedCounter value={s.value} />
|
||||
)}
|
||||
</div>
|
||||
<span
|
||||
className="rounded-full px-3 py-1 text-[10px] font-bold uppercase tracking-widest"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-text-muted) 8%, transparent)",
|
||||
color: "var(--color-text-muted)",
|
||||
}}
|
||||
>
|
||||
{s.label}
|
||||
</span>
|
||||
<Image
|
||||
src={s.icon}
|
||||
alt=""
|
||||
width={20}
|
||||
height={20}
|
||||
unoptimized
|
||||
/>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
<div
|
||||
className="gradient-text text-4xl font-black tracking-tight sm:text-5xl"
|
||||
style={{ fontVariantNumeric: "tabular-nums" }}
|
||||
>
|
||||
{s.value === null ? (
|
||||
<span className="text-base">{te("unavailable")}</span>
|
||||
) : (
|
||||
<AnimatedCounter value={s.value} />
|
||||
)}
|
||||
</div>
|
||||
<span
|
||||
className="rounded-full px-3 py-1 text-[10px] font-bold uppercase tracking-widest"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-text-muted) 8%, transparent)",
|
||||
color: "var(--color-text-muted)",
|
||||
}}
|
||||
>
|
||||
{s.label}
|
||||
</span>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</div>
|
||||
</Reveal>
|
||||
@@ -930,9 +870,7 @@ export default async function Home() {
|
||||
icon={ICON_NAV_ME}
|
||||
bodyClassName="p-3.5 sm:p-4"
|
||||
>
|
||||
<LoginForm
|
||||
variant="compact"
|
||||
redirectTo="/"
|
||||
<HomeLoginForm
|
||||
captcha={{
|
||||
provider: captcha.provider,
|
||||
siteKey: captcha.siteKey || undefined,
|
||||
@@ -1025,10 +963,12 @@ export default async function Home() {
|
||||
<Reveal className="mx-auto w-full max-w-7xl">
|
||||
<GlassPanel title={tp("recentPhotos")} icon={ICON_CAMERA}>
|
||||
<div className="mx-auto grid max-w-5xl grid-cols-2 gap-3 sm:grid-cols-4">
|
||||
{recentPhotos.slice(0, 4).map((p, i) => (
|
||||
{recentPhotos.slice(0, 4).map((p) => (
|
||||
<Link
|
||||
key={p.id}
|
||||
href="/photos"
|
||||
title=""
|
||||
aria-label={tp("recentPhotos")}
|
||||
className="block aspect-[4/3] overflow-hidden rounded-2xl border transition-all duration-300 ease-out hover:scale-[1.03] hover:shadow-xl hover:ring-2 hover:ring-[color-mix(in_srgb,var(--color-primary)_45%,transparent)]"
|
||||
style={{
|
||||
borderColor:
|
||||
@@ -1037,7 +977,7 @@ export default async function Home() {
|
||||
>
|
||||
<Image
|
||||
src={p.url}
|
||||
alt={`${tp("recentPhotos")} ${i + 1}`}
|
||||
alt={tp("recentPhotos")}
|
||||
width={280}
|
||||
height={210}
|
||||
className="h-full w-full object-cover"
|
||||
@@ -1069,28 +1009,6 @@ export default async function Home() {
|
||||
className="brand-halo left-1/2 top-0 h-72 w-[620px] max-w-full -translate-x-1/2 -translate-y-1/3"
|
||||
style={{ opacity: 0.6 }}
|
||||
/>
|
||||
<div
|
||||
aria-hidden="true"
|
||||
className="pointer-events-none absolute inset-0 overflow-hidden"
|
||||
>
|
||||
<div
|
||||
className="aurora-blob -left-20 bottom-0 h-72 w-72"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-accent) 45%, transparent)",
|
||||
opacity: 0.5,
|
||||
}}
|
||||
/>
|
||||
<div
|
||||
className="aurora-blob -right-16 top-4 h-64 w-64"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 45%, transparent)",
|
||||
animationDelay: "-6s",
|
||||
opacity: 0.5,
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
<h2
|
||||
id="join-cta-title"
|
||||
className="relative text-3xl font-black tracking-tight text-balance sm:text-4xl"
|
||||
@@ -1107,24 +1025,34 @@ export default async function Home() {
|
||||
<div className="relative mt-8 flex flex-wrap items-center justify-center gap-3">
|
||||
<Link
|
||||
href="/register"
|
||||
className="btn-brand btn-shine group px-8 py-4 text-sm font-black uppercase tracking-wide"
|
||||
className="btn-shine group inline-flex items-center gap-2 rounded-2xl px-8 py-4 text-sm font-black uppercase tracking-wide transition-all duration-300 hover:-translate-y-1 hover:scale-[1.02] active:scale-95"
|
||||
style={{
|
||||
background:
|
||||
"linear-gradient(120deg, var(--color-primary), color-mix(in srgb, var(--color-accent) 55%, var(--color-primary)))",
|
||||
color: "var(--color-primary-foreground)",
|
||||
boxShadow:
|
||||
"0 12px 40px -8px color-mix(in srgb, var(--color-primary) 50%, transparent)",
|
||||
}}
|
||||
>
|
||||
{tp("ctaJoin")}
|
||||
<span
|
||||
aria-hidden="true"
|
||||
className="inline-flex transition-transform duration-300 group-hover:translate-x-1"
|
||||
>
|
||||
<ArrowRight className="h-4 w-4" />
|
||||
<span className="transition-transform duration-300 group-hover:translate-x-0.5">
|
||||
→
|
||||
</span>
|
||||
</Link>
|
||||
<Link
|
||||
href="/community"
|
||||
className="btn-glass-dark px-8 py-4 text-sm font-bold"
|
||||
className="inline-flex items-center rounded-2xl px-8 py-4 text-sm font-bold transition-all duration-300 hover:-translate-y-1 hover:brightness-110 active:scale-95"
|
||||
style={{
|
||||
color: "#fff",
|
||||
background: "rgba(255,255,255,0.07)",
|
||||
border: "1px solid rgba(255,255,255,0.22)",
|
||||
backdropFilter: "blur(8px)",
|
||||
WebkitBackdropFilter: "blur(8px)",
|
||||
}}
|
||||
>
|
||||
{tp("browseCommunity")}
|
||||
</Link>
|
||||
</div>
|
||||
<div className="hero-ring" aria-hidden="true" />
|
||||
</section>
|
||||
</Reveal>
|
||||
</div>
|
||||
|
||||
+175
-124
@@ -1,32 +1,18 @@
|
||||
import { count, desc, eq } from "drizzle-orm";
|
||||
import type { Metadata } from "next";
|
||||
import { headers } from "next/headers";
|
||||
import Image from "next/image";
|
||||
import { redirect } from "next/navigation";
|
||||
import { getTranslations } from "next-intl/server";
|
||||
import {
|
||||
AuthPageFrame,
|
||||
AuthUsersCards,
|
||||
} from "@/components/auth/auth-page-frame";
|
||||
import { AuthTopBar } from "@/components/auth/auth-top-bar";
|
||||
import { RegisterForm } from "@/components/auth/register-form";
|
||||
import { Reveal } from "@/components/motion-reveal";
|
||||
import { UserAvatarThumbnail } from "@/components/shared/user-avatar-thumbnail";
|
||||
import { SurfaceCard } from "@/components/surface-card";
|
||||
import { auth } from "@/lib/auth";
|
||||
import { cached } from "@/lib/cache";
|
||||
import { db, User } from "@/lib/db";
|
||||
import { resolveHotelName } from "@/lib/hotel-name";
|
||||
import { captchaConfig } from "@/lib/services/captcha";
|
||||
import { siteSettings } from "@/lib/services/site-settings";
|
||||
|
||||
export async function generateMetadata(): Promise<Metadata> {
|
||||
const t = await getTranslations("pages.register");
|
||||
const title = t("title");
|
||||
const description = t("subtitle");
|
||||
return {
|
||||
title,
|
||||
description,
|
||||
openGraph: { title, description, type: "website" },
|
||||
};
|
||||
}
|
||||
import { ICON_FRIENDS, ICON_NAV_GOODY, ICON_NAV_ME } from "@/lib/site-icons";
|
||||
|
||||
export default async function RegisterPage() {
|
||||
const tpr = await getTranslations("pages.register");
|
||||
@@ -37,10 +23,6 @@ export default async function RegisterPage() {
|
||||
]);
|
||||
const nonce = (await headers()).get("x-nonce") ?? undefined;
|
||||
|
||||
// An account already exists in this browser — there is nothing to sign up.
|
||||
const session = await auth();
|
||||
if (session?.user?.id) redirect("/me");
|
||||
|
||||
const [online, recentUsers, latestUsers] = await Promise.all([
|
||||
cached("online_count", 10_000, () =>
|
||||
db
|
||||
@@ -50,7 +32,7 @@ export default async function RegisterPage() {
|
||||
.then((rows) => rows[0]?.total ?? 0),
|
||||
).catch(() => 0),
|
||||
cached(
|
||||
"auth_online_users",
|
||||
"register_online_users",
|
||||
10_000,
|
||||
() =>
|
||||
db
|
||||
@@ -61,7 +43,7 @@ export default async function RegisterPage() {
|
||||
{ staleMs: 30000 },
|
||||
).catch(() => []),
|
||||
cached(
|
||||
"auth_latest_users",
|
||||
"register_latest_users",
|
||||
30_000,
|
||||
() =>
|
||||
db
|
||||
@@ -74,119 +56,188 @@ export default async function RegisterPage() {
|
||||
]);
|
||||
|
||||
return (
|
||||
<AuthPageFrame
|
||||
hotelName={hotelName}
|
||||
logo={logo}
|
||||
title={tpr("title")}
|
||||
subtitle={tpr("subtitle")}
|
||||
form={
|
||||
<RegisterForm
|
||||
hotelName={hotelName}
|
||||
captcha={{
|
||||
provider: cfg.provider,
|
||||
siteKey: cfg.siteKey || undefined,
|
||||
}}
|
||||
nonce={nonce}
|
||||
/>
|
||||
}
|
||||
>
|
||||
<SurfaceCard
|
||||
className="card-glow relative overflow-hidden p-6"
|
||||
style={{
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 20%, transparent)",
|
||||
}}
|
||||
>
|
||||
<div
|
||||
className="absolute inset-0"
|
||||
style={{
|
||||
background:
|
||||
"linear-gradient(135deg, color-mix(in srgb, var(--color-primary) 10%, transparent), color-mix(in srgb, var(--color-accent) 10%, transparent))",
|
||||
}}
|
||||
/>
|
||||
<div aria-hidden="true" className="absolute inset-0 overflow-hidden">
|
||||
<div className="brand-halo left-1/2 top-0 h-64 w-[460px] max-w-full -translate-x-1/2 -translate-y-1/2" />
|
||||
<div
|
||||
className="aurora-blob -left-16 top-6 h-56 w-56"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 45%, transparent)",
|
||||
}}
|
||||
/>
|
||||
<div
|
||||
className="aurora-blob -right-16 bottom-0 h-56 w-56"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-accent) 40%, transparent)",
|
||||
animationDelay: "-8s",
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
<div className="relative">
|
||||
<div className="flex items-center gap-4">
|
||||
<div className="shrink-0 animate-float">
|
||||
<div className="brand-halo left-1/2 top-1/2 h-52 w-52 -translate-x-1/2 -translate-y-1/2" />
|
||||
<Image
|
||||
src="/assets/images/FrankwithBag.gif"
|
||||
alt="Frank"
|
||||
width={110}
|
||||
height={145}
|
||||
className="relative object-contain drop-shadow-xl"
|
||||
unoptimized
|
||||
/>
|
||||
</div>
|
||||
<div className="flex-1">
|
||||
<div className="mx-auto w-full max-w-6xl flex flex-col gap-8 pb-16">
|
||||
<AuthTopBar hotelName={hotelName} logo={logo} />
|
||||
|
||||
<Reveal>
|
||||
<div className="flex flex-col gap-8 lg:flex-row lg:items-start">
|
||||
{/* Left: intro panel */}
|
||||
<div className="lg:w-96 shrink-0 space-y-4">
|
||||
<SurfaceCard
|
||||
className="card-glow relative overflow-hidden p-6"
|
||||
style={{
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 20%, transparent)",
|
||||
}}
|
||||
>
|
||||
<div
|
||||
className="inline-flex items-center gap-2 px-3 py-1 rounded-full text-xs font-bold uppercase tracking-wider mb-2 border"
|
||||
className="absolute inset-0"
|
||||
style={{
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 30%, transparent)",
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-surface) 72%, transparent)",
|
||||
color: "var(--color-primary-readable, var(--color-primary))",
|
||||
boxShadow:
|
||||
"0 8px 20px -12px color-mix(in srgb, var(--color-primary) 70%, transparent)",
|
||||
"linear-gradient(135deg, color-mix(in srgb, var(--color-primary) 10%, transparent), color-mix(in srgb, var(--color-accent) 10%, transparent))",
|
||||
}}
|
||||
/>
|
||||
<div
|
||||
aria-hidden="true"
|
||||
className="absolute inset-0 overflow-hidden"
|
||||
>
|
||||
<span className="relative flex h-2 w-2">
|
||||
<span
|
||||
className="animate-ping absolute inline-flex h-full w-full rounded-full opacity-75"
|
||||
style={{ background: "var(--color-primary)" }}
|
||||
/>
|
||||
<span
|
||||
className="relative inline-flex rounded-full h-2 w-2"
|
||||
style={{ background: "var(--color-primary)" }}
|
||||
/>
|
||||
</span>
|
||||
{tpr("usersOnline", { count: online })}
|
||||
<div className="brand-halo left-1/2 top-0 h-64 w-[460px] max-w-full -translate-x-1/2 -translate-y-1/2" />
|
||||
</div>
|
||||
<h1
|
||||
className="text-lg font-black leading-tight"
|
||||
style={{
|
||||
color: "var(--color-text-readable)",
|
||||
fontFamily: "var(--font-nunito)",
|
||||
}}
|
||||
<div className="relative">
|
||||
<div className="flex items-center gap-4">
|
||||
<div className="shrink-0 animate-float">
|
||||
<div className="brand-halo left-1/2 top-1/2 h-52 w-52 -translate-x-1/2 -translate-y-1/2" />
|
||||
<Image
|
||||
src="/assets/images/FrankwithBag.gif"
|
||||
alt="Frank"
|
||||
width={110}
|
||||
height={145}
|
||||
className="relative object-contain drop-shadow-xl"
|
||||
unoptimized
|
||||
priority
|
||||
/>
|
||||
</div>
|
||||
<div className="flex-1">
|
||||
<div
|
||||
className="inline-flex items-center gap-2 px-3 py-1 rounded-full text-xs font-bold uppercase tracking-wider mb-2 border"
|
||||
style={{
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 18%, transparent)",
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 10%, transparent)",
|
||||
color:
|
||||
"var(--color-primary-readable, var(--color-primary))",
|
||||
}}
|
||||
>
|
||||
<span className="relative flex h-2 w-2">
|
||||
<span className="animate-ping absolute inline-flex h-full w-full rounded-full bg-primary opacity-75" />
|
||||
<span className="relative inline-flex rounded-full h-2 w-2 bg-primary" />
|
||||
</span>
|
||||
{tpr("usersOnline", { count: online })}
|
||||
</div>
|
||||
<h1
|
||||
className="text-lg font-black leading-tight"
|
||||
style={{
|
||||
color: "var(--color-text-readable)",
|
||||
fontFamily: "var(--font-nunito)",
|
||||
}}
|
||||
>
|
||||
{tpr("title")} —{" "}
|
||||
<span className="gradient-text">{hotelName}</span>
|
||||
</h1>
|
||||
<p
|
||||
className="text-xs mt-1.5 leading-relaxed"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{tpr("subtitle")}
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</SurfaceCard>
|
||||
|
||||
{recentUsers.length > 0 && (
|
||||
<SurfaceCard
|
||||
title={tpr("whoIsOnline")}
|
||||
icon={ICON_NAV_GOODY}
|
||||
bodyClassName="p-4"
|
||||
className="card-glow"
|
||||
>
|
||||
{tpr("title")} —{" "}
|
||||
<span className="gradient-text">{hotelName}</span>
|
||||
</h1>
|
||||
<div className="grid grid-cols-4 gap-1.5">
|
||||
{recentUsers.map((u) => (
|
||||
<div
|
||||
key={u.username}
|
||||
title={u.username}
|
||||
className="flex flex-col items-center gap-1.5 rounded-xl border px-1 py-2 transition-all duration-200 hover:-translate-y-0.5 hover:ring-1 hover:ring-[color-mix(in_srgb,var(--color-primary)_35%,transparent)]"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 4%, transparent)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 10%, transparent)",
|
||||
}}
|
||||
>
|
||||
<UserAvatarThumbnail
|
||||
figure={u.look}
|
||||
alt=""
|
||||
options={{ direction: 2 }}
|
||||
className="rounded-lg"
|
||||
/>
|
||||
<span
|
||||
className="w-full truncate text-center text-[9px] font-bold leading-tight"
|
||||
style={{ color: "var(--color-text-readable)" }}
|
||||
>
|
||||
{u.username}
|
||||
</span>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</SurfaceCard>
|
||||
)}
|
||||
|
||||
{latestUsers.length > 0 && (
|
||||
<SurfaceCard
|
||||
title={tpr("newestCitizens")}
|
||||
icon={ICON_FRIENDS}
|
||||
bodyClassName="p-4"
|
||||
className="card-glow"
|
||||
>
|
||||
<div className="grid grid-cols-4 gap-1.5">
|
||||
{latestUsers.map((u) => (
|
||||
<div
|
||||
key={u.username}
|
||||
title={u.username}
|
||||
className="flex flex-col items-center gap-1.5 rounded-xl border px-1 py-2 transition-all duration-200 hover:-translate-y-0.5 hover:ring-1 hover:ring-[color-mix(in_srgb,var(--color-primary)_35%,transparent)]"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 4%, transparent)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 10%, transparent)",
|
||||
}}
|
||||
>
|
||||
<UserAvatarThumbnail
|
||||
figure={u.look}
|
||||
alt=""
|
||||
options={{ direction: 2 }}
|
||||
className="rounded-lg"
|
||||
/>
|
||||
<span
|
||||
className="w-full truncate text-center text-[9px] font-bold leading-tight"
|
||||
style={{ color: "var(--color-text-readable)" }}
|
||||
>
|
||||
{u.username}
|
||||
</span>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</SurfaceCard>
|
||||
)}
|
||||
</div>
|
||||
|
||||
{/* Right: form */}
|
||||
<div className="flex-1 lg:sticky lg:top-6">
|
||||
<SurfaceCard
|
||||
title={tpr("title")}
|
||||
icon={ICON_NAV_ME}
|
||||
bodyClassName="p-6 sm:p-7"
|
||||
>
|
||||
<p
|
||||
className="text-xs mt-1.5 leading-relaxed"
|
||||
className="text-sm mb-6"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{tpr("subtitle")}
|
||||
</p>
|
||||
</div>
|
||||
<RegisterForm
|
||||
hotelName={hotelName}
|
||||
captcha={{
|
||||
provider: cfg.provider,
|
||||
siteKey: cfg.siteKey || undefined,
|
||||
}}
|
||||
nonce={nonce}
|
||||
/>
|
||||
</SurfaceCard>
|
||||
</div>
|
||||
</div>
|
||||
</SurfaceCard>
|
||||
|
||||
<AuthUsersCards
|
||||
recentUsers={recentUsers}
|
||||
latestUsers={latestUsers}
|
||||
recentTitle={tpr("whoIsOnline")}
|
||||
latestTitle={tpr("newestCitizens")}
|
||||
/>
|
||||
</AuthPageFrame>
|
||||
</Reveal>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -1,7 +1,6 @@
|
||||
import { eq } from "drizzle-orm";
|
||||
import { CheckCircle2, Clock, MailX } from "lucide-react";
|
||||
import { getTranslations } from "next-intl/server";
|
||||
import { ResendVerificationForm } from "@/components/auth/resend-verification-form";
|
||||
import Link from "@/components/link";
|
||||
import { SurfaceCard } from "@/components/surface-card";
|
||||
import { isValidVerificationToken } from "@/lib/auth/email-verification";
|
||||
@@ -186,7 +185,6 @@ export default async function VerifyPage({
|
||||
<p className="text-sm" style={{ color: "var(--color-text-muted)" }}>
|
||||
{t("invalidBody")}
|
||||
</p>
|
||||
<ResendVerificationForm />
|
||||
<Link
|
||||
href="/login"
|
||||
className={`${linkClass} !shadow-none`}
|
||||
|
||||
@@ -1,4 +1,11 @@
|
||||
import { BadgeCheck, Cloud, Lock, Server, ShieldAlert } from "lucide-react";
|
||||
import {
|
||||
BadgeCheck,
|
||||
Cloud,
|
||||
Lock,
|
||||
Radar,
|
||||
Server,
|
||||
ShieldAlert,
|
||||
} from "lucide-react";
|
||||
import { headers } from "next/headers";
|
||||
import { redirect } from "next/navigation";
|
||||
import {
|
||||
@@ -7,6 +14,8 @@ import {
|
||||
saveAntiddosSettings,
|
||||
unbanAntiddosIp,
|
||||
verifyCloudflareConfiguration,
|
||||
verifyCrowdsecConfiguration,
|
||||
verifyCrowdsecReportingConfiguration,
|
||||
} from "@/actions/admin-antiddos";
|
||||
import { Badge } from "@/components/ui/badge";
|
||||
import { Button } from "@/components/ui/button";
|
||||
@@ -24,6 +33,19 @@ import {
|
||||
listCloudflareBlocks,
|
||||
sweepExpiredCloudflareBlocks,
|
||||
} from "@/lib/cloudflare-api";
|
||||
import {
|
||||
CROWDSEC_BLOCK_SOURCE,
|
||||
type CrowdsecBlockMeta,
|
||||
crowdsecEnabled,
|
||||
getCrowdsecBlockMeta,
|
||||
getCrowdsecQuotaUsage,
|
||||
getLastCrowdsecVerify,
|
||||
} from "@/lib/crowdsec-api";
|
||||
import {
|
||||
crowdsecReportEnabled,
|
||||
getLastCrowdsecReport,
|
||||
} from "@/lib/crowdsec-report";
|
||||
import { type CrowdsecDailyStat, getCrowdsecStats } from "@/lib/crowdsec-stats";
|
||||
import { db, WebsiteSetting } from "@/lib/db";
|
||||
import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
|
||||
import { redis } from "@/lib/redis";
|
||||
@@ -36,6 +58,40 @@ function seconds(ttlMs: number): string {
|
||||
return `${Math.floor(s / 3600)}h ${Math.floor((s % 3600) / 60)}m`;
|
||||
}
|
||||
|
||||
function BarSparkline({ values }: { values: number[] }) {
|
||||
if (values.length === 0) return null;
|
||||
const max = Math.max(...values, 1);
|
||||
return (
|
||||
<div className="flex items-end gap-[3px] h-10" aria-hidden="true">
|
||||
{values.map((v, i) => (
|
||||
<div
|
||||
// biome-ignore lint/suspicious/noArrayIndexKey: static timeline position is the bar's identity
|
||||
key={i}
|
||||
className="w-full rounded-sm bg-primary/60"
|
||||
style={{
|
||||
height: `${Math.max(v > 0 ? 6 : 2, (v / max) * 100)}%`,
|
||||
opacity: v === 0 ? 0.15 : 0.6 + (v / max) * 0.4,
|
||||
}}
|
||||
/>
|
||||
))}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
/** Merge per-day breakdown maps (categories / reputations) into range totals. */
|
||||
function mergeBreakdowns(
|
||||
rows: CrowdsecDailyStat[],
|
||||
kind: keyof Pick<CrowdsecDailyStat, "categories" | "reputations">,
|
||||
): Record<string, number> {
|
||||
const totals: Record<string, number> = {};
|
||||
for (const row of rows) {
|
||||
for (const [k, v] of Object.entries(row[kind])) {
|
||||
totals[k] = (totals[k] ?? 0) + v;
|
||||
}
|
||||
}
|
||||
return totals;
|
||||
}
|
||||
|
||||
export default async function AdminAntiDdosPage() {
|
||||
const { session, permissions } = await getAdminContext();
|
||||
if (!canAccess(permissions, PERMS.SETTINGS_VIEW, session.user.rank)) {
|
||||
@@ -62,7 +118,8 @@ export default async function AdminAntiDdosPage() {
|
||||
ip: string;
|
||||
ttlMs: number;
|
||||
count: number;
|
||||
source: "gate";
|
||||
source: "gate" | "crowdsec";
|
||||
meta: CrowdsecBlockMeta | null;
|
||||
}[] = [];
|
||||
let redisOk = false;
|
||||
const rateStore = redis;
|
||||
@@ -83,13 +140,23 @@ export default async function AdminAntiDdosPage() {
|
||||
}
|
||||
const withTtl = await Promise.all(
|
||||
blockKeys.slice(0, 100).map(async (key) => {
|
||||
const ttlMs = await rateStore.pttl(key);
|
||||
const [ttlMs, value] = await Promise.all([
|
||||
rateStore.pttl(key),
|
||||
rateStore.get(key),
|
||||
]);
|
||||
const ip = key.replace("antiddos:block:", "");
|
||||
const source =
|
||||
value === CROWDSEC_BLOCK_SOURCE
|
||||
? ("crowdsec" as const)
|
||||
: ("gate" as const);
|
||||
return {
|
||||
ip,
|
||||
ttlMs: ttlMs > 0 ? ttlMs : 0,
|
||||
count: violationCounts.get(ip) ?? 0,
|
||||
source: "gate" as const,
|
||||
// The gate writes "1"; "crowdsec" marks a community-reputation block.
|
||||
source,
|
||||
// Why CrowdSec blocked this IP, when the meta was recorded.
|
||||
meta: source === "crowdsec" ? await getCrowdsecBlockMeta(ip) : null,
|
||||
};
|
||||
}),
|
||||
);
|
||||
@@ -110,6 +177,12 @@ export default async function AdminAntiDdosPage() {
|
||||
cloudflareBlocks.push(...(await listCloudflareBlocks()));
|
||||
}
|
||||
const lastVerify = await getLastCloudflareVerify();
|
||||
const crowdsecConfigured = crowdsecEnabled();
|
||||
const lastCrowdsecVerify = await getLastCrowdsecVerify();
|
||||
const crowdsecUsage = redisOk ? await getCrowdsecQuotaUsage() : null;
|
||||
const reportingEnabled = await crowdsecReportEnabled();
|
||||
const lastReport = await getLastCrowdsecReport();
|
||||
const crowdsecStats = redisOk ? await getCrowdsecStats(14) : [];
|
||||
|
||||
return (
|
||||
<div className="space-y-6">
|
||||
@@ -164,6 +237,23 @@ export default async function AdminAntiDdosPage() {
|
||||
</CardContent>
|
||||
</Card>
|
||||
|
||||
<Card>
|
||||
<CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
|
||||
<CardTitle className="text-sm font-medium">CrowdSec</CardTitle>
|
||||
<Radar className="h-4 w-4 text-muted-foreground" />
|
||||
</CardHeader>
|
||||
<CardContent>
|
||||
<Badge variant={crowdsecConfigured ? "default" : "secondary"}>
|
||||
{crowdsecConfigured ? "Connected" : "Not configured"}
|
||||
</Badge>
|
||||
<p className="text-xs text-muted-foreground mt-1">
|
||||
{crowdsecUsage && crowdsecUsage.quota > 0
|
||||
? `${crowdsecUsage.used.toLocaleString()} / ${crowdsecUsage.quota.toLocaleString()} CTI calls today${crowdsecUsage.exhausted ? " (paused)" : ""}`
|
||||
: "Community reputation auto-block"}
|
||||
</p>
|
||||
</CardContent>
|
||||
</Card>
|
||||
|
||||
<Card>
|
||||
<CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
|
||||
<CardTitle className="text-sm font-medium">Active blocks</CardTitle>
|
||||
@@ -261,6 +351,53 @@ export default async function AdminAntiDdosPage() {
|
||||
block.
|
||||
</p>
|
||||
|
||||
<label className="flex items-center gap-2 text-sm">
|
||||
<input
|
||||
type="checkbox"
|
||||
name="cs_auto_block"
|
||||
value="1"
|
||||
defaultChecked={effective.crowdsecAutoBlock}
|
||||
/>
|
||||
Automatically block IPs flagged as malicious by the CrowdSec
|
||||
community
|
||||
</label>
|
||||
<p className="text-xs text-muted-foreground -mt-2">
|
||||
Requires <span className="font-mono">CROWDSEC_API_KEY</span> in
|
||||
the environment. When a repeat offender has a bad community
|
||||
reputation it is hard-blocked immediately (no need to cross the
|
||||
local violation threshold). IPs carrying CrowdSec false-positive
|
||||
tags are never blocked.
|
||||
</p>
|
||||
<div className="flex flex-wrap items-center gap-4">
|
||||
<label className="block">
|
||||
<span className="text-xs font-medium">
|
||||
Minimum reputation score (0–5)
|
||||
</span>
|
||||
<input
|
||||
name="cs_block_score"
|
||||
type="number"
|
||||
min={0}
|
||||
max={5}
|
||||
defaultValue={effective.crowdsecBlockScore}
|
||||
className="w-24 mt-1"
|
||||
/>
|
||||
<span className="text-xs text-muted-foreground ml-2">
|
||||
4–5 = malicious (CrowdSec scale)
|
||||
</span>
|
||||
</label>
|
||||
<label className="block">
|
||||
<span className="text-xs font-medium">
|
||||
Block duration (sec)
|
||||
</span>
|
||||
<input
|
||||
name="cs_block_ttl_sec"
|
||||
type="number"
|
||||
defaultValue={effective.crowdsecBlockTtlSeconds}
|
||||
className="w-32 mt-1"
|
||||
/>
|
||||
</label>
|
||||
</div>
|
||||
|
||||
<div className="grid grid-cols-1 gap-4 md:grid-cols-3">
|
||||
{(
|
||||
[
|
||||
@@ -403,6 +540,10 @@ export default async function AdminAntiDdosPage() {
|
||||
) : (
|
||||
<div className="space-y-2">
|
||||
{blocks.map((b) => {
|
||||
const behaviorLabel =
|
||||
b.meta && b.meta.behaviors.length > 0
|
||||
? b.meta.behaviors.join(", ")
|
||||
: null;
|
||||
return (
|
||||
<div
|
||||
key={b.ip}
|
||||
@@ -410,8 +551,22 @@ export default async function AdminAntiDdosPage() {
|
||||
>
|
||||
<span className="font-mono">{b.ip}</span>
|
||||
<span className="flex items-center gap-2 text-xs text-muted-foreground">
|
||||
<Badge variant="secondary">Gate</Badge>
|
||||
{b.source === "crowdsec" ? (
|
||||
<Badge variant="default">CrowdSec</Badge>
|
||||
) : (
|
||||
<Badge variant="secondary">Gate</Badge>
|
||||
)}
|
||||
TTL {seconds(b.ttlMs)} · violations {b.count}
|
||||
{b.meta && (
|
||||
<span
|
||||
className="max-w-xs truncate"
|
||||
title={`${b.meta.reputation ?? "unknown"} · score ${b.meta.score} · ${b.meta.category}${behaviorLabel ? ` · ${behaviorLabel}` : ""}`}
|
||||
>
|
||||
{b.meta.reputation ?? "unknown"} · score{" "}
|
||||
{b.meta.score} · {b.meta.category}
|
||||
{behaviorLabel ? ` · ${behaviorLabel}` : ""}
|
||||
</span>
|
||||
)}
|
||||
</span>
|
||||
<form action={unbanAntiddosIp}>
|
||||
<input type="hidden" name="ip" value={b.ip} />
|
||||
@@ -505,6 +660,243 @@ export default async function AdminAntiDdosPage() {
|
||||
</CardContent>
|
||||
</Card>
|
||||
|
||||
<Card>
|
||||
<CardHeader>
|
||||
<CardTitle className="flex items-center gap-2">
|
||||
<Radar className="h-4 w-4" /> CrowdSec reputation API
|
||||
</CardTitle>
|
||||
</CardHeader>
|
||||
<CardContent className="space-y-4">
|
||||
<div className="flex flex-wrap items-center gap-3">
|
||||
<Badge variant={crowdsecConfigured ? "default" : "secondary"}>
|
||||
{crowdsecConfigured ? "API configured" : "API not configured"}
|
||||
</Badge>
|
||||
{!crowdsecConfigured && (
|
||||
<p className="text-xs text-muted-foreground">
|
||||
Set <span className="font-mono">CROWDSEC_API_KEY</span> to
|
||||
enable community-reputation auto-blocks. When a repeat offender
|
||||
is flagged as malicious by the CrowdSec community it is
|
||||
hard-blocked immediately without waiting for the local violation
|
||||
threshold.
|
||||
</p>
|
||||
)}
|
||||
<form action={verifyCrowdsecConfiguration}>
|
||||
<Button
|
||||
type="submit"
|
||||
size="sm"
|
||||
variant="outline"
|
||||
disabled={!crowdsecConfigured}
|
||||
>
|
||||
Verify connection
|
||||
</Button>
|
||||
</form>
|
||||
</div>
|
||||
|
||||
{lastCrowdsecVerify && crowdsecConfigured && (
|
||||
<p className="text-xs">
|
||||
<Badge
|
||||
variant={lastCrowdsecVerify.ok ? "default" : "destructive"}
|
||||
>
|
||||
{lastCrowdsecVerify.ok ? "Reachable" : "Failed"}
|
||||
</Badge>
|
||||
<span className="ml-2 text-muted-foreground">
|
||||
{lastCrowdsecVerify.ok
|
||||
? `CTI endpoint verified ${new Date(lastCrowdsecVerify.at).toLocaleString()}`
|
||||
: lastCrowdsecVerify.message}
|
||||
</span>
|
||||
</p>
|
||||
)}
|
||||
|
||||
{crowdsecConfigured && (
|
||||
<p className="text-sm text-muted-foreground">
|
||||
Verdicts are looked up lazily for IPs that already triggered a
|
||||
rate bucket (never on the per-request hot path), cached for an
|
||||
hour, and blocked IPs show a{" "}
|
||||
<Badge variant="default">CrowdSec</Badge> badge in the list above
|
||||
with the community reasoning (reputation, score, behaviors).
|
||||
</p>
|
||||
)}
|
||||
|
||||
{crowdsecUsage && (
|
||||
<div className="rounded-md border p-3">
|
||||
<p className="text-xs font-medium mb-1">
|
||||
Reputation lookups today
|
||||
</p>
|
||||
{crowdsecUsage.quota > 0 ? (
|
||||
<>
|
||||
<div className="flex items-center gap-2">
|
||||
<div className="h-2 flex-1 overflow-hidden rounded-full bg-muted">
|
||||
<div
|
||||
className="h-full rounded-full"
|
||||
style={{
|
||||
width: `${Math.min(100, (crowdsecUsage.used / crowdsecUsage.quota) * 100)}%`,
|
||||
background: crowdsecUsage.exhausted
|
||||
? "var(--color-destructive)"
|
||||
: crowdsecUsage.used >= crowdsecUsage.quota * 0.8
|
||||
? "var(--admin-accent)"
|
||||
: "var(--color-primary)",
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
<span
|
||||
className={`text-xs ${crowdsecUsage.exhausted ? "text-destructive" : "text-muted-foreground"}`}
|
||||
>
|
||||
{crowdsecUsage.used.toLocaleString()} /{" "}
|
||||
{crowdsecUsage.quota.toLocaleString()}
|
||||
</span>
|
||||
</div>
|
||||
<p className="text-xs text-muted-foreground mt-1">
|
||||
{crowdsecUsage.exhausted
|
||||
? "Quota spent for today — reputation lookups are paused until tomorrow (admin via CROWDSEC_CTI_DAILY_QUOTA)."
|
||||
: "Visible in the env via CROWDSEC_CTI_DAILY_QUOTA (0 = unlimited). Lookups pause at the ceiling to protect the plan."}
|
||||
</p>
|
||||
</>
|
||||
) : (
|
||||
<p className="text-xs text-muted-foreground">
|
||||
Tracking disabled (CROWDSEC_CTI_DAILY_QUOTA = 0 / unlimited).
|
||||
</p>
|
||||
)}
|
||||
</div>
|
||||
)}
|
||||
|
||||
{crowdsecStats.length > 0 && (
|
||||
<div className="rounded-md border p-3">
|
||||
<div className="flex flex-wrap items-center justify-between gap-2">
|
||||
<p className="text-xs font-medium">
|
||||
Daily activity (last {crowdsecStats.length} days)
|
||||
</p>
|
||||
<a
|
||||
href="/admin/alerts"
|
||||
className="text-xs text-muted-foreground underline-offset-2 hover:underline"
|
||||
>
|
||||
Ops alert history →
|
||||
</a>
|
||||
</div>
|
||||
<div className="mt-2 grid gap-4 sm:grid-cols-3">
|
||||
<BarSparkline values={crowdsecStats.map((row) => row.blocks)} />
|
||||
<div className="col-span-2 flex flex-wrap items-center gap-1.5">
|
||||
{Object.entries(
|
||||
mergeBreakdowns(crowdsecStats, "categories"),
|
||||
).map(([category, count]) => (
|
||||
<Badge key={category} variant="secondary">
|
||||
{category} · {count.toLocaleString()}
|
||||
</Badge>
|
||||
))}
|
||||
{Object.entries(
|
||||
mergeBreakdowns(crowdsecStats, "reputations"),
|
||||
).map(([reputation, count]) => (
|
||||
<Badge
|
||||
key={reputation}
|
||||
variant={
|
||||
reputation === "malicious" ? "destructive" : "secondary"
|
||||
}
|
||||
>
|
||||
{reputation} · {count.toLocaleString()}
|
||||
</Badge>
|
||||
))}
|
||||
</div>
|
||||
</div>
|
||||
<div className="mt-3 max-h-40 overflow-y-auto">
|
||||
<table className="w-full text-xs">
|
||||
<thead>
|
||||
<tr className="text-left text-muted-foreground">
|
||||
<th className="pb-1 pr-2 font-medium">Date</th>
|
||||
<th className="pb-1 pr-2 font-medium text-right">
|
||||
Lookups
|
||||
</th>
|
||||
<th className="pb-1 pr-2 font-medium text-right">
|
||||
Blocks
|
||||
</th>
|
||||
<th className="pb-1 pr-2 font-medium text-right">
|
||||
Reports
|
||||
</th>
|
||||
<th className="pb-1 font-medium text-right">Failures</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{crowdsecStats.map((row) => (
|
||||
<tr key={row.date} className="border-t">
|
||||
<td className="py-1 pr-2 text-muted-foreground">
|
||||
{row.date === new Date().toISOString().slice(0, 10)
|
||||
? "Today"
|
||||
: row.date.slice(5)}
|
||||
</td>
|
||||
<td className="py-1 pr-2 text-right">
|
||||
{row.lookups.toLocaleString()}
|
||||
</td>
|
||||
<td className="py-1 pr-2 text-right">
|
||||
{row.blocks.toLocaleString()}
|
||||
</td>
|
||||
<td className="py-1 pr-2 text-right">
|
||||
{row.reports.toLocaleString()}
|
||||
</td>
|
||||
<td className="py-1 text-right">
|
||||
{row.reportFailures > 0 ? (
|
||||
<span className="text-destructive">
|
||||
{row.reportFailures.toLocaleString()}
|
||||
</span>
|
||||
) : (
|
||||
"–"
|
||||
)}
|
||||
</td>
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
|
||||
<div className="rounded-md border p-3">
|
||||
<p className="text-xs font-medium mb-1">Community signal push</p>
|
||||
<div className="flex flex-wrap items-center gap-3">
|
||||
<Badge variant={reportingEnabled ? "default" : "secondary"}>
|
||||
{reportingEnabled ? "Enabled" : "Off"}
|
||||
</Badge>
|
||||
{!reportingEnabled && (
|
||||
<p className="text-xs text-muted-foreground">
|
||||
Set{" "}
|
||||
<span className="font-mono">
|
||||
CROWDSEC_REPORT_ENABLED=true
|
||||
</span>{" "}
|
||||
to share blocked IPs back into the CrowdSec community
|
||||
blocklist. Watcher credentials are auto-generated and
|
||||
persisted in Redis.
|
||||
</p>
|
||||
)}
|
||||
{reportingEnabled && (
|
||||
<p className="text-xs text-muted-foreground">
|
||||
Blocked IPs are pushed to the Central API (deduped per IP) so
|
||||
the community blocklist protects other members too.
|
||||
</p>
|
||||
)}
|
||||
<form action={verifyCrowdsecReportingConfiguration}>
|
||||
<Button
|
||||
type="submit"
|
||||
size="sm"
|
||||
variant="outline"
|
||||
disabled={!reportingEnabled}
|
||||
>
|
||||
Verify channel
|
||||
</Button>
|
||||
</form>
|
||||
</div>
|
||||
{lastReport && (
|
||||
<p className="text-xs mt-2">
|
||||
<Badge variant={lastReport.ok ? "default" : "destructive"}>
|
||||
{lastReport.ok ? "Push healthy" : "Push failed"}
|
||||
</Badge>
|
||||
<span className="ml-2 text-muted-foreground">
|
||||
{lastReport.ok
|
||||
? `Last signal accepted ${new Date(lastReport.at).toLocaleString()}`
|
||||
: `${lastReport.message ?? "unknown"} (${new Date(lastReport.at).toLocaleString()})`}
|
||||
</span>
|
||||
</p>
|
||||
)}
|
||||
</div>
|
||||
</CardContent>
|
||||
</Card>
|
||||
|
||||
{stored.size === 0 && (
|
||||
<p className="text-xs text-muted-foreground">
|
||||
Persisted site settings: none yet — the form values above reflect the
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
"use client";
|
||||
|
||||
import { RefreshCw } from "lucide-react";
|
||||
import { useCallback, useEffect, useState } from "react";
|
||||
import { useEffect, useState } from "react";
|
||||
import { Badge } from "@/components/ui/badge";
|
||||
import { Button } from "@/components/ui/button";
|
||||
|
||||
@@ -11,10 +11,7 @@ export function HealthCheckClient() {
|
||||
);
|
||||
const [checking, setChecking] = useState(false);
|
||||
|
||||
// Must be stable: the effect below depends on it. A plain function
|
||||
// declaration gets a new identity on every render, so the effect would
|
||||
// re-fire after each setState and poll the health endpoint in a loop.
|
||||
const checkEmulator = useCallback(async () => {
|
||||
async function checkEmulator() {
|
||||
setChecking(true);
|
||||
setStatus("checking");
|
||||
try {
|
||||
@@ -30,11 +27,12 @@ export function HealthCheckClient() {
|
||||
} finally {
|
||||
setChecking(false);
|
||||
}
|
||||
}, []);
|
||||
}
|
||||
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: explicitly chosen here, see surrounding code
|
||||
useEffect(() => {
|
||||
checkEmulator();
|
||||
}, [checkEmulator]);
|
||||
}, []);
|
||||
|
||||
return (
|
||||
<div className="flex items-center gap-2">
|
||||
|
||||
@@ -70,9 +70,10 @@ export function AdminHelpTicketDetail({
|
||||
setMessages(initialMessages);
|
||||
}, [initialMessages]);
|
||||
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: scroll when thread updates
|
||||
useEffect(() => {
|
||||
messagesEndRef.current?.scrollIntoView({ behavior: "smooth" });
|
||||
}, []);
|
||||
}, [messages]);
|
||||
|
||||
function handleReply() {
|
||||
if (!reply.trim() || isPending) return;
|
||||
|
||||
@@ -84,10 +84,11 @@ export function ImportBadgesClient() {
|
||||
);
|
||||
|
||||
// Auto-load on mount and when allHotels changes
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: explicitly chosen here, see surrounding code
|
||||
useEffect(() => {
|
||||
setOffset(0);
|
||||
fetchBadges(activeSearch, 0, allHotels);
|
||||
}, [fetchBadges, allHotels, activeSearch]);
|
||||
}, [fetchBadges, allHotels]);
|
||||
|
||||
// "/" keyboard shortcut to focus search
|
||||
useEffect(() => {
|
||||
|
||||
@@ -808,6 +808,7 @@ export function NitroEditorDialog({
|
||||
>,
|
||||
).map((lc, i) => (
|
||||
<div
|
||||
// biome-ignore lint/suspicious/noArrayIndexKey: color preview dots, position is the identity
|
||||
key={i}
|
||||
className="w-4 h-4 rounded-full border border-border shadow-sm"
|
||||
style={{
|
||||
|
||||
@@ -89,9 +89,10 @@ export function OnlineTable({ data }: OnlineTableProps) {
|
||||
}, [autoRefresh, doRefresh]);
|
||||
|
||||
// Update lastUpdated when data changes
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: explicitly chosen here, see surrounding code
|
||||
useEffect(() => {
|
||||
setLastUpdated(new Date());
|
||||
}, []);
|
||||
}, [data.total]);
|
||||
|
||||
return (
|
||||
<div className="space-y-4">
|
||||
|
||||
@@ -56,7 +56,7 @@ export function PrefixDialog({
|
||||
if (!saving && confirmLeave()) onClose();
|
||||
}
|
||||
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: isOpen acts as a trigger here, not a value read in the body; removing it is a real regression, reverted once in 704e3363
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: explicitly chosen here, see surrounding code
|
||||
useEffect(() => {
|
||||
setSaveError(false);
|
||||
if (editPrefix) {
|
||||
@@ -78,9 +78,6 @@ export function PrefixDialog({
|
||||
active: false,
|
||||
});
|
||||
}
|
||||
// isOpen must stay in the deps: the effect is what clears the form when
|
||||
// the dialog is reopened. Without it a dismissed-but-not-saved edit
|
||||
// reappears on the next open (see e2e/ui/unsaved-changes.spec.ts).
|
||||
}, [editPrefix, isOpen]);
|
||||
|
||||
if (!isOpen) return null;
|
||||
|
||||
@@ -259,7 +259,8 @@ export function PrefixesClient({ canEdit }: { canEdit: boolean }) {
|
||||
{"{"}
|
||||
{[...prefix.text].map((char, i) => (
|
||||
<span
|
||||
key={char}
|
||||
// biome-ignore lint/suspicious/noArrayIndexKey: char position drives color slot
|
||||
key={`char-${i}`}
|
||||
style={{
|
||||
color: colors[Math.min(i, colors.length - 1)],
|
||||
}}
|
||||
@@ -280,9 +281,10 @@ export function PrefixesClient({ canEdit }: { canEdit: boolean }) {
|
||||
</TableCell>
|
||||
<TableCell>
|
||||
<div className="flex items-center gap-1">
|
||||
{colors.slice(0, 5).map((c) => (
|
||||
{colors.slice(0, 5).map((c, i) => (
|
||||
<div
|
||||
key={c}
|
||||
// biome-ignore lint/suspicious/noArrayIndexKey: color preview slots, position is identity
|
||||
key={`color-${i}`}
|
||||
className="w-4 h-4 rounded border"
|
||||
style={{ backgroundColor: c }}
|
||||
title={c}
|
||||
|
||||
@@ -109,9 +109,10 @@ export function AdminTicketDetail({
|
||||
return `/admin/users/show/${ticket.creator.id}`;
|
||||
}
|
||||
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: explicitly chosen here, see surrounding code
|
||||
useEffect(() => {
|
||||
messagesEndRef.current?.scrollIntoView({ behavior: "smooth" });
|
||||
}, []);
|
||||
}, [messages]);
|
||||
|
||||
function handleReply() {
|
||||
if (!reply.trim() || isPending) return;
|
||||
|
||||
@@ -42,11 +42,12 @@ export function ClientTranslations({
|
||||
|
||||
// Re-sync local state when the user switches file (server re-renders with
|
||||
// fresh entries; useState only initializes once).
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: explicitly chosen here, see surrounding code
|
||||
useEffect(() => {
|
||||
setData(entries);
|
||||
setSearch("");
|
||||
setPage(1);
|
||||
}, [entries]);
|
||||
}, [entries, activeFile.id]);
|
||||
|
||||
const filteredKeys = useMemo(() => {
|
||||
const keys = Object.keys(data);
|
||||
|
||||
@@ -1,95 +0,0 @@
|
||||
import { beforeEach, describe, expect, it, vi } from "vitest";
|
||||
|
||||
const mocks = vi.hoisted(() => ({
|
||||
clientIp: vi.fn(async () => "203.0.113.7"),
|
||||
rateLimit: vi.fn(
|
||||
async (): Promise<{ ok: boolean; retryAfter: number }> => ({
|
||||
ok: true,
|
||||
retryAfter: 0,
|
||||
}),
|
||||
),
|
||||
dbExecute: vi.fn(async () => [{}]),
|
||||
ping: vi.fn(async () => "PONG"),
|
||||
rconSend: vi.fn(async () => true),
|
||||
}));
|
||||
vi.mock("@/lib/rate-limit", () => ({
|
||||
clientIp: mocks.clientIp,
|
||||
rateLimit: mocks.rateLimit,
|
||||
}));
|
||||
vi.mock("@/lib/db", () => ({
|
||||
db: { execute: mocks.dbExecute },
|
||||
}));
|
||||
vi.mock("@/lib/redis", () => ({
|
||||
redis: {
|
||||
ping: mocks.ping,
|
||||
},
|
||||
}));
|
||||
vi.mock("@/lib/services/rcon", () => ({
|
||||
rcon: { send: mocks.rconSend },
|
||||
}));
|
||||
vi.mock("@/env", () => ({
|
||||
env: { REDIS_URL: "redis://cache.test:6379", RESEND_API_KEY: "" },
|
||||
}));
|
||||
|
||||
import { GET } from "./route";
|
||||
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks();
|
||||
mocks.ping.mockResolvedValue("PONG");
|
||||
mocks.dbExecute.mockResolvedValue([{}]);
|
||||
mocks.rconSend.mockResolvedValue(true);
|
||||
mocks.rateLimit.mockResolvedValue({ ok: true, retryAfter: 0 });
|
||||
});
|
||||
|
||||
describe("ops health status", () => {
|
||||
it("answers 200 when the database is reachable", async () => {
|
||||
const res = await GET();
|
||||
expect(res.status).toBe(200);
|
||||
expect(await res.json()).toMatchObject({
|
||||
status: "ok",
|
||||
database: true,
|
||||
});
|
||||
});
|
||||
|
||||
// The regression this guards: the route used to answer 200 unconditionally,
|
||||
// so the Docker healthcheck reported a container healthy while every page
|
||||
// failed to render.
|
||||
it("answers 503 when the database is unreachable", async () => {
|
||||
mocks.dbExecute.mockRejectedValue(new Error("ECONNREFUSED"));
|
||||
const res = await GET();
|
||||
expect(res.status).toBe(503);
|
||||
expect(await res.json()).toMatchObject({
|
||||
status: "degraded",
|
||||
database: false,
|
||||
});
|
||||
});
|
||||
|
||||
// Redis and the emulator both have in-process fallbacks (cache.ts,
|
||||
// rate-limit.ts), so failing the container on them would turn a degraded
|
||||
// site into a restart loop.
|
||||
it("stays 200 on a Redis outage because the cache falls back in-process", async () => {
|
||||
mocks.ping.mockRejectedValue(new Error("ECONNREFUSED"));
|
||||
const res = await GET();
|
||||
expect(res.status).toBe(200);
|
||||
expect(await res.json()).toMatchObject({
|
||||
status: "degraded",
|
||||
database: true,
|
||||
redis: false,
|
||||
});
|
||||
});
|
||||
|
||||
it("stays 200 when the emulator is unreachable", async () => {
|
||||
mocks.rconSend.mockResolvedValue(false);
|
||||
const res = await GET();
|
||||
expect(res.status).toBe(200);
|
||||
expect(await res.json()).toMatchObject({ emulator: false });
|
||||
});
|
||||
|
||||
it("still rate-limits before probing anything", async () => {
|
||||
mocks.rateLimit.mockResolvedValue({ ok: false, retryAfter: 30 });
|
||||
const res = await GET();
|
||||
expect(res.status).toBe(429);
|
||||
expect(res.headers.get("Retry-After")).toBe("30");
|
||||
expect(mocks.dbExecute).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
+14
-23
@@ -9,15 +9,9 @@ import { rcon } from "@/lib/services/rcon";
|
||||
|
||||
/**
|
||||
* Ops health probe: database reachability, Redis (when configured), emulator
|
||||
* RCON, SMTP (when configured), and runtime info.
|
||||
*
|
||||
* HTTP status is load-bearing: 200 means the CMS can actually serve, 503 means
|
||||
* it cannot. Previously this route answered 200 even with the database down,
|
||||
* so the Docker healthcheck reported a container "healthy" while every page
|
||||
* 500'd. Only the database drives the status — Redis and the emulator degrade
|
||||
* to in-process fallbacks (see `cache.ts` and `rate-limit.ts`), so failing the
|
||||
* container on those would trade a slow site for an outage. Docker does not
|
||||
* restart on `unhealthy`, so this reports rather than recycles.
|
||||
* RCON, SMTP (when configured), and runtime info. Returns HTTP 200 always
|
||||
* (read the `status`/`database` fields), so it's safe for uptime monitors that
|
||||
* only care about reachability. Rate-limited per client IP.
|
||||
*/
|
||||
export async function GET() {
|
||||
const ip = await clientIp();
|
||||
@@ -56,18 +50,15 @@ export async function GET() {
|
||||
const resendAvailable = !!env.RESEND_API_KEY;
|
||||
|
||||
const degraded = !database || redisOk === false;
|
||||
return apiJson(
|
||||
{
|
||||
status: degraded ? "degraded" : "ok",
|
||||
database,
|
||||
redis: redisOk,
|
||||
emulator,
|
||||
resend: resendAvailable,
|
||||
node: process.version,
|
||||
release: process.env.NEXT_PUBLIC_CMS_RELEASE ?? "unknown",
|
||||
uptime: Math.round(process.uptime()),
|
||||
time: new Date().toISOString(),
|
||||
},
|
||||
{ status: database ? 200 : 503 },
|
||||
);
|
||||
return apiJson({
|
||||
status: degraded ? "degraded" : "ok",
|
||||
database,
|
||||
redis: redisOk,
|
||||
emulator,
|
||||
resend: resendAvailable,
|
||||
node: process.version,
|
||||
release: process.env.NEXT_PUBLIC_CMS_RELEASE ?? "unknown",
|
||||
uptime: Math.round(process.uptime()),
|
||||
time: new Date().toISOString(),
|
||||
});
|
||||
}
|
||||
@@ -285,7 +285,7 @@ export function ClientView({
|
||||
window.removeEventListener("touchmove", onTouchMove);
|
||||
window.removeEventListener("touchend", onEnd);
|
||||
};
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: snapPos is a pure helper that reads neither state nor props, and being a function declaration its identity changes every render. Depending on it would re-bind the drag listeners on every mousemove.
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: snapPos is a useCallback used intentionally here
|
||||
}, [dragging, snapPos]);
|
||||
|
||||
return (
|
||||
|
||||
+2
-372
@@ -2162,14 +2162,14 @@ details[open] > summary .details-open\:rotate-180 {
|
||||
/* Glass morphism */
|
||||
.glass {
|
||||
background: color-mix(in srgb, var(--color-surface) 70%, transparent);
|
||||
-webkit-backdrop-filter: blur(20px);
|
||||
backdrop-filter: blur(20px);
|
||||
-webkit-backdrop-filter: blur(20px);
|
||||
border: 1px solid color-mix(in srgb, var(--color-text-muted) 10%, transparent);
|
||||
}
|
||||
.glass-strong {
|
||||
background: color-mix(in srgb, var(--color-surface) 85%, transparent);
|
||||
-webkit-backdrop-filter: blur(32px);
|
||||
backdrop-filter: blur(32px);
|
||||
-webkit-backdrop-filter: blur(32px);
|
||||
border: 1px solid color-mix(in srgb, var(--color-text-muted) 12%, transparent);
|
||||
}
|
||||
|
||||
@@ -2532,373 +2532,3 @@ html {
|
||||
letter-spacing: 0.12em;
|
||||
color: var(--color-text-muted);
|
||||
}
|
||||
|
||||
/* ── Public page polish: buttons ──────────────────────────────────── */
|
||||
.btn-brand {
|
||||
position: relative;
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
gap: 0.5rem;
|
||||
border-radius: 999px;
|
||||
background: linear-gradient(
|
||||
120deg,
|
||||
var(--color-primary) 0%,
|
||||
color-mix(in srgb, var(--color-primary) 72%, var(--color-accent)) 55%,
|
||||
color-mix(in srgb, var(--color-accent) 85%, var(--color-primary)) 100%
|
||||
);
|
||||
color: var(--color-primary-foreground);
|
||||
box-shadow:
|
||||
0 10px 26px -12px color-mix(in srgb, var(--color-primary) 75%, transparent),
|
||||
inset 0 1px 0 0 color-mix(in srgb, white 35%, transparent);
|
||||
transition:
|
||||
transform 0.22s ease,
|
||||
box-shadow 0.22s ease,
|
||||
filter 0.22s ease;
|
||||
}
|
||||
.btn-brand:hover {
|
||||
transform: translateY(-2px);
|
||||
filter: brightness(1.05);
|
||||
box-shadow:
|
||||
0 18px 36px -14px color-mix(in srgb, var(--color-primary) 85%, transparent),
|
||||
inset 0 1px 0 0 color-mix(in srgb, white 45%, transparent);
|
||||
}
|
||||
.btn-brand:active {
|
||||
transform: translateY(0) scale(0.985);
|
||||
}
|
||||
.btn-brand:focus-visible {
|
||||
outline: none;
|
||||
box-shadow:
|
||||
0 0 0 3px color-mix(in srgb, var(--color-primary) 35%, transparent),
|
||||
0 14px 32px -14px color-mix(in srgb, var(--color-primary) 80%, transparent);
|
||||
}
|
||||
|
||||
/* Frosted CTA meant to sit on top of the dark hero image. */
|
||||
.btn-glass-dark {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
gap: 0.5rem;
|
||||
border-radius: 999px;
|
||||
color: #fff;
|
||||
background: color-mix(in srgb, #ffffff 10%, transparent);
|
||||
border: 1px solid color-mix(in srgb, #ffffff 34%, transparent);
|
||||
-webkit-backdrop-filter: blur(12px);
|
||||
backdrop-filter: blur(12px);
|
||||
box-shadow: inset 0 1px 0 0 color-mix(in srgb, #ffffff 25%, transparent);
|
||||
transition:
|
||||
background 0.22s ease,
|
||||
border-color 0.22s ease,
|
||||
transform 0.22s ease;
|
||||
}
|
||||
.btn-glass-dark:hover {
|
||||
background: color-mix(in srgb, #ffffff 20%, transparent);
|
||||
border-color: color-mix(in srgb, #ffffff 60%, transparent);
|
||||
transform: translateY(-2px);
|
||||
}
|
||||
.btn-glass-dark:active {
|
||||
transform: translateY(0);
|
||||
}
|
||||
.btn-glass-dark:focus-visible {
|
||||
outline: none;
|
||||
border-color: #fff;
|
||||
box-shadow: 0 0 0 3px
|
||||
color-mix(in srgb, var(--color-primary) 55%, transparent);
|
||||
}
|
||||
|
||||
/* ── Public page polish: auth fields ──────────────────────────────── */
|
||||
.auth-label {
|
||||
display: block;
|
||||
font-size: 11px;
|
||||
font-weight: 800;
|
||||
letter-spacing: 0.14em;
|
||||
text-transform: uppercase;
|
||||
color: var(--color-text-muted);
|
||||
margin-bottom: 0.4rem;
|
||||
}
|
||||
.auth-input {
|
||||
width: 100%;
|
||||
border-radius: 14px;
|
||||
border: 1.5px solid
|
||||
color-mix(in srgb, var(--color-text-muted) 22%, transparent);
|
||||
background: color-mix(
|
||||
in srgb,
|
||||
var(--color-background) 88%,
|
||||
var(--color-surface)
|
||||
);
|
||||
padding: 0.78rem 1rem;
|
||||
font-size: 0.875rem;
|
||||
font-weight: 600;
|
||||
color: var(--color-text-readable);
|
||||
transition:
|
||||
border-color 0.2s ease,
|
||||
box-shadow 0.2s ease,
|
||||
background-color 0.2s ease;
|
||||
}
|
||||
.auth-input::placeholder {
|
||||
color: color-mix(in srgb, var(--color-text-muted) 75%, transparent);
|
||||
font-weight: 500;
|
||||
}
|
||||
.auth-input:hover:not(:disabled):not(:focus) {
|
||||
border-color: color-mix(in srgb, var(--color-primary) 45%, transparent);
|
||||
}
|
||||
.auth-input:focus {
|
||||
outline: none;
|
||||
border-color: var(--color-primary);
|
||||
background: var(--color-surface);
|
||||
box-shadow:
|
||||
0 0 0 3px color-mix(in srgb, var(--color-primary) 16%, transparent),
|
||||
0 0 24px -8px color-mix(in srgb, var(--color-primary) 60%, transparent);
|
||||
}
|
||||
.auth-input:disabled {
|
||||
opacity: 0.55;
|
||||
cursor: not-allowed;
|
||||
}
|
||||
.auth-input.has-icon {
|
||||
padding-left: 2.75rem;
|
||||
}
|
||||
.auth-input.has-action {
|
||||
padding-right: 2.75rem;
|
||||
}
|
||||
|
||||
/* Alert box used for form errors. */
|
||||
.auth-alert {
|
||||
display: flex;
|
||||
align-items: flex-start;
|
||||
gap: 0.5rem;
|
||||
border-radius: 14px;
|
||||
padding: 0.7rem 0.85rem;
|
||||
font-size: 0.85rem;
|
||||
font-weight: 700;
|
||||
color: color-mix(
|
||||
in srgb,
|
||||
var(--color-danger) 85%,
|
||||
var(--color-text-readable)
|
||||
);
|
||||
background: color-mix(in srgb, var(--color-danger) 10%, transparent);
|
||||
border: 1px solid color-mix(in srgb, var(--color-danger) 32%, transparent);
|
||||
}
|
||||
|
||||
/* Same box with the success tint — post-registration confirmation, etc. */
|
||||
.auth-alert.auth-alert--success {
|
||||
color: color-mix(
|
||||
in srgb,
|
||||
var(--color-success) 85%,
|
||||
var(--color-text-readable)
|
||||
);
|
||||
background: color-mix(in srgb, var(--color-success) 10%, transparent);
|
||||
border-color: color-mix(in srgb, var(--color-success) 32%, transparent);
|
||||
}
|
||||
|
||||
/* ── Public page polish: explore pills ────────────────────────────── */
|
||||
.explore-pill {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
gap: 0.5rem;
|
||||
padding: 0.6rem 1.15rem;
|
||||
border-radius: 999px;
|
||||
font-size: 0.85rem;
|
||||
font-weight: 700;
|
||||
color: var(--color-text-readable);
|
||||
background: color-mix(in srgb, var(--color-surface) 55%, transparent);
|
||||
border: 1px solid color-mix(in srgb, var(--color-text-muted) 16%, transparent);
|
||||
-webkit-backdrop-filter: blur(10px);
|
||||
backdrop-filter: blur(10px);
|
||||
transition:
|
||||
background 0.25s ease,
|
||||
border-color 0.25s ease,
|
||||
transform 0.25s ease,
|
||||
box-shadow 0.25s ease;
|
||||
}
|
||||
.explore-pill:hover {
|
||||
background: color-mix(
|
||||
in srgb,
|
||||
var(--color-primary) 16%,
|
||||
var(--color-surface)
|
||||
);
|
||||
border-color: color-mix(in srgb, var(--color-primary) 50%, transparent);
|
||||
transform: translateY(-2px);
|
||||
box-shadow: 0 12px 26px -14px
|
||||
color-mix(in srgb, var(--color-primary) 80%, transparent);
|
||||
}
|
||||
.explore-pill .pill-arrow {
|
||||
opacity: 0;
|
||||
transform: translateX(-4px);
|
||||
transition:
|
||||
opacity 0.25s ease,
|
||||
transform 0.25s ease;
|
||||
}
|
||||
.explore-pill:hover .pill-arrow {
|
||||
opacity: 1;
|
||||
transform: translateX(0);
|
||||
}
|
||||
.explore-pill:focus-visible {
|
||||
outline: none;
|
||||
border-color: var(--color-primary);
|
||||
box-shadow: 0 0 0 3px
|
||||
color-mix(in srgb, var(--color-primary) 20%, transparent);
|
||||
}
|
||||
|
||||
/* ── Public page polish: avatar tiles ─────────────────────────────── */
|
||||
.avatar-tile {
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
align-items: center;
|
||||
gap: 0.4rem;
|
||||
padding: 0.55rem 0.3rem;
|
||||
border-radius: 14px;
|
||||
background: color-mix(in srgb, var(--color-primary) 6%, transparent);
|
||||
border: 1px solid color-mix(in srgb, var(--color-primary) 14%, transparent);
|
||||
transition:
|
||||
transform 0.25s ease,
|
||||
border-color 0.25s ease,
|
||||
box-shadow 0.25s ease,
|
||||
background 0.25s ease;
|
||||
}
|
||||
.avatar-tile:hover {
|
||||
transform: translateY(-3px);
|
||||
background: color-mix(in srgb, var(--color-primary) 12%, transparent);
|
||||
border-color: color-mix(in srgb, var(--color-primary) 45%, transparent);
|
||||
box-shadow: 0 12px 24px -14px
|
||||
color-mix(in srgb, var(--color-primary) 85%, transparent);
|
||||
}
|
||||
.avatar-name {
|
||||
font-size: 9.5px;
|
||||
font-weight: 800;
|
||||
letter-spacing: 0.04em;
|
||||
color: var(--color-text-muted);
|
||||
max-width: 100%;
|
||||
overflow: hidden;
|
||||
text-overflow: ellipsis;
|
||||
white-space: nowrap;
|
||||
}
|
||||
.avatar-tile:hover .avatar-name {
|
||||
color: var(--color-text-readable);
|
||||
}
|
||||
.avatar-online {
|
||||
width: 8px;
|
||||
height: 8px;
|
||||
border-radius: 999px;
|
||||
background: var(--color-accent);
|
||||
box-shadow: 0 0 0 2px var(--color-surface);
|
||||
}
|
||||
|
||||
/* ── Public page polish: drifting aurora blobs ────────────────────── */
|
||||
.aurora-blob {
|
||||
position: absolute;
|
||||
border-radius: 999px;
|
||||
filter: blur(70px);
|
||||
pointer-events: none;
|
||||
will-change: transform;
|
||||
animation: aurora-drift 16s ease-in-out infinite alternate;
|
||||
}
|
||||
@keyframes aurora-drift {
|
||||
from {
|
||||
transform: translate3d(0, 0, 0) scale(1);
|
||||
opacity: 0.55;
|
||||
}
|
||||
to {
|
||||
transform: translate3d(30px, -24px, 0) scale(1.15);
|
||||
opacity: 0.85;
|
||||
}
|
||||
}
|
||||
|
||||
/* Small bobbing scroll cue at the bottom of the hero. */
|
||||
.hero-cue {
|
||||
animation: float 2.4s ease-in-out infinite;
|
||||
will-change: transform;
|
||||
}
|
||||
|
||||
@media (prefers-reduced-motion: reduce) {
|
||||
.aurora-blob,
|
||||
.hero-cue {
|
||||
animation: none;
|
||||
}
|
||||
.btn-brand:hover,
|
||||
.btn-glass-dark:hover,
|
||||
.explore-pill:hover,
|
||||
.avatar-tile:hover {
|
||||
transform: none;
|
||||
}
|
||||
}
|
||||
|
||||
/* Dividers between the four counters in the stats panel. */
|
||||
.stat-cell {
|
||||
position: relative;
|
||||
}
|
||||
@media (min-width: 1024px) {
|
||||
.stat-cell:not(:first-child)::before {
|
||||
content: "";
|
||||
position: absolute;
|
||||
left: -0.5rem;
|
||||
top: 18%;
|
||||
height: 64%;
|
||||
width: 1px;
|
||||
background: color-mix(in srgb, var(--color-text-muted) 20%, transparent);
|
||||
}
|
||||
}
|
||||
@media (max-width: 1023px) {
|
||||
.stat-cell:nth-child(3)::before {
|
||||
content: "";
|
||||
position: absolute;
|
||||
left: -0.5rem;
|
||||
top: 10%;
|
||||
height: 80%;
|
||||
width: 1px;
|
||||
background: color-mix(in srgb, var(--color-text-muted) 20%, transparent);
|
||||
}
|
||||
}
|
||||
|
||||
/* Mouse-tracking spotlight glow for premium cards. The dot position comes
|
||||
from CSS custom properties updated on pointermove (see SpotlightCard). */
|
||||
.spotlight {
|
||||
position: relative;
|
||||
isolation: isolate;
|
||||
}
|
||||
.spotlight::before {
|
||||
content: "";
|
||||
position: absolute;
|
||||
inset: 0;
|
||||
border-radius: inherit;
|
||||
pointer-events: none;
|
||||
opacity: 0;
|
||||
transition: opacity 0.4s ease;
|
||||
background: radial-gradient(
|
||||
340px circle at var(--spot-x, 50%) var(--spot-y, 50%),
|
||||
color-mix(in srgb, var(--color-primary) 20%, transparent),
|
||||
transparent 70%
|
||||
);
|
||||
z-index: -1;
|
||||
}
|
||||
.spotlight:hover::before,
|
||||
.spotlight:focus-within::before {
|
||||
opacity: 1;
|
||||
}
|
||||
|
||||
/* Section number mark (01 / 02 / …) used as a faint watermark in headers. */
|
||||
.number-mark {
|
||||
font-family: var(--font-nunito);
|
||||
font-weight: 900;
|
||||
letter-spacing: -0.02em;
|
||||
line-height: 1;
|
||||
background: linear-gradient(
|
||||
120deg,
|
||||
color-mix(in srgb, var(--color-primary) 65%, transparent),
|
||||
color-mix(in srgb, var(--color-accent) 50%, transparent)
|
||||
);
|
||||
-webkit-background-clip: text;
|
||||
background-clip: text;
|
||||
color: transparent;
|
||||
opacity: 0.85;
|
||||
}
|
||||
|
||||
@media (prefers-reduced-motion: reduce) {
|
||||
.spotlight::before {
|
||||
transition: none;
|
||||
}
|
||||
.animate-fade-in-up,
|
||||
.animate-scale-in,
|
||||
.animate-count {
|
||||
animation: none;
|
||||
}
|
||||
}
|
||||
@@ -27,7 +27,7 @@ export function useArticleRecovery(
|
||||
const dirtyRef = useRef(dirty);
|
||||
dirtyRef.current = dirty;
|
||||
const blocked = useRef(true);
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: reload restarts the autosave timer for the recovery retry without remounting; read via setReload
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: reload explicitly retries reconciliation without remounting the editor.
|
||||
useEffect(() => {
|
||||
let active = true;
|
||||
blocked.current = true;
|
||||
@@ -80,10 +80,6 @@ export function useArticleRecovery(
|
||||
active = false;
|
||||
clearInterval(timer);
|
||||
};
|
||||
// reload restarts the autosave timer without remounting the editor or
|
||||
// touching the current form contents; it is what the "Retry recovery"
|
||||
// button bumps after reconciling server versions. Removing it from the
|
||||
// deps makes that button a no-op.
|
||||
}, [key, form, saving, reload]);
|
||||
return {
|
||||
draft: recovery?.draft?.payload,
|
||||
|
||||
@@ -178,7 +178,7 @@ function InlineEditorSession({
|
||||
}
|
||||
document.addEventListener("keydown", onKeyDown);
|
||||
return () => document.removeEventListener("keydown", onKeyDown);
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: handleSave is a function declaration, so its identity changes every render; depending on it would re-register this listener on every keystroke. Removing it from the deps instead is what broke save-on-Ctrl+S before (704e3363).
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: handleSave is a stable callback from parent
|
||||
}, [canEdit, isDirty, saving, page, handleSave]);
|
||||
|
||||
const loadPage = useCallback(
|
||||
|
||||
@@ -860,6 +860,7 @@ export function SortableTree({
|
||||
const activeNode = activeId ? flatItems.find((n) => n.id === activeId) : null;
|
||||
const noop = () => {};
|
||||
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: intentionally partial deps (matching the eslint-disable-line below)
|
||||
const getItemProps = useCallback(
|
||||
(node: FlatTreeNode): Omit<TreeItemProps, "sortMode" | "isOverlay"> => ({
|
||||
node,
|
||||
@@ -885,10 +886,6 @@ export function SortableTree({
|
||||
handleToggleExpand,
|
||||
handleSelect,
|
||||
handleDuplicate,
|
||||
handleToggleVisible,
|
||||
handleDelete,
|
||||
handleToggleEnabled,
|
||||
handleAddSubpage,
|
||||
],
|
||||
); // eslint-disable-line react-hooks/exhaustive-deps
|
||||
|
||||
@@ -1108,7 +1105,8 @@ export function SortableTree({
|
||||
<div className="space-y-1 p-2" aria-hidden="true">
|
||||
{[...Array(8)].map((_, i) => (
|
||||
<div
|
||||
key={`skeleton-${i}`}
|
||||
// biome-ignore lint/suspicious/noArrayIndexKey: static placeholder rows
|
||||
key={i}
|
||||
className="flex items-center gap-2 rounded-md px-2 py-1.5"
|
||||
style={{ marginLeft: `${(i % 3) * 14}px` }}
|
||||
>
|
||||
|
||||
@@ -76,7 +76,7 @@ export function CatalogImagePicker({
|
||||
);
|
||||
|
||||
// Reset and fetch on open / search change
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: debounced is the search term; refetching on its change is intended
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: explicitly chosen here, see surrounding code
|
||||
useEffect(() => {
|
||||
if (!open) return;
|
||||
setImages([]);
|
||||
@@ -84,8 +84,7 @@ export function CatalogImagePicker({
|
||||
setHasMore(true);
|
||||
fetchImages(0, true);
|
||||
if (scrollRef.current) scrollRef.current.scrollTop = 0;
|
||||
// debounced drives the search term, so a changed query must refetch.
|
||||
}, [open, fetchImages, debounced]);
|
||||
}, [open, debounced, fetchImages]);
|
||||
|
||||
const handleScroll = useCallback(() => {
|
||||
const el = scrollRef.current;
|
||||
@@ -235,7 +234,7 @@ function CatalogImageThumb({
|
||||
const [error, setError] = useState(0);
|
||||
|
||||
// Reset error state when name changes
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: name is a prop; the reset is meant to follow it
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: explicitly chosen here, see surrounding code
|
||||
useEffect(() => setError(0), [name]);
|
||||
|
||||
if (!name || error >= 2) {
|
||||
|
||||
@@ -36,7 +36,7 @@ export function CatalogIntegrityPanel({ canRepair }: { canRepair: boolean }) {
|
||||
const [refresh, setRefresh] = useState(0);
|
||||
const request = useRef(0);
|
||||
const applying = useRef(false);
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: refresh starts a new read-only scan; read via setRefresh
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: A requested refresh must start a new read-only scan.
|
||||
useEffect(() => {
|
||||
const version = ++request.current;
|
||||
setBusy(true);
|
||||
@@ -58,8 +58,6 @@ export function CatalogIntegrityPanel({ canRepair }: { canRepair: boolean }) {
|
||||
return () => {
|
||||
request.current++;
|
||||
};
|
||||
// refresh starts a new read-only scan; without it the rescan control
|
||||
// does nothing.
|
||||
}, [catalog, refresh]);
|
||||
async function prepare() {
|
||||
setBusy(true);
|
||||
|
||||
@@ -73,6 +73,7 @@ export function IconPicker({
|
||||
);
|
||||
|
||||
// Reset and fetch on open / search change
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: explicitly chosen here, see surrounding code
|
||||
useEffect(() => {
|
||||
if (!open) return;
|
||||
setIcons([]);
|
||||
@@ -80,7 +81,7 @@ export function IconPicker({
|
||||
setHasMore(true);
|
||||
fetchIcons(0, true);
|
||||
if (scrollRef.current) scrollRef.current.scrollTop = 0;
|
||||
}, [open, fetchIcons]);
|
||||
}, [open, debounced, fetchIcons]);
|
||||
|
||||
const handleScroll = useCallback(() => {
|
||||
const el = scrollRef.current;
|
||||
@@ -214,9 +215,7 @@ function IconPreview({
|
||||
size?: number;
|
||||
}) {
|
||||
const [error, setError] = useState(false);
|
||||
// Clear the previous load failure when the icon changes, otherwise a
|
||||
// placeholder sticks to the next image too.
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: iconImage is a prop; the reset is meant to follow it
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: explicitly chosen here, see surrounding code
|
||||
useEffect(() => setError(false), [iconImage]);
|
||||
|
||||
if (error || iconImage <= 0) {
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import { QueryClient } from "@tanstack/react-query";
|
||||
import { HttpResponse, http } from "msw";
|
||||
import { onlineManager, QueryObserver } from "@tanstack/react-query";
|
||||
import { delay, HttpResponse, http } from "msw";
|
||||
import { setupServer } from "msw/node";
|
||||
import {
|
||||
afterAll,
|
||||
@@ -10,55 +10,257 @@ import {
|
||||
it,
|
||||
vi,
|
||||
} from "vitest";
|
||||
import { furnitureJobsQueryOptions } from "./furniture-jobs-query";
|
||||
import {
|
||||
furnitureCursorFixture,
|
||||
furnitureJobFixture,
|
||||
} from "@/test/furniture-jobs-fixtures";
|
||||
import {
|
||||
createFurnitureJobsClient,
|
||||
furnitureJobsQueryOptions,
|
||||
readFurnitureJobResponse,
|
||||
} from "./furniture-jobs-query";
|
||||
|
||||
let calls = 0;
|
||||
let release: (() => void) | null = null;
|
||||
|
||||
// Cast to any to bypass strict MSW v3 config types in the test environment
|
||||
const server = setupServer(
|
||||
http.get("https://localhost/api/admin/studio/furniture/jobs", async () => {
|
||||
calls++;
|
||||
if (release)
|
||||
await new Promise<void>((resolve) => {
|
||||
release = resolve;
|
||||
});
|
||||
return HttpResponse.json({ jobs: [], nextCursor: null });
|
||||
}),
|
||||
);
|
||||
|
||||
beforeAll(() => server.listen({ onUnhandledRequest: "bypass" } as any));
|
||||
afterEach(() => {
|
||||
calls = 0;
|
||||
release = null;
|
||||
const endpoint = "http://localhost/api/admin/studio/import-jobs";
|
||||
const server = setupServer();
|
||||
const clients: ReturnType<typeof createFurnitureJobsClient>[] = [];
|
||||
function client() {
|
||||
const value = createFurnitureJobsClient();
|
||||
clients.push(value);
|
||||
return value;
|
||||
}
|
||||
beforeAll(() => server.listen({ onUnhandledRequest: "error" }));
|
||||
afterEach(async () => {
|
||||
await Promise.all(
|
||||
clients.map(async (value) => {
|
||||
await value.cancelQueries();
|
||||
value.clear();
|
||||
}),
|
||||
);
|
||||
clients.length = 0;
|
||||
server.resetHandlers();
|
||||
});
|
||||
afterAll(() => {
|
||||
try {
|
||||
server.close();
|
||||
} catch (_e) {}
|
||||
});
|
||||
|
||||
afterAll(() => server.close());
|
||||
describe("furniture history HTTP query", () => {
|
||||
const client = () =>
|
||||
new QueryClient({ defaultOptions: { queries: { retry: false } } });
|
||||
|
||||
it("deduplicates simultaneous refreshes and caches their validated result", async () => {
|
||||
let calls = 0;
|
||||
let release: (() => void) | undefined;
|
||||
server.use(
|
||||
http.get(endpoint, async () => {
|
||||
calls++;
|
||||
await new Promise<void>((resolve) => {
|
||||
release = resolve;
|
||||
});
|
||||
return HttpResponse.json({
|
||||
ok: true,
|
||||
jobs: [furnitureJobFixture],
|
||||
nextCursor: furnitureCursorFixture,
|
||||
});
|
||||
}),
|
||||
);
|
||||
const cache = client();
|
||||
// Use type assertions to allow the test to manipulate options freely
|
||||
const options = furnitureJobsQueryOptions(false, null) as any;
|
||||
options.queryKey = ["furniture-import-history", false, null];
|
||||
options.queryFn = () =>
|
||||
fetch("https://localhost/api/admin/studio/furniture/jobs").then((r) =>
|
||||
r.json(),
|
||||
);
|
||||
|
||||
const options = furnitureJobsQueryOptions(true, null);
|
||||
const first = cache.fetchQuery(options);
|
||||
const second = cache.fetchQuery(options);
|
||||
|
||||
await vi.waitFor(() => expect(calls).toBe(1));
|
||||
if (release) release();
|
||||
|
||||
await Promise.all([first, second]);
|
||||
release?.();
|
||||
const [a, b] = await Promise.all([first, second]);
|
||||
expect(a).toEqual(b);
|
||||
expect(a.jobs[0].id).toBe(furnitureJobFixture.id);
|
||||
expect(cache.getQueryData(options.queryKey)).toEqual(a);
|
||||
});
|
||||
it("keeps different pages and mounted history clients isolated", async () => {
|
||||
const urls: string[] = [];
|
||||
server.use(
|
||||
http.get(endpoint, ({ request }) => {
|
||||
urls.push(request.url);
|
||||
return HttpResponse.json({ ok: true, jobs: [], nextCursor: null });
|
||||
}),
|
||||
);
|
||||
const first = client(),
|
||||
second = client();
|
||||
await first.fetchQuery(furnitureJobsQueryOptions(true, null));
|
||||
await first.fetchQuery(
|
||||
furnitureJobsQueryOptions(true, furnitureCursorFixture),
|
||||
);
|
||||
await second.fetchQuery(furnitureJobsQueryOptions(true, null));
|
||||
expect(urls).toHaveLength(3);
|
||||
expect(new URL(urls[1]).searchParams.get("before")).toBe(
|
||||
furnitureCursorFixture,
|
||||
);
|
||||
first.clear();
|
||||
expect(
|
||||
second.getQueryData(furnitureJobsQueryOptions(true, null).queryKey),
|
||||
).toEqual({ jobs: [], nextCursor: null });
|
||||
});
|
||||
it.each([403, 500])(
|
||||
"surfaces HTTP %i without automatic retries or a false empty result",
|
||||
async (status) => {
|
||||
let calls = 0;
|
||||
server.use(
|
||||
http.get(endpoint, () => {
|
||||
calls++;
|
||||
return HttpResponse.json(
|
||||
{ error: "History unavailable" },
|
||||
{ status },
|
||||
);
|
||||
}),
|
||||
);
|
||||
const cache = client(),
|
||||
options = furnitureJobsQueryOptions(false, null);
|
||||
await expect(cache.fetchQuery(options)).rejects.toMatchObject({
|
||||
status,
|
||||
message: "History unavailable",
|
||||
});
|
||||
expect(calls).toBe(1);
|
||||
expect(cache.getQueryData(options.queryKey)).toBeUndefined();
|
||||
},
|
||||
);
|
||||
it.each([
|
||||
{ ok: true, jobs: null },
|
||||
{ ok: true, jobs: [{ ...furnitureJobFixture, state: "invented" }] },
|
||||
{
|
||||
ok: true,
|
||||
jobs: [
|
||||
{
|
||||
...furnitureJobFixture,
|
||||
items: [{ ...furnitureJobFixture.items[0], state: "unknown" }],
|
||||
},
|
||||
],
|
||||
},
|
||||
{ ok: true, jobs: [{ ...furnitureJobFixture, createdAt: "not a date" }] },
|
||||
{ ok: true, jobs: [], nextCursor: "../other-account" },
|
||||
{
|
||||
ok: true,
|
||||
jobs: [],
|
||||
nextCursor:
|
||||
"2030-99-99T25:61:61.000Z|aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
|
||||
},
|
||||
])("rejects malformed successful payloads", async (payload) => {
|
||||
server.use(http.get(endpoint, () => HttpResponse.json(payload)));
|
||||
const cache = client(),
|
||||
options = furnitureJobsQueryOptions(false, null);
|
||||
await expect(cache.fetchQuery(options)).rejects.toThrow(
|
||||
"Invalid import history response",
|
||||
);
|
||||
expect(cache.getQueryData(options.queryKey)).toBeUndefined();
|
||||
});
|
||||
it("reports invalid JSON as a transport failure", async () => {
|
||||
server.use(
|
||||
http.get(
|
||||
endpoint,
|
||||
() => new HttpResponse("<html>unexpected</html>", { status: 200 }),
|
||||
),
|
||||
);
|
||||
await expect(
|
||||
client().fetchQuery(furnitureJobsQueryOptions(false, null)),
|
||||
).rejects.toThrow("Invalid import history response");
|
||||
});
|
||||
it("times out a stalled HTTP request without retries", async () => {
|
||||
let calls = 0;
|
||||
server.use(
|
||||
http.get(endpoint, async () => {
|
||||
calls++;
|
||||
await delay(100);
|
||||
return HttpResponse.json({ ok: true, jobs: [] });
|
||||
}),
|
||||
);
|
||||
await expect(
|
||||
client().fetchQuery(furnitureJobsQueryOptions(false, null, 10)),
|
||||
).rejects.toThrow("Import history request timed out");
|
||||
expect(calls).toBe(1);
|
||||
});
|
||||
it("aborts a cancelled request without replacing cache data with an empty result", async () => {
|
||||
let entered = false;
|
||||
let transportAborted = false;
|
||||
server.use(
|
||||
http.get(endpoint, async ({ request }) => {
|
||||
request.signal.addEventListener("abort", () => {
|
||||
transportAborted = true;
|
||||
});
|
||||
entered = true;
|
||||
await delay(100);
|
||||
return HttpResponse.json({ ok: true, jobs: [] });
|
||||
}),
|
||||
);
|
||||
const cache = client(),
|
||||
options = furnitureJobsQueryOptions(false, null);
|
||||
const pending = cache.fetchQuery(options);
|
||||
const rejection = expect(pending).rejects.toThrow();
|
||||
await vi.waitFor(() => expect(entered).toBe(true));
|
||||
await cache.cancelQueries({ queryKey: options.queryKey });
|
||||
await rejection;
|
||||
await vi.waitFor(() => expect(transportAborted).toBe(true));
|
||||
expect(cache.getQueryData(options.queryKey)).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
describe("history refresh and mutation response integrity", () => {
|
||||
it("retains the last valid page while a refresh fails", async () => {
|
||||
server.use(
|
||||
http.get(endpoint, () =>
|
||||
HttpResponse.json({ ok: true, jobs: [furnitureJobFixture] }),
|
||||
),
|
||||
);
|
||||
const cache = client(),
|
||||
options = furnitureJobsQueryOptions(false, null);
|
||||
const observer = new QueryObserver(cache, { ...options, enabled: false });
|
||||
const unsubscribe = observer.subscribe(() => {});
|
||||
try {
|
||||
await cache.fetchQuery(options);
|
||||
server.use(
|
||||
http.get(endpoint, () =>
|
||||
HttpResponse.json({ error: "offline" }, { status: 500 }),
|
||||
),
|
||||
);
|
||||
await expect(cache.fetchQuery(options)).rejects.toThrow("offline");
|
||||
expect(observer.getCurrentResult().data?.jobs[0].id).toBe(
|
||||
furnitureJobFixture.id,
|
||||
);
|
||||
expect(observer.getCurrentResult().error?.message).toBe("offline");
|
||||
} finally {
|
||||
unsubscribe();
|
||||
}
|
||||
});
|
||||
it("rejects malformed successful mutation responses rather than storing an undefined job", async () => {
|
||||
server.use(
|
||||
http.patch(endpoint, () =>
|
||||
HttpResponse.json({ ok: true, job: { id: furnitureJobFixture.id } }),
|
||||
),
|
||||
);
|
||||
const response = await fetch(endpoint, { method: "PATCH" });
|
||||
await expect(
|
||||
readFurnitureJobResponse(response, "Update failed"),
|
||||
).rejects.toThrow("Invalid import job response");
|
||||
});
|
||||
it("reports mutation HTTP failure without issuing a second write", async () => {
|
||||
let calls = 0;
|
||||
server.use(
|
||||
http.post(endpoint, () => {
|
||||
calls++;
|
||||
return HttpResponse.json(
|
||||
{ error: "Queue unavailable" },
|
||||
{ status: 500 },
|
||||
);
|
||||
}),
|
||||
);
|
||||
const response = await fetch(endpoint, { method: "POST" });
|
||||
await expect(
|
||||
readFurnitureJobResponse(response, "Queue failed"),
|
||||
).rejects.toMatchObject({ status: 500, message: "Queue unavailable" });
|
||||
expect(calls).toBe(1);
|
||||
});
|
||||
});
|
||||
|
||||
it("does not park manual refresh indefinitely behind a global offline signal", async () => {
|
||||
server.use(
|
||||
http.get(endpoint, () => HttpResponse.json({ ok: true, jobs: [] })),
|
||||
);
|
||||
onlineManager.setOnline(false);
|
||||
try {
|
||||
await expect(
|
||||
client().fetchQuery(furnitureJobsQueryOptions(false, null)),
|
||||
).resolves.toEqual({ jobs: [], nextCursor: null });
|
||||
} finally {
|
||||
onlineManager.setOnline(true);
|
||||
}
|
||||
});
|
||||
@@ -113,6 +113,7 @@ export function LayoutPreview({
|
||||
</div>
|
||||
) : (
|
||||
<div
|
||||
// biome-ignore lint/suspicious/noArrayIndexKey: positional layout grid placeholders
|
||||
key={`empty-${index}`}
|
||||
className="rounded bg-muted/40"
|
||||
style={{ width: compact ? 22 : 36, height: compact ? 22 : 36 }}
|
||||
|
||||
@@ -26,13 +26,7 @@ import {
|
||||
Trash2,
|
||||
X,
|
||||
} from "lucide-react";
|
||||
// motion/react-m is the minimal entry. The full motion/react pulls in
|
||||
// framer-motion's entire component library (73 internal modules) for what this
|
||||
// file needs: one fade-in on the result pane. The minimal entry ships only the
|
||||
// element factories (2 modules) and exposes the same initial/animate/transition
|
||||
// props, so the fade behaves identically. Only the element factory is
|
||||
// imported, since that is the single one this file renders.
|
||||
import { div as Mdiv } from "motion/react-m";
|
||||
import { motion } from "motion/react";
|
||||
import {
|
||||
lazy,
|
||||
Suspense,
|
||||
@@ -2059,7 +2053,7 @@ export function StudioClient({
|
||||
</p>
|
||||
</div>
|
||||
) : (
|
||||
<Mdiv
|
||||
<motion.div
|
||||
key={viewMode}
|
||||
initial={{ opacity: 0 }}
|
||||
animate={{ opacity: 1 }}
|
||||
@@ -2503,7 +2497,7 @@ export function StudioClient({
|
||||
</span>
|
||||
)}
|
||||
</div>
|
||||
</Mdiv>
|
||||
</motion.div>
|
||||
)}
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,183 +0,0 @@
|
||||
import type { ReactNode } from "react";
|
||||
import { AuthTopBar } from "@/components/auth/auth-top-bar";
|
||||
import { Reveal } from "@/components/motion-reveal";
|
||||
import { UserAvatarThumbnail } from "@/components/shared/user-avatar-thumbnail";
|
||||
import { SurfaceCard } from "@/components/surface-card";
|
||||
import { ICON_FRIENDS, ICON_NAV_GOODY, ICON_NAV_ME } from "@/lib/site-icons";
|
||||
|
||||
export interface PublicUser {
|
||||
username: string;
|
||||
look: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* The decorative aurora blobs that sit behind the auth top bar on `/login` and
|
||||
* `/register`. Purely visual, hence aria-hidden, and shared so both pages keep
|
||||
* the exact same tint and delay.
|
||||
*/
|
||||
export function AuthAurora() {
|
||||
return (
|
||||
<div
|
||||
aria-hidden="true"
|
||||
className="pointer-events-none absolute -inset-x-16 -top-24 overflow-hidden"
|
||||
>
|
||||
<div
|
||||
className="aurora-blob -left-20 top-0 h-80 w-80"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 34%, transparent)",
|
||||
opacity: 0.45,
|
||||
}}
|
||||
/>
|
||||
<div
|
||||
className="aurora-blob -right-20 top-6 h-72 w-72"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-accent) 30%, transparent)",
|
||||
animationDelay: "-7s",
|
||||
opacity: 0.4,
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
interface AuthUsersCardsProps {
|
||||
recentUsers: PublicUser[];
|
||||
latestUsers: PublicUser[];
|
||||
/** Title of the online-users card. */
|
||||
recentTitle: string;
|
||||
/** Title of the newest-accounts card. */
|
||||
latestTitle: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* The "who is online" + "newest citizens" avatar cards both auth pages show in
|
||||
* their left column. Cards with no users render nothing, so a cold database
|
||||
* degrades to just the intro panel instead of an empty grid.
|
||||
*/
|
||||
export function AuthUsersCards({
|
||||
recentUsers,
|
||||
latestUsers,
|
||||
recentTitle,
|
||||
latestTitle,
|
||||
}: AuthUsersCardsProps) {
|
||||
return (
|
||||
<>
|
||||
{recentUsers.length > 0 && (
|
||||
<SurfaceCard
|
||||
title={recentTitle}
|
||||
icon={ICON_NAV_GOODY}
|
||||
bodyClassName="p-4"
|
||||
className="card-glow"
|
||||
>
|
||||
<AvatarGrid users={recentUsers} online />
|
||||
</SurfaceCard>
|
||||
)}
|
||||
{latestUsers.length > 0 && (
|
||||
<SurfaceCard
|
||||
title={latestTitle}
|
||||
icon={ICON_FRIENDS}
|
||||
bodyClassName="p-4"
|
||||
className="card-glow"
|
||||
>
|
||||
<AvatarGrid users={latestUsers} />
|
||||
</SurfaceCard>
|
||||
)}
|
||||
</>
|
||||
);
|
||||
}
|
||||
|
||||
function AvatarGrid({
|
||||
users,
|
||||
online,
|
||||
}: {
|
||||
users: PublicUser[];
|
||||
online?: boolean;
|
||||
}) {
|
||||
return (
|
||||
<div className="grid grid-cols-4 gap-1.5 sm:gap-2">
|
||||
{users.map((u) => (
|
||||
<div key={u.username} title={u.username} className="avatar-tile">
|
||||
<div className="relative">
|
||||
<UserAvatarThumbnail
|
||||
figure={u.look}
|
||||
alt=""
|
||||
options={{ direction: 2 }}
|
||||
className="rounded-lg"
|
||||
/>
|
||||
{online && (
|
||||
<span className="avatar-online absolute -bottom-0.5 -right-0.5" />
|
||||
)}
|
||||
</div>
|
||||
<span className="avatar-name">{u.username}</span>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
interface AuthPageFrameProps {
|
||||
hotelName: string;
|
||||
logo?: string | null;
|
||||
/** Title of the form card on the right. */
|
||||
title: string;
|
||||
/** One-line intro above the form. */
|
||||
subtitle: ReactNode;
|
||||
/** Optional notice rendered at the top of the form card (e.g. "registered"). */
|
||||
notice?: ReactNode;
|
||||
/** The form itself. */
|
||||
form: ReactNode;
|
||||
/** The left column: intro panel plus `AuthUsersCards`. */
|
||||
children: ReactNode;
|
||||
}
|
||||
|
||||
/**
|
||||
* Shared skeleton for the public auth pages: aurora + top bar on top, a fixed
|
||||
* left column for the promo/roster panels and a sticky right column holding the
|
||||
* form. Both `/login` and `/register` used to duplicate all of it.
|
||||
*/
|
||||
export function AuthPageFrame({
|
||||
hotelName,
|
||||
logo,
|
||||
title,
|
||||
subtitle,
|
||||
notice,
|
||||
form,
|
||||
children,
|
||||
}: AuthPageFrameProps) {
|
||||
return (
|
||||
<div className="mx-auto w-full max-w-6xl flex flex-col gap-8 pb-16">
|
||||
<div className="relative">
|
||||
<AuthAurora />
|
||||
<AuthTopBar hotelName={hotelName} logo={logo} />
|
||||
</div>
|
||||
|
||||
<Reveal>
|
||||
<div className="flex flex-col gap-8 lg:flex-row lg:items-start">
|
||||
<div className="lg:w-96 shrink-0 space-y-4">{children}</div>
|
||||
|
||||
<div className="flex-1 lg:sticky lg:top-6">
|
||||
<div className="gradient-border">
|
||||
<SurfaceCard
|
||||
title={title}
|
||||
icon={ICON_NAV_ME}
|
||||
bodyClassName="p-6 sm:p-7"
|
||||
className="card-glow"
|
||||
>
|
||||
{notice}
|
||||
<p
|
||||
className="text-sm mb-6 leading-relaxed"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{subtitle}
|
||||
</p>
|
||||
{form}
|
||||
</SurfaceCard>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</Reveal>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -23,14 +23,14 @@ export function AuthTopBar({
|
||||
return (
|
||||
<Reveal>
|
||||
<div
|
||||
className="relative flex items-center justify-between rounded-full border px-3 py-2.5 sm:px-5"
|
||||
className="relative flex items-center justify-between rounded-xl border px-3 py-2.5 sm:px-5 sm:py-3"
|
||||
style={{
|
||||
background:
|
||||
"linear-gradient(90deg, color-mix(in srgb, var(--color-surface) 62%, transparent), color-mix(in srgb, var(--color-primary) 7%, transparent))",
|
||||
"color-mix(in srgb, var(--color-surface) 60%, transparent)",
|
||||
backdropFilter: "blur(14px)",
|
||||
WebkitBackdropFilter: "blur(14px)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-text-muted) 10%, transparent)",
|
||||
"color-mix(in srgb, var(--color-text-muted) 8%, transparent)",
|
||||
boxShadow:
|
||||
"0 1px 3px rgba(0,0,0,0.04), 0 0 0 0.5px color-mix(in srgb, var(--color-text-muted) 6%, transparent)",
|
||||
}}
|
||||
@@ -44,32 +44,21 @@ export function AuthTopBar({
|
||||
height={28}
|
||||
className="shrink-0 object-contain"
|
||||
unoptimized
|
||||
style={{ maxHeight: 26, width: "auto", height: "auto" }}
|
||||
style={{ maxHeight: 28, width: "auto", height: "auto" }}
|
||||
/>
|
||||
) : (
|
||||
<div
|
||||
className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full"
|
||||
style={{
|
||||
background:
|
||||
"linear-gradient(135deg, var(--color-primary), color-mix(in srgb, var(--color-accent) 60%, var(--color-primary)))",
|
||||
boxShadow:
|
||||
"0 4px 16px -4px color-mix(in srgb, var(--color-primary) 60%, transparent)",
|
||||
}}
|
||||
>
|
||||
<Image
|
||||
src={ICON_LIGHTHOUSE}
|
||||
alt=""
|
||||
width={18}
|
||||
height={18}
|
||||
className="shrink-0"
|
||||
unoptimized
|
||||
style={{ filter: "brightness(0) invert(1)" }}
|
||||
/>
|
||||
</div>
|
||||
<Image
|
||||
src={ICON_LIGHTHOUSE}
|
||||
alt={hotelName}
|
||||
width={28}
|
||||
height={28}
|
||||
className="shrink-0"
|
||||
unoptimized
|
||||
/>
|
||||
)}
|
||||
{showHotelName ? (
|
||||
<span
|
||||
className="hidden text-sm font-extrabold uppercase tracking-wide sm:inline"
|
||||
className="hidden sm:inline text-sm font-extrabold uppercase tracking-wide"
|
||||
style={{ color: "var(--color-text-readable)" }}
|
||||
>
|
||||
{hotelName}
|
||||
@@ -77,10 +66,10 @@ export function AuthTopBar({
|
||||
) : null}
|
||||
</div>
|
||||
<div
|
||||
className="flex items-center gap-1 sm:gap-1.5 rounded-full px-1.5 py-1 sm:px-2"
|
||||
className="flex items-center gap-1 sm:gap-1.5 rounded-lg px-1.5 py-1 sm:px-2"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-text-muted) 5%, transparent)",
|
||||
"color-mix(in srgb, var(--color-text-muted) 4%, transparent)",
|
||||
}}
|
||||
>
|
||||
<LanguageSwitcher />
|
||||
|
||||
@@ -0,0 +1,229 @@
|
||||
"use client";
|
||||
|
||||
import { signIn } from "next-auth/react";
|
||||
import { type FormEvent, useState } from "react";
|
||||
import { precheckLogin } from "@/actions/auth-precheck";
|
||||
import {
|
||||
type CaptchaPublicConfig,
|
||||
CaptchaWidget,
|
||||
readCaptchaToken,
|
||||
} from "@/components/auth/captcha-widget";
|
||||
import { signInWithTransientRetry } from "@/lib/auth/sign-in-retry";
|
||||
|
||||
export function HomeLoginForm({
|
||||
captcha = { provider: "none" },
|
||||
nonce,
|
||||
}: {
|
||||
captcha?: CaptchaPublicConfig;
|
||||
nonce?: string;
|
||||
} = {}) {
|
||||
const [username, setUsername] = useState("");
|
||||
const [password, setPassword] = useState("");
|
||||
const [showPassword, setShowPassword] = useState(false);
|
||||
const [code, setCode] = useState("");
|
||||
const [needs2fa, setNeeds2fa] = useState(false);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
const [pending, setPending] = useState(false);
|
||||
|
||||
async function onSubmit(e: FormEvent<HTMLFormElement>) {
|
||||
e.preventDefault();
|
||||
setError(null);
|
||||
setPending(true);
|
||||
try {
|
||||
if (!needs2fa) {
|
||||
const captchaToken = readCaptchaToken(e.currentTarget, captcha);
|
||||
const pre = await precheckLogin(username, password, captchaToken);
|
||||
if (pre === "invalid") {
|
||||
setError("Invalid username or password");
|
||||
return;
|
||||
}
|
||||
if (pre === "captcha") {
|
||||
setError("Captcha verification failed. Please try again.");
|
||||
return;
|
||||
}
|
||||
if (pre === "unverified") {
|
||||
setError("Please verify your email before signing in.");
|
||||
return;
|
||||
}
|
||||
if (pre === "twofactor") {
|
||||
setNeeds2fa(true);
|
||||
return;
|
||||
}
|
||||
}
|
||||
const res = await signInWithTransientRetry(() =>
|
||||
signIn("credentials", {
|
||||
username,
|
||||
password,
|
||||
code,
|
||||
redirect: false,
|
||||
}),
|
||||
);
|
||||
if (!res || res.error) {
|
||||
setError(
|
||||
needs2fa ? "Invalid 2FA code" : "Invalid username or password",
|
||||
);
|
||||
return;
|
||||
}
|
||||
window.location.href = "/";
|
||||
} catch {
|
||||
setError(needs2fa ? "Invalid 2FA code" : "Invalid username or password");
|
||||
} finally {
|
||||
setPending(false);
|
||||
}
|
||||
}
|
||||
|
||||
return (
|
||||
<form onSubmit={onSubmit} className="relative flex flex-col gap-4">
|
||||
<div className="space-y-1">
|
||||
<label
|
||||
htmlFor="login-username"
|
||||
className="block text-xs font-bold uppercase tracking-wider"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
Username
|
||||
</label>
|
||||
<input
|
||||
id="login-username"
|
||||
type="text"
|
||||
value={username}
|
||||
onChange={(e) => setUsername(e.target.value)}
|
||||
placeholder="Your username"
|
||||
autoComplete="username"
|
||||
disabled={needs2fa}
|
||||
className="input-glow w-full rounded-xl border-2 px-4 py-3 text-sm font-medium transition-all focus:outline-none disabled:opacity-50"
|
||||
style={{
|
||||
backgroundColor: "var(--color-background)",
|
||||
color: "var(--color-text-readable)",
|
||||
borderColor: needs2fa
|
||||
? "color-mix(in srgb, var(--color-text-muted) 15%, transparent)"
|
||||
: "color-mix(in srgb, var(--color-text-muted) 25%, transparent)",
|
||||
}}
|
||||
required
|
||||
/>
|
||||
</div>
|
||||
|
||||
<div className="space-y-1">
|
||||
<div className="flex items-center justify-between">
|
||||
<label
|
||||
htmlFor="login-password"
|
||||
className="block text-xs font-bold uppercase tracking-wider"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
Password
|
||||
</label>
|
||||
</div>
|
||||
<div className="relative">
|
||||
<input
|
||||
id="login-password"
|
||||
type={showPassword ? "text" : "password"}
|
||||
value={password}
|
||||
onChange={(e) => setPassword(e.target.value)}
|
||||
placeholder="Your password"
|
||||
autoComplete="current-password"
|
||||
disabled={needs2fa}
|
||||
className="input-glow w-full rounded-xl border-2 px-4 py-3 text-sm font-medium transition-all focus:outline-none disabled:opacity-50"
|
||||
style={{
|
||||
backgroundColor: "var(--color-background)",
|
||||
color: "var(--color-text-readable)",
|
||||
borderColor: needs2fa
|
||||
? "color-mix(in srgb, var(--color-text-muted) 15%, transparent)"
|
||||
: "color-mix(in srgb, var(--color-text-muted) 25%, transparent)",
|
||||
}}
|
||||
required
|
||||
/>
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setShowPassword(!showPassword)}
|
||||
className="absolute right-3 top-1/2 -translate-y-1/2 text-sm font-bold opacity-60 hover:opacity-100 transition-opacity"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
tabIndex={-1}
|
||||
>
|
||||
{showPassword ? "Hide" : "Show"}
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{needs2fa ? (
|
||||
<div className="space-y-1 animate-scale-in">
|
||||
<label
|
||||
htmlFor="login-2fa"
|
||||
className="block text-xs font-bold uppercase tracking-wider"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
2FA Code
|
||||
</label>
|
||||
<input
|
||||
id="login-2fa"
|
||||
type="text"
|
||||
value={code}
|
||||
onChange={(e) => setCode(e.target.value)}
|
||||
placeholder="Enter your 2FA code"
|
||||
inputMode="numeric"
|
||||
autoComplete="one-time-code"
|
||||
className="w-full rounded-xl border-2 px-4 py-3 text-sm font-medium transition-all focus:outline-none"
|
||||
style={{
|
||||
backgroundColor: "var(--color-background)",
|
||||
color: "var(--color-text-readable)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 30%, transparent)",
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
) : (
|
||||
<CaptchaWidget captcha={captcha} nonce={nonce} />
|
||||
)}
|
||||
|
||||
{error ? (
|
||||
<p
|
||||
className="animate-fade-in-up m-0 text-center text-sm font-semibold"
|
||||
style={{ color: "var(--color-danger)" }}
|
||||
>
|
||||
{error}
|
||||
</p>
|
||||
) : null}
|
||||
|
||||
<button
|
||||
type="submit"
|
||||
disabled={pending}
|
||||
className="btn-shine w-full cursor-pointer rounded-xl font-extrabold text-sm py-3.5 transition-all duration-200 hover:scale-[1.02] active:scale-95 shadow-lg disabled:opacity-60"
|
||||
style={{
|
||||
background: "var(--color-primary)",
|
||||
color: "var(--color-primary-foreground)",
|
||||
boxShadow:
|
||||
"0 4px 20px color-mix(in srgb, var(--color-primary) 30%, transparent)",
|
||||
}}
|
||||
>
|
||||
{pending ? (
|
||||
<span className="inline-flex items-center gap-2">
|
||||
<svg
|
||||
className="animate-spin h-4 w-4"
|
||||
viewBox="0 0 24 24"
|
||||
fill="none"
|
||||
role="img"
|
||||
aria-label="Loading"
|
||||
>
|
||||
<circle
|
||||
className="opacity-25"
|
||||
cx="12"
|
||||
cy="12"
|
||||
r="10"
|
||||
stroke="currentColor"
|
||||
strokeWidth="4"
|
||||
/>
|
||||
<path
|
||||
className="opacity-75"
|
||||
fill="currentColor"
|
||||
d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"
|
||||
/>
|
||||
</svg>
|
||||
Please wait...
|
||||
</span>
|
||||
) : needs2fa ? (
|
||||
"Verify"
|
||||
) : (
|
||||
"Login"
|
||||
)}
|
||||
</button>
|
||||
</form>
|
||||
);
|
||||
}
|
||||
@@ -1,63 +1,36 @@
|
||||
"use client";
|
||||
|
||||
import { KeyRound, Lock, UserRound } from "lucide-react";
|
||||
import { signIn } from "next-auth/react";
|
||||
import { useTranslations } from "next-intl";
|
||||
import { type FormEvent, useId, useState } from "react";
|
||||
import { type FormEvent, useState } from "react";
|
||||
import { precheckLogin } from "@/actions/auth-precheck";
|
||||
import {
|
||||
type CaptchaPublicConfig,
|
||||
CaptchaWidget,
|
||||
readCaptchaToken,
|
||||
} from "@/components/auth/captcha-widget";
|
||||
import { PasswordToggle } from "@/components/auth/password-toggle";
|
||||
import Link from "@/components/link";
|
||||
import { signInWithTransientRetry } from "@/lib/auth/sign-in-retry";
|
||||
|
||||
export type LoginFormVariant =
|
||||
/** Full page: labelled fields, plus the register / forgot-password footer. */
|
||||
| "page"
|
||||
/** Homepage sidebar: visible labels, no footer, tighter spacing. */
|
||||
| "compact";
|
||||
|
||||
export interface LoginFormProps {
|
||||
captcha?: CaptchaPublicConfig;
|
||||
nonce?: string;
|
||||
variant?: LoginFormVariant;
|
||||
/** Where to land after a successful sign-in. */
|
||||
redirectTo?: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* The single sign-in form for both `/login` and the homepage sidebar. It runs a
|
||||
* cheap server-side precheck first so the visitor gets a specific reason
|
||||
* (bad password, unverified email, 2FA required, captcha) instead of NextAuth's
|
||||
* generic failure, then completes the credentials sign-in.
|
||||
*/
|
||||
export function LoginForm({
|
||||
captcha = { provider: "none" },
|
||||
nonce,
|
||||
variant = "page",
|
||||
redirectTo = "/me",
|
||||
}: LoginFormProps = {}) {
|
||||
}: {
|
||||
captcha?: CaptchaPublicConfig;
|
||||
nonce?: string;
|
||||
}) {
|
||||
const t = useTranslations("pages.login");
|
||||
const fieldId = useId();
|
||||
const [username, setUsername] = useState("");
|
||||
const [password, setPassword] = useState("");
|
||||
const [showPassword, setShowPassword] = useState(false);
|
||||
const [code, setCode] = useState("");
|
||||
const [needs2fa, setNeeds2fa] = useState(false);
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
const [unverified, setUnverified] = useState(false);
|
||||
const [pending, setPending] = useState(false);
|
||||
|
||||
const showFooter = variant === "page";
|
||||
const lockCredentials = needs2fa ? "opacity-50 pointer-events-none" : "";
|
||||
|
||||
async function onSubmit(e: FormEvent<HTMLFormElement>) {
|
||||
e.preventDefault();
|
||||
setError(null);
|
||||
setUnverified(false);
|
||||
setPending(true);
|
||||
try {
|
||||
if (!needs2fa) {
|
||||
@@ -73,7 +46,6 @@ export function LoginForm({
|
||||
}
|
||||
if (pre === "unverified") {
|
||||
setError(t("errorUnverified"));
|
||||
setUnverified(true);
|
||||
return;
|
||||
}
|
||||
if (pre === "twofactor") {
|
||||
@@ -95,7 +67,7 @@ export function LoginForm({
|
||||
);
|
||||
return;
|
||||
}
|
||||
window.location.href = redirectTo;
|
||||
window.location.href = "/me";
|
||||
} catch {
|
||||
setError(needs2fa ? t("errorInvalid2fa") : t("errorInvalidCredentials"));
|
||||
} finally {
|
||||
@@ -107,107 +79,73 @@ export function LoginForm({
|
||||
<>
|
||||
{needs2fa && (
|
||||
<p
|
||||
className="animate-fade-in-up mb-4 rounded-xl border px-3 py-2.5 text-sm font-semibold"
|
||||
style={{
|
||||
color: "var(--color-text-readable)",
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 10%, transparent)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 26%, transparent)",
|
||||
}}
|
||||
className="animate-fade-in-up text-sm font-semibold mb-4"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{t("subtitle2fa")}
|
||||
</p>
|
||||
)}
|
||||
|
||||
<form
|
||||
onSubmit={onSubmit}
|
||||
aria-label={t("signIn")}
|
||||
className="relative flex flex-col gap-4"
|
||||
>
|
||||
<div className={`space-y-1.5 ${lockCredentials}`}>
|
||||
<label htmlFor={`${fieldId}-username`} className="auth-label">
|
||||
{t("username")}
|
||||
</label>
|
||||
<div className="relative">
|
||||
<UserRound
|
||||
aria-hidden="true"
|
||||
className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
/>
|
||||
<input
|
||||
id={`${fieldId}-username`}
|
||||
name="username"
|
||||
type="text"
|
||||
value={username}
|
||||
onChange={(e) => setUsername(e.target.value)}
|
||||
placeholder={t("usernamePlaceholder")}
|
||||
autoComplete="username"
|
||||
disabled={needs2fa}
|
||||
required
|
||||
className="auth-input has-icon"
|
||||
/>
|
||||
</div>
|
||||
<form onSubmit={onSubmit} className="flex flex-col gap-4">
|
||||
<div className={needs2fa ? "opacity-50 pointer-events-none" : ""}>
|
||||
<input
|
||||
value={username}
|
||||
onChange={(e) => setUsername(e.target.value)}
|
||||
placeholder={t("usernamePlaceholder")}
|
||||
autoComplete="username"
|
||||
disabled={needs2fa}
|
||||
className="input-glow w-full rounded-xl border-2 px-4 py-3 text-sm font-medium transition-all focus:outline-none disabled:opacity-50"
|
||||
style={{
|
||||
backgroundColor: "var(--color-background)",
|
||||
color: "var(--color-text-readable)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-text-muted) 25%, transparent)",
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
|
||||
<div className={`space-y-1.5 ${lockCredentials}`}>
|
||||
<label htmlFor={`${fieldId}-password`} className="auth-label">
|
||||
{t("password")}
|
||||
</label>
|
||||
<div className="relative">
|
||||
<Lock
|
||||
aria-hidden="true"
|
||||
className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
/>
|
||||
<input
|
||||
id={`${fieldId}-password`}
|
||||
name="password"
|
||||
type={showPassword ? "text" : "password"}
|
||||
value={password}
|
||||
onChange={(e) => setPassword(e.target.value)}
|
||||
placeholder={t("passwordPlaceholder")}
|
||||
autoComplete="current-password"
|
||||
disabled={needs2fa}
|
||||
required
|
||||
className="auth-input has-icon has-action"
|
||||
/>
|
||||
<PasswordToggle
|
||||
show={showPassword}
|
||||
onToggle={() => setShowPassword((v) => !v)}
|
||||
labelShow={t("showPassword")}
|
||||
labelHide={t("hidePassword")}
|
||||
/>
|
||||
</div>
|
||||
<div
|
||||
className={`${needs2fa ? "opacity-50 pointer-events-none" : ""} relative`}
|
||||
>
|
||||
<input
|
||||
type={showPassword ? "text" : "password"}
|
||||
value={password}
|
||||
onChange={(e) => setPassword(e.target.value)}
|
||||
placeholder={t("passwordPlaceholder")}
|
||||
autoComplete="current-password"
|
||||
disabled={needs2fa}
|
||||
className="input-glow w-full rounded-xl border-2 px-4 py-3 text-sm font-medium transition-all focus:outline-none disabled:opacity-50"
|
||||
style={{
|
||||
backgroundColor: "var(--color-background)",
|
||||
color: "var(--color-text-readable)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-text-muted) 25%, transparent)",
|
||||
}}
|
||||
/>
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setShowPassword(!showPassword)}
|
||||
className="absolute right-3 top-1/2 -translate-y-1/2 text-sm font-bold opacity-60 hover:opacity-100 transition-opacity"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
tabIndex={-1}
|
||||
>
|
||||
{showPassword ? "Hide" : "Show"}
|
||||
</button>
|
||||
</div>
|
||||
|
||||
{needs2fa ? (
|
||||
<div className="animate-scale-in space-y-1.5">
|
||||
<label htmlFor={`${fieldId}-2fa`} className="auth-label">
|
||||
{t("codePlaceholder")}
|
||||
</label>
|
||||
<div className="relative">
|
||||
<KeyRound
|
||||
aria-hidden="true"
|
||||
className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
|
||||
style={{ color: "var(--color-primary)" }}
|
||||
/>
|
||||
<input
|
||||
id={`${fieldId}-2fa`}
|
||||
name="code"
|
||||
type="text"
|
||||
value={code}
|
||||
onChange={(e) => setCode(e.target.value)}
|
||||
placeholder={t("codePlaceholder")}
|
||||
inputMode="numeric"
|
||||
autoComplete="one-time-code"
|
||||
className="auth-input has-icon"
|
||||
style={{
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 45%, transparent)",
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
<div className="animate-scale-in">
|
||||
<input
|
||||
value={code}
|
||||
onChange={(e) => setCode(e.target.value)}
|
||||
placeholder={t("codePlaceholder")}
|
||||
inputMode="numeric"
|
||||
autoComplete="one-time-code"
|
||||
className="input-glow w-full rounded-xl border-2 px-4 py-3 text-sm font-medium transition-all focus:outline-none"
|
||||
style={{
|
||||
backgroundColor: "var(--color-background)",
|
||||
color: "var(--color-text-readable)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 30%, transparent)",
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
) : (
|
||||
<CaptchaWidget captcha={captcha} nonce={nonce} />
|
||||
@@ -215,42 +153,32 @@ export function LoginForm({
|
||||
|
||||
{error && (
|
||||
<p
|
||||
role="alert"
|
||||
aria-live="polite"
|
||||
className="auth-alert animate-fade-in-up m-0"
|
||||
className="animate-fade-in-up text-sm text-center font-semibold"
|
||||
style={{ color: "var(--color-danger)" }}
|
||||
>
|
||||
{error}
|
||||
</p>
|
||||
)}
|
||||
|
||||
{unverified && (
|
||||
<p
|
||||
className="m-0 text-center text-xs"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
<Link
|
||||
href="/verify"
|
||||
className="font-extrabold transition-colors hover:underline"
|
||||
style={{ color: "var(--color-primary)" }}
|
||||
>
|
||||
{t("verifyEmailCta")}
|
||||
</Link>
|
||||
</p>
|
||||
)}
|
||||
|
||||
<button
|
||||
type="submit"
|
||||
disabled={pending}
|
||||
className="btn-brand btn-shine w-full cursor-pointer py-3.5 text-sm font-extrabold uppercase tracking-wider disabled:opacity-60"
|
||||
className="btn-shine w-full rounded-xl font-extrabold text-sm py-3.5 transition-all duration-200 hover:scale-[1.02] active:scale-95 shadow-lg disabled:opacity-60"
|
||||
style={{
|
||||
background: "var(--color-primary)",
|
||||
color: "var(--color-primary-foreground)",
|
||||
boxShadow:
|
||||
"0 4px 24px color-mix(in srgb, var(--color-primary) 35%, transparent)",
|
||||
}}
|
||||
>
|
||||
{pending ? (
|
||||
<span className="inline-flex items-center justify-center gap-2">
|
||||
<svg
|
||||
className="h-4 w-4 animate-spin"
|
||||
className="animate-spin h-4 w-4"
|
||||
viewBox="0 0 24 24"
|
||||
fill="none"
|
||||
role="img"
|
||||
aria-label={t("pleaseWait")}
|
||||
aria-label="Loading"
|
||||
>
|
||||
<circle
|
||||
className="opacity-25"
|
||||
@@ -276,43 +204,27 @@ export function LoginForm({
|
||||
</button>
|
||||
</form>
|
||||
|
||||
{showFooter && (
|
||||
<div
|
||||
className="mt-6 space-y-3 border-t pt-5"
|
||||
style={{
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-text-muted) 14%, transparent)",
|
||||
}}
|
||||
<p
|
||||
className="text-xs text-center mt-6"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{t("noAccount")}{" "}
|
||||
<Link
|
||||
href="/register"
|
||||
className="font-extrabold hover:underline"
|
||||
style={{ color: "var(--color-primary)" }}
|
||||
>
|
||||
<p
|
||||
className="text-center text-xs"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{t("noAccount")}{" "}
|
||||
<Link
|
||||
href="/register"
|
||||
className="font-extrabold transition-colors hover:underline"
|
||||
style={{ color: "var(--color-primary)" }}
|
||||
>
|
||||
{t("createOne")}
|
||||
</Link>
|
||||
</p>
|
||||
<Link
|
||||
href="/forgot"
|
||||
className="flex items-center justify-center gap-2 rounded-full border px-4 py-2.5 text-xs font-extrabold transition-all duration-200 hover:-translate-y-0.5"
|
||||
style={{
|
||||
color: "var(--color-primary)",
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 8%, transparent)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 35%, transparent)",
|
||||
}}
|
||||
>
|
||||
<KeyRound aria-hidden="true" className="h-3.5 w-3.5" />
|
||||
{t("forgotPassword")}
|
||||
</Link>
|
||||
</div>
|
||||
)}
|
||||
{t("createOne")}
|
||||
</Link>{" "}
|
||||
·{" "}
|
||||
<Link
|
||||
href="/forgot"
|
||||
className="font-extrabold hover:underline"
|
||||
style={{ color: "var(--color-primary)" }}
|
||||
>
|
||||
{t("forgotPassword")}
|
||||
</Link>
|
||||
</p>
|
||||
</>
|
||||
);
|
||||
}
|
||||
@@ -1,37 +0,0 @@
|
||||
"use client";
|
||||
|
||||
import { Eye, EyeOff } from "lucide-react";
|
||||
|
||||
/**
|
||||
* Round eye-icon button that reveals / hides a password field. Kept separate so
|
||||
* the login and register forms share one consistent control (and a11y labels).
|
||||
*/
|
||||
export function PasswordToggle({
|
||||
show,
|
||||
onToggle,
|
||||
labelShow,
|
||||
labelHide,
|
||||
}: {
|
||||
show: boolean;
|
||||
onToggle: () => void;
|
||||
labelShow: string;
|
||||
labelHide: string;
|
||||
}) {
|
||||
return (
|
||||
<button
|
||||
type="button"
|
||||
onClick={onToggle}
|
||||
aria-label={show ? labelHide : labelShow}
|
||||
aria-pressed={show}
|
||||
tabIndex={-1}
|
||||
className="absolute right-2.5 top-1/2 flex h-8 w-8 -translate-y-1/2 items-center justify-center rounded-full transition-colors duration-200 hover:bg-[color-mix(in_srgb,var(--color-primary)_14%,transparent)] focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[var(--color-primary)]"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{show ? (
|
||||
<EyeOff aria-hidden="true" className="h-4 w-4" />
|
||||
) : (
|
||||
<Eye aria-hidden="true" className="h-4 w-4" />
|
||||
)}
|
||||
</button>
|
||||
);
|
||||
}
|
||||
@@ -1,24 +1,11 @@
|
||||
"use client";
|
||||
|
||||
import {
|
||||
Check,
|
||||
KeyRound,
|
||||
Lock,
|
||||
Mail,
|
||||
ShieldCheck,
|
||||
UserRound,
|
||||
X,
|
||||
} from "lucide-react";
|
||||
import Image from "next/image";
|
||||
import Script from "next/script";
|
||||
import { signIn } from "next-auth/react";
|
||||
import { useTranslations } from "next-intl";
|
||||
import { useActionState, useEffect, useRef, useState } from "react";
|
||||
import {
|
||||
type RegisterErrorCode,
|
||||
type RegisterState,
|
||||
register,
|
||||
} from "@/actions/register";
|
||||
import { PasswordToggle } from "@/components/auth/password-toggle";
|
||||
import { type RegisterState, register } from "@/actions/register";
|
||||
import Link from "@/components/link";
|
||||
import { signInWithTransientRetry } from "@/lib/auth/sign-in-retry";
|
||||
|
||||
@@ -29,10 +16,7 @@ interface RegisterFormProps {
|
||||
nonce?: string;
|
||||
}
|
||||
|
||||
function passwordStrength(
|
||||
pw: string,
|
||||
t: (key: string) => string,
|
||||
): {
|
||||
function passwordStrength(pw: string): {
|
||||
score: number;
|
||||
label: string;
|
||||
color: string;
|
||||
@@ -44,10 +28,10 @@ function passwordStrength(
|
||||
if (/\d/.test(pw)) score += 1;
|
||||
if (/[^a-zA-Z0-9]/.test(pw)) score += 1;
|
||||
|
||||
if (score <= 1) return { score, label: t("strengthWeak"), color: "#ef4444" };
|
||||
if (score <= 2) return { score, label: t("strengthFair"), color: "#f59e0b" };
|
||||
if (score <= 3) return { score, label: t("strengthGood"), color: "#22c55e" };
|
||||
return { score: 5, label: t("strengthStrong"), color: "#16a34a" };
|
||||
if (score <= 1) return { score, label: "Weak", color: "#ef4444" };
|
||||
if (score <= 2) return { score, label: "Fair", color: "#f59e0b" };
|
||||
if (score <= 3) return { score, label: "Good", color: "#22c55e" };
|
||||
return { score: 5, label: "Strong", color: "#16a34a" };
|
||||
}
|
||||
|
||||
export function RegisterForm({
|
||||
@@ -62,26 +46,10 @@ export function RegisterForm({
|
||||
RegisterState,
|
||||
FormData
|
||||
>(register, { error: null, ok: false });
|
||||
|
||||
/**
|
||||
* Prefer the locale-independent `code` so the message follows the visitor's
|
||||
* language, falling back to the server's English string when a code has no
|
||||
* translation yet.
|
||||
*/
|
||||
const translateErrorCode = (code: RegisterErrorCode | undefined) => {
|
||||
if (!code) return null;
|
||||
try {
|
||||
return t(code);
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
};
|
||||
const errorMessage = error ?? translateErrorCode(state.code) ?? state.error;
|
||||
const [termsAccepted, setTermsAccepted] = useState(false);
|
||||
const [termsError, setTermsError] = useState(false);
|
||||
const termsRef = useRef<HTMLDivElement>(null);
|
||||
const [password, setPassword] = useState("");
|
||||
const [confirmPassword, setConfirmPassword] = useState("");
|
||||
const [showPassword, setShowPassword] = useState(false);
|
||||
const [showConfirm, setShowConfirm] = useState(false);
|
||||
const [signingIn, setSigningIn] = useState(false);
|
||||
@@ -90,22 +58,7 @@ export function RegisterForm({
|
||||
);
|
||||
const autoLoginStartedRef = useRef(false);
|
||||
const [referralCode, setReferralCode] = useState("");
|
||||
const strength = passwordStrength(password, t);
|
||||
|
||||
/**
|
||||
* The password policy the server enforces, evaluated live so the visitor can
|
||||
* see which rule they are still missing instead of submitting and reading a
|
||||
* single error back.
|
||||
*/
|
||||
const requirements = [
|
||||
{ label: t("passwordMinLength"), met: password.length >= 12 },
|
||||
{ label: t("passwordUpper"), met: /[A-Z]/.test(password) },
|
||||
{ label: t("passwordLower"), met: /[a-z]/.test(password) },
|
||||
{ label: t("passwordDigit"), met: /\d/.test(password) },
|
||||
{ label: t("passwordSpecial"), met: /[^A-Za-z0-9]/.test(password) },
|
||||
];
|
||||
/** Shown as soon as the confirmation is filled in and disagrees. */
|
||||
const mismatch = confirmPassword.length > 0 && confirmPassword !== password;
|
||||
const strength = passwordStrength(password);
|
||||
|
||||
// The invite link is `/register?ref=<username>`; read it client-side so the
|
||||
// attribution travels with the sign-up form without server state.
|
||||
@@ -167,41 +120,90 @@ export function RegisterForm({
|
||||
nonce={nonce}
|
||||
/>
|
||||
) : null}
|
||||
{/* Header Banner */}
|
||||
<div
|
||||
className="relative overflow-hidden bg-center bg-cover rounded-t-xl"
|
||||
style={{
|
||||
backgroundImage: "url(/assets/images/mybobba_banner.png)",
|
||||
height: "160px",
|
||||
}}
|
||||
>
|
||||
<div
|
||||
className="absolute inset-0 z-10"
|
||||
style={{
|
||||
background:
|
||||
"linear-gradient(180deg, rgba(0,0,0,0.05) 0%, rgba(0,0,0,0.55) 100%)",
|
||||
}}
|
||||
/>
|
||||
<div className="relative flex items-center justify-center w-full h-full z-20">
|
||||
<div
|
||||
className="relative animate-float"
|
||||
style={{ width: "140px", height: "140px" }}
|
||||
>
|
||||
<div
|
||||
className="absolute inset-0 rounded-full overflow-hidden"
|
||||
style={{ zIndex: -1 }}
|
||||
>
|
||||
<div
|
||||
className="w-full h-full"
|
||||
style={{
|
||||
background: "black",
|
||||
filter: "blur(8px)",
|
||||
transform: "scale(1.2)",
|
||||
opacity: 0.6,
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
<Image
|
||||
src="/assets/images/FrankwithBag.gif"
|
||||
alt=""
|
||||
fill
|
||||
className="!static"
|
||||
style={{
|
||||
objectFit: "contain",
|
||||
objectPosition: "center",
|
||||
width: "100%",
|
||||
height: "100%",
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{/* Form */}
|
||||
<form
|
||||
action={(fd) => {
|
||||
const passwordValue = String(fd.get("password") ?? "");
|
||||
const confirmation = String(fd.get("password_confirmation") ?? "");
|
||||
// A mismatch is reported live under the field — no round-trip
|
||||
// needed just to hear it again from the server.
|
||||
if (passwordValue !== confirmation) return;
|
||||
credentialsRef.current = {
|
||||
username: String(fd.get("username") ?? "").trim(),
|
||||
password: passwordValue,
|
||||
password: String(fd.get("password") ?? ""),
|
||||
};
|
||||
formAction(fd);
|
||||
}}
|
||||
className="flex flex-col gap-6"
|
||||
className="p-6 flex flex-col gap-6"
|
||||
style={{
|
||||
backgroundColor:
|
||||
"color-mix(in srgb, var(--color-background) 50%, var(--color-surface))",
|
||||
borderRadius: "0 0 12px 12px",
|
||||
}}
|
||||
>
|
||||
{errorMessage && (
|
||||
<p
|
||||
role="alert"
|
||||
aria-live="polite"
|
||||
className="auth-alert animate-fade-in-up m-0"
|
||||
{(error || state.error) && (
|
||||
<div
|
||||
className="animate-fade-in-up p-3 rounded-lg text-sm font-semibold text-primary-foreground"
|
||||
style={{ backgroundColor: "var(--color-danger)" }}
|
||||
>
|
||||
{errorMessage}
|
||||
</p>
|
||||
{error || state.error}
|
||||
</div>
|
||||
)}
|
||||
|
||||
{referralCode && (
|
||||
<div
|
||||
className="animate-fade-in-up flex items-center gap-2 rounded-xl border px-3 py-2.5 text-sm font-semibold"
|
||||
className="animate-fade-in-up flex items-center gap-2 p-3 rounded-lg text-sm font-semibold"
|
||||
style={{
|
||||
background:
|
||||
backgroundColor:
|
||||
"color-mix(in srgb, var(--color-primary) 12%, transparent)",
|
||||
color: "var(--color-primary-readable, var(--color-primary))",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 26%, transparent)",
|
||||
border:
|
||||
"1px solid color-mix(in srgb, var(--color-primary) 22%, transparent)",
|
||||
}}
|
||||
>
|
||||
{t("invitedBy", { username: referralCode })}
|
||||
@@ -212,24 +214,7 @@ export function RegisterForm({
|
||||
|
||||
{/* Username & Email */}
|
||||
<div className="space-y-2">
|
||||
<div className="flex items-center gap-2.5">
|
||||
<span
|
||||
aria-hidden="true"
|
||||
className="flex h-7 w-7 shrink-0 items-center justify-center rounded-lg"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 12%, transparent)",
|
||||
boxShadow:
|
||||
"inset 0 0 0 1px color-mix(in srgb, var(--color-primary) 22%, transparent)",
|
||||
}}
|
||||
>
|
||||
<UserRound
|
||||
className="h-3.5 w-3.5"
|
||||
style={{
|
||||
color: "var(--color-primary-readable, var(--color-primary))",
|
||||
}}
|
||||
/>
|
||||
</span>
|
||||
<div className="flex items-center gap-2">
|
||||
<span
|
||||
className="text-[11px] font-black uppercase tracking-widest"
|
||||
style={{
|
||||
@@ -245,75 +230,61 @@ export function RegisterForm({
|
||||
"linear-gradient(90deg, color-mix(in srgb, var(--color-text-muted) 18%, transparent), transparent)",
|
||||
}}
|
||||
/>
|
||||
<span aria-hidden="true" className="number-mark text-lg">
|
||||
01
|
||||
</span>
|
||||
</div>
|
||||
<div className="grid grid-cols-1 md:grid-cols-2 gap-4 stagger-children">
|
||||
<div className="space-y-1.5">
|
||||
<label htmlFor="username" className="auth-label">
|
||||
<label
|
||||
htmlFor="username"
|
||||
className="block text-xs font-bold uppercase tracking-wider"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{t("username")}
|
||||
</label>
|
||||
<div className="relative">
|
||||
<UserRound
|
||||
aria-hidden="true"
|
||||
className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
/>
|
||||
<input
|
||||
id="username"
|
||||
name="username"
|
||||
type="text"
|
||||
placeholder={t("usernamePlaceholder")}
|
||||
autoComplete="username"
|
||||
className="auth-input has-icon"
|
||||
required
|
||||
/>
|
||||
</div>
|
||||
<input
|
||||
id="username"
|
||||
name="username"
|
||||
type="text"
|
||||
placeholder={t("usernamePlaceholder")}
|
||||
autoComplete="username"
|
||||
className="input-glow w-full rounded-xl border-2 px-4 py-3 text-sm font-medium transition-all focus:outline-none"
|
||||
style={{
|
||||
backgroundColor: "var(--color-background)",
|
||||
color: "var(--color-text-readable)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-text-muted) 25%, transparent)",
|
||||
}}
|
||||
required
|
||||
/>
|
||||
</div>
|
||||
<div className="space-y-1.5">
|
||||
<label htmlFor="mail" className="auth-label">
|
||||
<label
|
||||
htmlFor="mail"
|
||||
className="block text-xs font-bold uppercase tracking-wider"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{t("email")}
|
||||
</label>
|
||||
<div className="relative">
|
||||
<Mail
|
||||
aria-hidden="true"
|
||||
className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
/>
|
||||
<input
|
||||
id="mail"
|
||||
name="mail"
|
||||
type="email"
|
||||
placeholder={t("emailPlaceholder")}
|
||||
autoComplete="email"
|
||||
className="auth-input has-icon"
|
||||
/>
|
||||
</div>
|
||||
<input
|
||||
id="mail"
|
||||
name="mail"
|
||||
type="email"
|
||||
placeholder={t("emailPlaceholder")}
|
||||
autoComplete="email"
|
||||
className="input-glow w-full rounded-xl border-2 px-4 py-3 text-sm font-medium transition-all focus:outline-none"
|
||||
style={{
|
||||
backgroundColor: "var(--color-background)",
|
||||
color: "var(--color-text-readable)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-text-muted) 25%, transparent)",
|
||||
}}
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{/* Password & Confirm */}
|
||||
<div className="space-y-2">
|
||||
<div className="flex items-center gap-2.5">
|
||||
<span
|
||||
aria-hidden="true"
|
||||
className="flex h-7 w-7 shrink-0 items-center justify-center rounded-lg"
|
||||
style={{
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 12%, transparent)",
|
||||
boxShadow:
|
||||
"inset 0 0 0 1px color-mix(in srgb, var(--color-primary) 22%, transparent)",
|
||||
}}
|
||||
>
|
||||
<KeyRound
|
||||
className="h-3.5 w-3.5"
|
||||
style={{
|
||||
color: "var(--color-primary-readable, var(--color-primary))",
|
||||
}}
|
||||
/>
|
||||
</span>
|
||||
<div className="flex items-center gap-2">
|
||||
<span
|
||||
className="text-[11px] font-black uppercase tracking-widest"
|
||||
style={{
|
||||
@@ -329,21 +300,17 @@ export function RegisterForm({
|
||||
"linear-gradient(90deg, color-mix(in srgb, var(--color-text-muted) 18%, transparent), transparent)",
|
||||
}}
|
||||
/>
|
||||
<span aria-hidden="true" className="number-mark text-lg">
|
||||
02
|
||||
</span>
|
||||
</div>
|
||||
<div className="grid grid-cols-1 md:grid-cols-2 gap-4 stagger-children">
|
||||
<div className="space-y-1.5">
|
||||
<label htmlFor="password" className="auth-label">
|
||||
<label
|
||||
htmlFor="password"
|
||||
className="block text-xs font-bold uppercase tracking-wider"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{t("password")}
|
||||
</label>
|
||||
<div className="relative">
|
||||
<Lock
|
||||
aria-hidden="true"
|
||||
className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
/>
|
||||
<input
|
||||
id="password"
|
||||
name="password"
|
||||
@@ -352,19 +319,28 @@ export function RegisterForm({
|
||||
autoComplete="new-password"
|
||||
value={password}
|
||||
onChange={(e) => setPassword(e.target.value)}
|
||||
className="auth-input has-icon has-action"
|
||||
className="input-glow w-full rounded-xl border-2 px-4 py-3 text-sm font-medium transition-all focus:outline-none"
|
||||
style={{
|
||||
backgroundColor: "var(--color-background)",
|
||||
color: "var(--color-text-readable)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-text-muted) 25%, transparent)",
|
||||
}}
|
||||
required
|
||||
/>
|
||||
<PasswordToggle
|
||||
show={showPassword}
|
||||
onToggle={() => setShowPassword((v) => !v)}
|
||||
labelShow={t("showPassword")}
|
||||
labelHide={t("hidePassword")}
|
||||
/>
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setShowPassword(!showPassword)}
|
||||
className="absolute right-3 top-1/2 -translate-y-1/2 text-sm font-bold opacity-60 hover:opacity-100 transition-opacity"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
tabIndex={-1}
|
||||
>
|
||||
{showPassword ? t("hidePassword") : t("showPassword")}
|
||||
</button>
|
||||
</div>
|
||||
{password.length > 0 && (
|
||||
<div className="animate-fade-in-up space-y-1.5 pt-0.5">
|
||||
<div className="flex gap-1.5">
|
||||
<div className="animate-fade-in-up space-y-1">
|
||||
<div className="flex gap-1">
|
||||
{[1, 2, 3, 4, 5].map((i) => (
|
||||
<div
|
||||
key={i}
|
||||
@@ -373,87 +349,54 @@ export function RegisterForm({
|
||||
backgroundColor:
|
||||
i <= strength.score
|
||||
? strength.color
|
||||
: "color-mix(in srgb, var(--color-text-muted) 18%, transparent)",
|
||||
boxShadow:
|
||||
i <= strength.score
|
||||
? `0 0 8px color-mix(in srgb, ${strength.color} 45%, transparent)`
|
||||
: undefined,
|
||||
: "color-mix(in srgb, var(--color-text-muted) 15%, transparent)",
|
||||
}}
|
||||
/>
|
||||
))}
|
||||
</div>
|
||||
<div className="flex items-center gap-1.5">
|
||||
<ShieldCheck
|
||||
aria-hidden="true"
|
||||
className="h-3.5 w-3.5 shrink-0"
|
||||
style={{ color: strength.color }}
|
||||
/>
|
||||
<p
|
||||
className="text-[11px] font-extrabold uppercase tracking-wider"
|
||||
style={{ color: strength.color }}
|
||||
>
|
||||
{strength.label}
|
||||
</p>
|
||||
</div>
|
||||
<p
|
||||
className="text-xs font-bold"
|
||||
style={{ color: strength.color }}
|
||||
>
|
||||
{strength.label}
|
||||
</p>
|
||||
</div>
|
||||
)}
|
||||
<ul aria-label={t("password")} className="space-y-1 pt-1">
|
||||
{requirements.map((r) => (
|
||||
<li
|
||||
key={r.label}
|
||||
className="flex items-center gap-1.5 text-[11px] font-semibold transition-colors duration-200"
|
||||
style={{
|
||||
color: r.met
|
||||
? "var(--color-success)"
|
||||
: "var(--color-text-muted)",
|
||||
}}
|
||||
>
|
||||
{r.met ? (
|
||||
<Check className="h-3 w-3 shrink-0" aria-hidden="true" />
|
||||
) : (
|
||||
<X className="h-3 w-3 shrink-0" aria-hidden="true" />
|
||||
)}
|
||||
{r.label}
|
||||
</li>
|
||||
))}
|
||||
</ul>
|
||||
</div>
|
||||
<div className="space-y-1.5">
|
||||
<label htmlFor="password_confirmation" className="auth-label">
|
||||
<label
|
||||
htmlFor="password_confirmation"
|
||||
className="block text-xs font-bold uppercase tracking-wider"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
>
|
||||
{t("confirmPassword")}
|
||||
</label>
|
||||
<div className="relative">
|
||||
<Lock
|
||||
aria-hidden="true"
|
||||
className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
/>
|
||||
<input
|
||||
id="password_confirmation"
|
||||
name="password_confirmation"
|
||||
type={showConfirm ? "text" : "password"}
|
||||
placeholder={t("confirmPasswordPlaceholder")}
|
||||
autoComplete="new-password"
|
||||
value={confirmPassword}
|
||||
onChange={(e) => setConfirmPassword(e.target.value)}
|
||||
className="auth-input has-icon has-action"
|
||||
className="input-glow w-full rounded-xl border-2 px-4 py-3 text-sm font-medium transition-all focus:outline-none"
|
||||
style={{
|
||||
backgroundColor: "var(--color-background)",
|
||||
color: "var(--color-text-readable)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-text-muted) 25%, transparent)",
|
||||
}}
|
||||
required
|
||||
/>
|
||||
<PasswordToggle
|
||||
show={showConfirm}
|
||||
onToggle={() => setShowConfirm((v) => !v)}
|
||||
labelShow={t("showPassword")}
|
||||
labelHide={t("hidePassword")}
|
||||
/>
|
||||
</div>
|
||||
{mismatch && (
|
||||
<p
|
||||
className="animate-fade-in-up text-xs font-bold"
|
||||
style={{ color: "var(--color-danger)" }}
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setShowConfirm(!showConfirm)}
|
||||
className="absolute right-3 top-1/2 -translate-y-1/2 text-sm font-bold opacity-60 hover:opacity-100 transition-opacity"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
tabIndex={-1}
|
||||
>
|
||||
{t("passwordsDontMatch")}
|
||||
</p>
|
||||
)}
|
||||
{showConfirm ? t("hidePassword") : t("showPassword")}
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
@@ -580,11 +523,8 @@ export function RegisterForm({
|
||||
<button
|
||||
type="submit"
|
||||
disabled={isPending || signingIn}
|
||||
onClick={(e) => {
|
||||
onClick={() => {
|
||||
if (!termsAccepted) {
|
||||
// Don't fire a doomed server round-trip: shake the
|
||||
// terms box and stay put until it is checked.
|
||||
e.preventDefault();
|
||||
setTermsError(true);
|
||||
termsRef.current?.scrollIntoView({
|
||||
behavior: "smooth",
|
||||
@@ -592,13 +532,15 @@ export function RegisterForm({
|
||||
});
|
||||
}
|
||||
}}
|
||||
className={`btn-brand btn-shine w-full py-3.5 text-sm font-extrabold uppercase tracking-wider disabled:opacity-60 ${
|
||||
termsAccepted ? "" : "opacity-70 saturate-[0.85]"
|
||||
className={`btn-shine w-full rounded-xl font-extrabold text-sm py-3.5 transition-all duration-200 hover:scale-[1.02] active:scale-95 shadow-lg disabled:opacity-60 ${
|
||||
termsAccepted ? "" : "opacity-70 saturate-[0.85] hover:scale-100"
|
||||
}`}
|
||||
style={{
|
||||
background: "var(--color-primary)",
|
||||
color: "var(--color-primary-foreground)",
|
||||
boxShadow: termsAccepted
|
||||
? undefined
|
||||
: "0 4px 14px -8px color-mix(in srgb, var(--color-primary) 50%, transparent)",
|
||||
? "0 4px 24px color-mix(in srgb, var(--color-primary) 35%, transparent)"
|
||||
: "0 2px 10px color-mix(in srgb, var(--color-primary) 12%, transparent)",
|
||||
}}
|
||||
>
|
||||
{isPending || signingIn ? (
|
||||
@@ -631,25 +573,14 @@ export function RegisterForm({
|
||||
)}
|
||||
</button>
|
||||
|
||||
<div
|
||||
className="border-t pt-4 text-center"
|
||||
style={{
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-text-muted) 14%, transparent)",
|
||||
}}
|
||||
>
|
||||
<div className="text-center">
|
||||
<Link
|
||||
href="/login"
|
||||
className="inline-flex items-center gap-2 rounded-full border px-5 py-2.5 text-xs font-extrabold transition-all duration-200 hover:-translate-y-0.5"
|
||||
className="text-sm font-bold hover:underline transition-all"
|
||||
style={{
|
||||
color: "var(--color-primary)",
|
||||
background:
|
||||
"color-mix(in srgb, var(--color-primary) 8%, transparent)",
|
||||
borderColor:
|
||||
"color-mix(in srgb, var(--color-primary) 35%, transparent)",
|
||||
color: "var(--color-primary-readable, var(--color-primary))",
|
||||
}}
|
||||
>
|
||||
<UserRound aria-hidden="true" className="h-3.5 w-3.5" />
|
||||
{t("alreadyHaveAccount")}
|
||||
</Link>
|
||||
</div>
|
||||
|
||||
@@ -1,99 +0,0 @@
|
||||
"use client";
|
||||
|
||||
import { Mail } from "lucide-react";
|
||||
import { useTranslations } from "next-intl";
|
||||
import { useActionState, useId } from "react";
|
||||
import {
|
||||
type ResendVerificationState,
|
||||
resendVerification,
|
||||
} from "@/actions/verify";
|
||||
|
||||
const INITIAL_STATE: ResendVerificationState = { ok: false, error: null };
|
||||
|
||||
/**
|
||||
* Lets a visitor whose verification token expired or was mangled request a
|
||||
* fresh mail straight from the invalid card of /verify. The server answers
|
||||
* identically for unknown addresses, so no registered address can be probed;
|
||||
* the live feedback is limited to "we tried" vs "throttled".
|
||||
*/
|
||||
export function ResendVerificationForm() {
|
||||
const t = useTranslations("pages.verify");
|
||||
const fieldId = useId();
|
||||
const [state, formAction, isPending] = useActionState(
|
||||
resendVerification,
|
||||
INITIAL_STATE,
|
||||
);
|
||||
|
||||
return (
|
||||
<form action={formAction} className="mt-1 w-full space-y-2 text-left">
|
||||
{state.ok ? (
|
||||
<p
|
||||
role="status"
|
||||
className="auth-alert auth-alert--success m-0 animate-fade-in-up"
|
||||
>
|
||||
{t("resendSent")}
|
||||
</p>
|
||||
) : state.error ? (
|
||||
<p role="alert" className="auth-alert m-0 animate-fade-in-up">
|
||||
{t("resendFailed")}
|
||||
</p>
|
||||
) : null}
|
||||
|
||||
<label htmlFor={fieldId} className="auth-label">
|
||||
{t("resendEmail")}
|
||||
</label>
|
||||
<div className="flex flex-col gap-2 sm:flex-row">
|
||||
<div className="relative flex-1">
|
||||
<Mail
|
||||
aria-hidden="true"
|
||||
className="pointer-events-none absolute left-3.5 top-1/2 h-4 w-4 -translate-y-1/2"
|
||||
style={{ color: "var(--color-text-muted)" }}
|
||||
/>
|
||||
<input
|
||||
id={fieldId}
|
||||
name="email"
|
||||
type="email"
|
||||
required
|
||||
autoComplete="email"
|
||||
placeholder={t("resendEmail")}
|
||||
className="auth-input has-icon"
|
||||
/>
|
||||
</div>
|
||||
<button
|
||||
type="submit"
|
||||
disabled={isPending}
|
||||
className="btn-brand btn-shine mb-0.5 shrink-0 px-5 py-3 text-sm font-extrabold uppercase tracking-wider disabled:opacity-60"
|
||||
>
|
||||
{isPending ? (
|
||||
<span className="inline-flex items-center justify-center gap-2">
|
||||
<svg
|
||||
className="animate-spin h-4 w-4"
|
||||
viewBox="0 0 24 24"
|
||||
fill="none"
|
||||
role="img"
|
||||
aria-label="Loading"
|
||||
>
|
||||
<circle
|
||||
className="opacity-25"
|
||||
cx="12"
|
||||
cy="12"
|
||||
r="10"
|
||||
stroke="currentColor"
|
||||
strokeWidth="4"
|
||||
/>
|
||||
<path
|
||||
className="opacity-75"
|
||||
fill="currentColor"
|
||||
d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"
|
||||
/>
|
||||
</svg>
|
||||
{t("resendButton")}
|
||||
</span>
|
||||
) : (
|
||||
t("resendButton")
|
||||
)}
|
||||
</button>
|
||||
</div>
|
||||
</form>
|
||||
);
|
||||
}
|
||||
@@ -4,17 +4,17 @@ import { describe, expect, it } from "vitest";
|
||||
|
||||
const compactCallSites = new Map<string, number>([
|
||||
["src/components/top-header.tsx", 1],
|
||||
// /login and /register render their rosters through this shared frame.
|
||||
["src/components/auth/auth-page-frame.tsx", 1],
|
||||
["src/app/(site)/friends/page.tsx", 1],
|
||||
["src/app/(site)/guilds/[id]/page.tsx", 1],
|
||||
["src/app/(site)/leaderboard/page.tsx", 1],
|
||||
["src/app/(site)/login/page.tsx", 2],
|
||||
["src/app/(site)/me/page.tsx", 1],
|
||||
["src/app/(site)/messages/page.tsx", 2],
|
||||
["src/app/(site)/page.tsx", 2],
|
||||
["src/app/(site)/radio/leaderboard/page.tsx", 1],
|
||||
["src/app/(site)/radio/shouts/page.tsx", 1],
|
||||
["src/app/(site)/rankings/page.tsx", 1],
|
||||
["src/app/(site)/register/page.tsx", 2],
|
||||
["src/app/(site)/search/page.tsx", 1],
|
||||
["src/app/(site)/u/[username]/page.tsx", 2],
|
||||
]);
|
||||
|
||||
@@ -1,39 +0,0 @@
|
||||
"use client";
|
||||
|
||||
import type { CSSProperties, MouseEvent, ReactNode } from "react";
|
||||
|
||||
interface SpotlightCardProps {
|
||||
children: ReactNode;
|
||||
className?: string;
|
||||
style?: CSSProperties;
|
||||
}
|
||||
|
||||
/**
|
||||
* Wraps a card with a mouse-tracking radial glow. The pointer position is
|
||||
* written to `--spot-x` / `--spot-y` and consumed by the `.spotlight::before`
|
||||
* overlay in globals.css.
|
||||
*/
|
||||
export function SpotlightCard({
|
||||
children,
|
||||
className,
|
||||
style,
|
||||
}: SpotlightCardProps) {
|
||||
const handlePointerMove = (event: MouseEvent<HTMLDivElement>) => {
|
||||
const el = event.currentTarget;
|
||||
const rect = el.getBoundingClientRect();
|
||||
el.style.setProperty("--spot-x", `${event.clientX - rect.left}px`);
|
||||
el.style.setProperty("--spot-y", `${event.clientY - rect.top}px`);
|
||||
};
|
||||
|
||||
return (
|
||||
<div
|
||||
className={className}
|
||||
style={
|
||||
{ "--spot-x": "50%", "--spot-y": "50%", ...style } as CSSProperties
|
||||
}
|
||||
onPointerMove={handlePointerMove}
|
||||
>
|
||||
{children}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -16,15 +16,6 @@ export function TypewriterText({
|
||||
useEffect(() => {
|
||||
setDisplayed(text[0] ?? "");
|
||||
setDone(text.length <= 1);
|
||||
|
||||
// Respect "reduce motion": show the full text instead of animating the
|
||||
// letters in, since the blinking cursor is pure CSS-driven decoration.
|
||||
if (window.matchMedia("(prefers-reduced-motion: reduce)").matches) {
|
||||
setDisplayed(text);
|
||||
setDone(true);
|
||||
return;
|
||||
}
|
||||
|
||||
let i = 1;
|
||||
const id = setInterval(() => {
|
||||
if (i < text.length) {
|
||||
|
||||
+82
@@ -148,6 +148,80 @@ const schema = z
|
||||
.string()
|
||||
.optional()
|
||||
.transform((value) => value !== "false" && value !== "0"),
|
||||
// CrowdSec API — optional. When the CTI API key is set, the anti-DDoS
|
||||
// gate consults the community reputation of repeat offenders (CTI
|
||||
// GET /smoke/{ip}) and hard-blocks known-bad IPs immediately. Like the
|
||||
// Cloudflare token, the key lives in env only and is never written into
|
||||
// the admin-visible config. Free/community key: app.crowdsec.net →
|
||||
// Settings → CTI API Keys.
|
||||
CROWDSEC_API_KEY: z.string().optional(),
|
||||
// Reputation lookup (CTI) endpoint; overridden for tests/staging.
|
||||
CROWDSEC_CTI_BASE_URL: z
|
||||
.string()
|
||||
.url()
|
||||
.default("https://cti.api.crowdsec.net/v2"),
|
||||
// Boot default for the runtime "auto-block from CrowdSec reputation"
|
||||
// toggle (overridable via the admin panel / antiddos:config).
|
||||
CROWDSEC_AUTO_BLOCK_ENABLED: z
|
||||
.string()
|
||||
.optional()
|
||||
.transform((value) => value !== "false" && value !== "0"),
|
||||
// Minimum malevolence score (CrowdSec scores are 0-5; 4-5 maps to
|
||||
// "malicious") an IP must reach before the gate treats it as known-bad.
|
||||
// An IP the community already labels "malicious" is always blocked,
|
||||
// unless it carries false-positive classification tags.
|
||||
CROWDSEC_BLOCK_SCORE: z.coerce.number().int().min(0).max(5).default(4),
|
||||
// How long a CrowdSec-confirmed bad IP stays blocked by the gate.
|
||||
CROWDSEC_BLOCK_TTL_SECONDS: z.coerce
|
||||
.number()
|
||||
.int()
|
||||
.positive()
|
||||
.default(86_400),
|
||||
// Daily CTI enrichment quota guard (freemium plan ≈ 10k lookups/day).
|
||||
// The gate stops consulting the API once the counter for today exceeds
|
||||
// it, so a spread DDoS can never silently burn the whole quota; 0
|
||||
// disables the guard.
|
||||
CROWDSEC_CTI_DAILY_QUOTA: z.coerce.number().int().min(0).default(10_000),
|
||||
// How many new community-reputation blocks within a 5-minute window
|
||||
// justify an ops alert (cooldown-gated via HEALTH_ALERT_COOLDOWN_MIN).
|
||||
CROWDSEC_ALERT_BLOCK_BURST: z.coerce.number().int().min(1).default(10),
|
||||
// Share our own detections back into the CrowdSec community blocklist
|
||||
// (signal push over the Central API). Opt-in: flipping this on publicly
|
||||
// shares blocked IPs + behaviors, so it defaults to off.
|
||||
CROWDSEC_REPORT_ENABLED: z
|
||||
.string()
|
||||
.optional()
|
||||
.transform((value) => value === "true" || value === "1"),
|
||||
// Central API (CAPI) base endpoint; overridden for tests/staging.
|
||||
CROWDSEC_CAPI_BASE_URL: z
|
||||
.string()
|
||||
.url()
|
||||
.default("https://api.crowdsec.net/v3"),
|
||||
// Local CrowdSec engine shipped as an opt-in Docker stack in
|
||||
// deployment/crowdsec. When enabled, the anti-DDoS gate asks the local
|
||||
// LAPI (bouncer) for each client IP before its own buckets and blocks
|
||||
// ban/captcha decisions immediately. The key lives in env only.
|
||||
CROWDSEC_LOCAL_ENABLED: z
|
||||
.string()
|
||||
.optional()
|
||||
.transform((value) => value === "true" || value === "1"),
|
||||
CROWDSEC_LAPI_URL: z
|
||||
.string()
|
||||
.optional()
|
||||
.transform((value) =>
|
||||
value?.trim() ? value.trim() : "http://127.0.0.1:18080",
|
||||
)
|
||||
.pipe(z.string().url()),
|
||||
CROWDSEC_LAPI_API_KEY: z.string().optional(),
|
||||
CROWDSEC_LAPI_TIMEOUT_MS: z.coerce.number().int().positive().default(500),
|
||||
// Watcher credentials for signal push. When omitted, a stable pair is
|
||||
// generated once and persisted in Redis (48-char alnum machine id,
|
||||
// per the CAPI schema).
|
||||
CROWDSEC_REPORT_MACHINE_ID: z.string().optional(),
|
||||
CROWDSEC_REPORT_PASSWORD: z.string().optional(),
|
||||
// Optional attachment key from the CrowdSec Console — links our
|
||||
// watcher to your account so pushed signals show up there.
|
||||
CROWDSEC_REPORT_ENROLL_KEY: z.string().optional(),
|
||||
})
|
||||
.superRefine((data, ctx) => {
|
||||
if (data.NODE_ENV !== "production") return;
|
||||
@@ -175,6 +249,14 @@ const schema = z
|
||||
path: ["PAYPAL_CLIENT_ID"],
|
||||
});
|
||||
}
|
||||
if (data.CROWDSEC_LOCAL_ENABLED && !data.CROWDSEC_LAPI_API_KEY) {
|
||||
ctx.addIssue({
|
||||
code: "custom",
|
||||
message:
|
||||
"CROWDSEC_LAPI_API_KEY is required when CROWDSEC_LOCAL_ENABLED=true",
|
||||
path: ["CROWDSEC_LAPI_API_KEY"],
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
type Env = z.infer<typeof schema>;
|
||||
|
||||
@@ -49,8 +49,7 @@ export function CatalogSearch({
|
||||
const destinationRequest = useRef(0);
|
||||
const destinationBusy = useRef(false);
|
||||
const [refreshKey, setRefreshKey] = useState(0);
|
||||
// Catalog switches invalidate the selection and destination requests.
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: a catalog switch is exactly what should reset this
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: Catalog switches invalidate the selection and destination requests.
|
||||
useEffect(() => {
|
||||
destinationRequest.current += 1;
|
||||
destinationBusy.current = false;
|
||||
@@ -101,7 +100,7 @@ export function CatalogSearch({
|
||||
});
|
||||
if (!pages) void loadDestinations();
|
||||
}
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: refreshKey re-runs the query after a bulk edit
|
||||
// biome-ignore lint/correctness/useExhaustiveDependencies: Successful bulk edits must refresh unchanged search queries.
|
||||
useEffect(() => {
|
||||
const request = requests.start();
|
||||
setResults([]);
|
||||
@@ -132,8 +131,6 @@ export function CatalogSearch({
|
||||
clearTimeout(timer);
|
||||
requests.cancel();
|
||||
};
|
||||
// refreshKey re-runs the query after a bulk edit changed rows that this
|
||||
// search would otherwise keep showing as stale.
|
||||
}, [query, catalogType, requests, refreshKey]);
|
||||
return (
|
||||
<section
|
||||
|
||||
@@ -217,9 +217,8 @@ function readFlatFromMemory(
|
||||
}
|
||||
const pageMap = new Map(rows.map((row) => [toInt(row.id), row]));
|
||||
const depths = new Map<number, number>();
|
||||
const visitingGlobal = new Set<number>();
|
||||
|
||||
function depth(id: number, visiting = visitingGlobal): number {
|
||||
function depth(id: number, visiting = new Set<number>()): number {
|
||||
const cached = depths.get(id);
|
||||
if (cached !== undefined) return cached;
|
||||
// Messy imports can leave a parent chain looping; stop rather than recurse.
|
||||
|
||||
@@ -266,7 +266,7 @@ function scanModuleAccesses(source: string): ModuleAccessScan {
|
||||
} else if (value.type === "ImportExpression") {
|
||||
recordArgument(value.source, "import");
|
||||
} else if (value.type === "TSImportType") {
|
||||
recordArgument(value.source ?? value.argument, "import");
|
||||
recordArgument(value.argument, "import");
|
||||
} else if (
|
||||
value.type === "CallExpression" ||
|
||||
value.type === "OptionalCallExpression"
|
||||
|
||||
@@ -255,7 +255,7 @@ function scanModuleAccesses(source: string): ModuleAccessScan {
|
||||
} else if (value.type === "ImportExpression") {
|
||||
recordArgument(value.source, "import");
|
||||
} else if (value.type === "TSImportType") {
|
||||
recordArgument(value.source ?? value.argument, "import");
|
||||
recordArgument(value.argument, "import");
|
||||
} else if (
|
||||
value.type === "CallExpression" ||
|
||||
value.type === "OptionalCallExpression"
|
||||
|
||||
@@ -1,174 +0,0 @@
|
||||
import { readdirSync } from "node:fs";
|
||||
import { createTranslator } from "next-intl";
|
||||
import { describe, expect, it } from "vitest";
|
||||
import ar from "@/messages/ar.json";
|
||||
import bg from "@/messages/bg.json";
|
||||
import cs from "@/messages/cs.json";
|
||||
import da from "@/messages/da.json";
|
||||
import de from "@/messages/de.json";
|
||||
import el from "@/messages/el.json";
|
||||
import en from "@/messages/en.json";
|
||||
import es from "@/messages/es.json";
|
||||
import fi from "@/messages/fi.json";
|
||||
import fr from "@/messages/fr.json";
|
||||
import hr from "@/messages/hr.json";
|
||||
import hu from "@/messages/hu.json";
|
||||
import itMessages from "@/messages/it.json";
|
||||
import ja from "@/messages/ja.json";
|
||||
import nl from "@/messages/nl.json";
|
||||
import no from "@/messages/no.json";
|
||||
import pl from "@/messages/pl.json";
|
||||
import pt from "@/messages/pt.json";
|
||||
import ro from "@/messages/ro.json";
|
||||
import ru from "@/messages/ru.json";
|
||||
import sk from "@/messages/sk.json";
|
||||
import sr from "@/messages/sr.json";
|
||||
import sv from "@/messages/sv.json";
|
||||
import tr from "@/messages/tr.json";
|
||||
import uk from "@/messages/uk.json";
|
||||
|
||||
/**
|
||||
* Every failure reason the register action can report is a `RegisterErrorCode`,
|
||||
* which the form renders as `pages.register.<code>`. If a code ships without a
|
||||
* translation the visitor silently sees the raw English fallback, so this test
|
||||
* locks the contract in both directions: the union of codes must match the
|
||||
* dictionary, and every locale must carry every key.
|
||||
*/
|
||||
|
||||
type RegisterErrorCode =
|
||||
| "usernameMinLength"
|
||||
| "usernameMaxLength"
|
||||
| "usernamePattern"
|
||||
| "usernameReserved"
|
||||
| "usernameTaken"
|
||||
| "emailValid"
|
||||
| "emailDisposable"
|
||||
| "passwordMinLength"
|
||||
| "passwordMaxLength"
|
||||
| "passwordUpper"
|
||||
| "passwordLower"
|
||||
| "passwordDigit"
|
||||
| "passwordSpecial"
|
||||
| "passwordsMatch"
|
||||
| "termsRequired"
|
||||
| "captchaFailed"
|
||||
| "rateLimited"
|
||||
| "vpnBlocked"
|
||||
| "maxAccountsPerIp"
|
||||
| "unavailable"
|
||||
| "createFailed"
|
||||
| "invalidInput";
|
||||
|
||||
/** Mirrors `RegisterErrorCode` in src/actions/register.ts. */
|
||||
const REGISTER_ERROR_CODES: readonly RegisterErrorCode[] = [
|
||||
"usernameMinLength",
|
||||
"usernameMaxLength",
|
||||
"usernamePattern",
|
||||
"usernameReserved",
|
||||
"usernameTaken",
|
||||
"emailValid",
|
||||
"emailDisposable",
|
||||
"passwordMinLength",
|
||||
"passwordMaxLength",
|
||||
"passwordUpper",
|
||||
"passwordLower",
|
||||
"passwordDigit",
|
||||
"passwordSpecial",
|
||||
"passwordsMatch",
|
||||
"termsRequired",
|
||||
"captchaFailed",
|
||||
"rateLimited",
|
||||
"vpnBlocked",
|
||||
"maxAccountsPerIp",
|
||||
"unavailable",
|
||||
"createFailed",
|
||||
"invalidInput",
|
||||
];
|
||||
|
||||
const MESSAGES: Record<string, typeof en> = {
|
||||
ar,
|
||||
bg,
|
||||
cs,
|
||||
da,
|
||||
de,
|
||||
el,
|
||||
en,
|
||||
es,
|
||||
fi,
|
||||
fr,
|
||||
hr,
|
||||
hu,
|
||||
it: itMessages as unknown as typeof en,
|
||||
ja,
|
||||
nl: nl as unknown as typeof en,
|
||||
no,
|
||||
pl,
|
||||
pt,
|
||||
ro,
|
||||
ru,
|
||||
sk,
|
||||
sr,
|
||||
sv,
|
||||
tr,
|
||||
uk,
|
||||
};
|
||||
|
||||
const locales = readdirSync("src/messages")
|
||||
.filter((file) => file.endsWith(".json"))
|
||||
.map((file) => file.replace(/\.json$/, ""))
|
||||
.sort();
|
||||
|
||||
const namespaces = ["pages.register", "pages.login", "pages.reset"] as const;
|
||||
|
||||
describe("auth page messages", () => {
|
||||
it("exposes every register error code as a translated message", () => {
|
||||
const t = createTranslator({
|
||||
locale: "en",
|
||||
messages: en,
|
||||
namespace: "pages.register",
|
||||
});
|
||||
for (const code of REGISTER_ERROR_CODES) {
|
||||
expect(t.has(code as never), code).toBe(true);
|
||||
expect(t(code as never), code).not.toBe("");
|
||||
}
|
||||
});
|
||||
|
||||
it("keeps the dictionary free of unreachable register error keys", () => {
|
||||
const known = new Set<string>(REGISTER_ERROR_CODES);
|
||||
for (const key of Object.keys(en.pages.register)) {
|
||||
// Keys that map a code onto its canonical sentence must stay in sync.
|
||||
if (key === "passwordMinLength") continue;
|
||||
expect(known.has(key) || !/^[a-z][A-Z]/.test(key), key).toBe(true);
|
||||
}
|
||||
expect(en.pages.register.passwordError).toBe(
|
||||
en.pages.register.passwordMinLength,
|
||||
);
|
||||
});
|
||||
|
||||
it("ships a dictionary for every locale on disk", () => {
|
||||
expect(Object.keys(MESSAGES).sort()).toEqual(locales);
|
||||
});
|
||||
|
||||
it.each(locales)("provides every auth message in %s", (locale) => {
|
||||
const messages = MESSAGES[locale];
|
||||
expect(messages, locale).toBeDefined();
|
||||
for (const namespace of namespaces) {
|
||||
const t = createTranslator({ locale, messages, namespace });
|
||||
const keys =
|
||||
namespace === "pages.register"
|
||||
? REGISTER_ERROR_CODES
|
||||
: namespace === "pages.login"
|
||||
? ([
|
||||
"username",
|
||||
"password",
|
||||
"showPassword",
|
||||
"hidePassword",
|
||||
] as const)
|
||||
: (["passwordMinLength", "tooManyAttempts"] as const);
|
||||
for (const key of keys) {
|
||||
expect(t.has(key as never), `${namespace}.${key}`).toBe(true);
|
||||
expect(t(key as never), `${namespace}.${key}`).not.toBe("");
|
||||
}
|
||||
}
|
||||
});
|
||||
});
|
||||
@@ -24,6 +24,11 @@ export interface AntiddosConfig {
|
||||
blockTiers: AntiddosBlockTier[];
|
||||
globalHaltMs: number;
|
||||
cloudflareAutoBlock: boolean;
|
||||
crowdsecAutoBlock: boolean;
|
||||
/** Minimum CrowdSec malevolence score (0-5) treated as known-bad. */
|
||||
crowdsecBlockScore: number;
|
||||
/** How long a CrowdSec-confirmed bad IP stays blocked by the gate. */
|
||||
crowdsecBlockTtlSeconds: number;
|
||||
}
|
||||
|
||||
const DEFAULT_CONFIG: AntiddosConfig = {
|
||||
@@ -41,6 +46,9 @@ const DEFAULT_CONFIG: AntiddosConfig = {
|
||||
],
|
||||
globalHaltMs: 10_000,
|
||||
cloudflareAutoBlock: true,
|
||||
crowdsecAutoBlock: true,
|
||||
crowdsecBlockScore: 4,
|
||||
crowdsecBlockTtlSeconds: 86_400,
|
||||
};
|
||||
|
||||
function positiveInt(value: number | undefined, fallback: number): number {
|
||||
@@ -49,6 +57,17 @@ function positiveInt(value: number | undefined, fallback: number): number {
|
||||
return Math.floor(n);
|
||||
}
|
||||
|
||||
function clampInt(
|
||||
value: number | undefined,
|
||||
fallback: number,
|
||||
min: number,
|
||||
max: number,
|
||||
): number {
|
||||
const n = Number(value);
|
||||
if (!Number.isFinite(n)) return fallback;
|
||||
return Math.min(max, Math.max(min, Math.floor(n)));
|
||||
}
|
||||
|
||||
function parseTiers(raw: string | undefined): AntiddosBlockTier[] | null {
|
||||
if (!raw?.trim()) return null;
|
||||
const tiers: AntiddosBlockTier[] = [];
|
||||
@@ -125,6 +144,17 @@ export function antiddosDefaultsFromEnv(): AntiddosConfig {
|
||||
DEFAULT_CONFIG.globalHaltMs,
|
||||
),
|
||||
cloudflareAutoBlock: isTruthyFlag(env.CLOUDFLARE_AUTO_BLOCK_ENABLED),
|
||||
crowdsecAutoBlock: isTruthyFlag(env.CROWDSEC_AUTO_BLOCK_ENABLED),
|
||||
crowdsecBlockScore: clampInt(
|
||||
env.CROWDSEC_BLOCK_SCORE,
|
||||
DEFAULT_CONFIG.crowdsecBlockScore,
|
||||
0,
|
||||
5,
|
||||
),
|
||||
crowdsecBlockTtlSeconds: positiveInt(
|
||||
env.CROWDSEC_BLOCK_TTL_SECONDS,
|
||||
DEFAULT_CONFIG.crowdsecBlockTtlSeconds,
|
||||
),
|
||||
};
|
||||
}
|
||||
|
||||
@@ -167,6 +197,17 @@ function sanitize(config: AntiddosConfig): AntiddosConfig {
|
||||
: base.blockTiers,
|
||||
globalHaltMs: positiveInt(config?.globalHaltMs, base.globalHaltMs),
|
||||
cloudflareAutoBlock: config?.cloudflareAutoBlock !== false,
|
||||
crowdsecAutoBlock: config?.crowdsecAutoBlock !== false,
|
||||
crowdsecBlockScore: clampInt(
|
||||
config?.crowdsecBlockScore,
|
||||
base.crowdsecBlockScore,
|
||||
0,
|
||||
5,
|
||||
),
|
||||
crowdsecBlockTtlSeconds: positiveInt(
|
||||
config?.crowdsecBlockTtlSeconds,
|
||||
base.crowdsecBlockTtlSeconds,
|
||||
),
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
import { safeRedirectPath } from "./safe-redirect";
|
||||
|
||||
describe("safeRedirectPath", () => {
|
||||
it("keeps same-site destinations", () => {
|
||||
expect(safeRedirectPath("/admin/users")).toBe("/admin/users");
|
||||
expect(safeRedirectPath("/me")).toBe("/me");
|
||||
expect(safeRedirectPath("/login?from=%2Fadmin")).toBe(
|
||||
"/login?from=%2Fadmin",
|
||||
);
|
||||
expect(safeRedirectPath("/news/welcome#comments")).toBe(
|
||||
"/news/welcome#comments",
|
||||
);
|
||||
});
|
||||
|
||||
it("refuses cross-origin and non-path destinations", () => {
|
||||
expect(safeRedirectPath("//evil.example")).toBe("/me");
|
||||
expect(safeRedirectPath("/\\evil.example")).toBe("/me");
|
||||
expect(safeRedirectPath("https://evil.example")).toBe("/me");
|
||||
expect(safeRedirectPath("javascript:alert(1)")).toBe("/me");
|
||||
expect(safeRedirectPath("admin")).toBe("/me");
|
||||
});
|
||||
|
||||
it("treats a missing value as the fallback", () => {
|
||||
expect(safeRedirectPath(undefined)).toBe("/me");
|
||||
expect(safeRedirectPath(null)).toBe("/me");
|
||||
expect(safeRedirectPath("")).toBe("/me");
|
||||
expect(safeRedirectPath(undefined, "/admin")).toBe("/admin");
|
||||
});
|
||||
});
|
||||
@@ -1,17 +0,0 @@
|
||||
/**
|
||||
* Validate a post-login destination taken from the query string.
|
||||
*
|
||||
* The value ends up in `window.location.href`, so an unvalidated one turns the
|
||||
* sign-in form into an open redirect. Only same-site absolute paths pass:
|
||||
* `//host` and `/\host` are cross-origin in every browser, and anything without
|
||||
* a leading slash is not a path at all.
|
||||
*/
|
||||
export function safeRedirectPath(
|
||||
raw: string | null | undefined,
|
||||
fallback = "/me",
|
||||
): string {
|
||||
if (!raw) return fallback;
|
||||
if (!raw.startsWith("/")) return fallback;
|
||||
if (raw.startsWith("//") || raw.startsWith("/\\")) return fallback;
|
||||
return raw;
|
||||
}
|
||||
@@ -84,7 +84,7 @@ function snapshot(): Record<string, CacheKeyStats> {
|
||||
}
|
||||
|
||||
async function flush(): Promise<void> {
|
||||
if (process.env.NODE_ENV === "test" || redis?.status !== "ready") return;
|
||||
if (redis?.status !== "ready") return;
|
||||
try {
|
||||
await redis.setex(
|
||||
REDIS_KEY,
|
||||
@@ -127,9 +127,7 @@ export async function readCacheStats(): Promise<CacheStatsReport> {
|
||||
shared = true;
|
||||
}
|
||||
} catch (error) {
|
||||
if (process.env.NODE_ENV !== "test") {
|
||||
logger.warn("[cache] stats unavailable", { error: String(error) });
|
||||
}
|
||||
logger.warn("[cache] stats unavailable", { error: String(error) });
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -78,7 +78,7 @@ describe("cached (memory-only, no Redis)", () => {
|
||||
// key survives even though it was inserted first by a long way.
|
||||
for (let i = 0; i < 2_100; i++) {
|
||||
await cached(hotKey, 60_000, hot);
|
||||
await cached(`churn-${i}`, 60_000, cold);
|
||||
await cached(`churn-${i}-${Math.random()}`, 60_000, cold);
|
||||
}
|
||||
|
||||
expect(hot).toHaveBeenCalledTimes(1);
|
||||
|
||||
+16
-24
@@ -99,10 +99,10 @@ function setMemory(key: string, entry: CacheEntry): void {
|
||||
if (memory.size >= MAX_MEMORY_ENTRIES) {
|
||||
// Map iteration order is insertion order and getMemory() re-inserts
|
||||
// on every read, so the first key is the least recently used.
|
||||
for (const lruKey of memory.keys()) {
|
||||
memory.delete(lruKey);
|
||||
recordCacheOutcome(lruKey, "evicted");
|
||||
break;
|
||||
const lru = memory.keys().next().value;
|
||||
if (lru !== undefined) {
|
||||
memory.delete(lru);
|
||||
recordCacheOutcome(lru, "evicted");
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -128,14 +128,12 @@ function getMemory(key: string): CacheEntry | undefined {
|
||||
return entry;
|
||||
}
|
||||
|
||||
/** Deterministic TTL - no random jitter to prevent unpredictable drops. */
|
||||
/** `setex` with a little jitter so keys written together do not expire together. */
|
||||
function redisTtlSeconds(ttlSec: number): number {
|
||||
return ttlSec;
|
||||
const jitter = Math.min(5, Math.floor(ttlSec * 0.1));
|
||||
return ttlSec + Math.floor(Math.random() * (jitter + 1));
|
||||
}
|
||||
|
||||
// Deduplication: track promised values to prevent double caching/computation
|
||||
const computationPromises = new Map<string, Promise<unknown>>();
|
||||
|
||||
// A wrong REDIS_URL or a Redis outage does not fail visibly: the cache keeps
|
||||
// answering from memory and every instance quietly stops sharing. Say so once.
|
||||
let warnedSharedCacheDown = false;
|
||||
@@ -199,13 +197,6 @@ export async function cached<T>(
|
||||
return (await pending) as T;
|
||||
}
|
||||
|
||||
// Check for existing computation promise to avoid duplicate work
|
||||
const existingPromise = computationPromises.get(key);
|
||||
if (existingPromise) {
|
||||
recordCacheOutcome(key, "miss");
|
||||
return existingPromise as Promise<T>;
|
||||
}
|
||||
|
||||
recordCacheOutcome(key, "miss");
|
||||
return refresh(key, ttlMs, staleMs, fn);
|
||||
}
|
||||
@@ -222,8 +213,8 @@ function refresh<T>(
|
||||
): Promise<T> {
|
||||
const generation = generations.get(key) ?? 0;
|
||||
const compute = (async (): Promise<T> => {
|
||||
// Redis path (shared across instances) - skip during tests for speed/stability
|
||||
if (process.env.NODE_ENV !== "test" && redis && redis.status !== "end") {
|
||||
// Redis path (shared across instances).
|
||||
if (redis && redis.status !== "end") {
|
||||
try {
|
||||
const raw = await redis.get(key);
|
||||
if (raw !== null && raw !== undefined) {
|
||||
@@ -234,7 +225,7 @@ function refresh<T>(
|
||||
} catch {
|
||||
/* fall through to fn */
|
||||
}
|
||||
} else if (process.env.NODE_ENV !== "test") {
|
||||
} else {
|
||||
warnIfSharedCacheDown();
|
||||
}
|
||||
|
||||
@@ -246,10 +237,13 @@ function refresh<T>(
|
||||
// An invalidation landed while `fn()` was running: keep the value out of
|
||||
// the cache so the next read recomputes instead of resurrecting stale data.
|
||||
if ((generations.get(key) ?? 0) === generation) {
|
||||
if (process.env.NODE_ENV !== "test" && redis && redis.status !== "end") {
|
||||
if (redis && redis.status !== "end") {
|
||||
try {
|
||||
const ttlSec = Math.max(1, Math.ceil(ttlMs / 1000));
|
||||
await redis.setex(key, redisTtlSeconds(ttlSec), JSON.stringify(data));
|
||||
await redis.setex(
|
||||
key,
|
||||
redisTtlSeconds(Math.ceil(ttlMs / 1000)),
|
||||
JSON.stringify(data),
|
||||
);
|
||||
} catch {
|
||||
/* non-critical: memory cache still works */
|
||||
}
|
||||
@@ -261,11 +255,9 @@ function refresh<T>(
|
||||
return data;
|
||||
})().finally(() => {
|
||||
inFlight.delete(key);
|
||||
computationPromises.delete(key);
|
||||
});
|
||||
|
||||
inFlight.set(key, compute);
|
||||
computationPromises.set(key, compute);
|
||||
return compute;
|
||||
}
|
||||
|
||||
|
||||
@@ -218,11 +218,6 @@ function simulateBlueGreen(scenario: string, livePort = 3002) {
|
||||
writeFileSync(join(dir, "nginx-site.conf"), "upstream cms_app { }\n");
|
||||
// Het live container-bestand, zodat `docker inspect` hem als draaiend ziet.
|
||||
writeFileSync(join(dir, "epicnext-cms-app"), "old\n");
|
||||
// Een compose-replica uit deze checkout (scenario 'port-taken-compose' of
|
||||
// 'compose-live'); retire_compose_replicas() in het script zoekt hem op bij
|
||||
// zijn container-id en beslist aan zijn PORT of hij live draait.
|
||||
if (scenario === "port-taken-compose" || scenario === "compose-live")
|
||||
writeFileSync(join(dir, "epicnext-cms"), "compose\n");
|
||||
const result = spawnSync(bash, [resolve(root, "scripts/ci-deploy.sh")], {
|
||||
cwd: dir,
|
||||
encoding: "utf8",
|
||||
@@ -304,50 +299,6 @@ describe("blue/green cutover", () => {
|
||||
expect(r.upstream).not.toContain("127.0.0.1:3003");
|
||||
});
|
||||
|
||||
// Regressie: een poort die al in gebruik is liet `docker run` stilletjes op
|
||||
// EADDRINUSE sterven. De health-probe beantwoordde daarna vanaf de
|
||||
// reeds draaiende container op diezelfde poort, waardoor de
|
||||
// release-vergelijking 30 keer op een verkeerde release faalde in plaats
|
||||
// van op de echte oorzaak te wijzen.
|
||||
it("refuses to start the candidate on a port that is already in use", () => {
|
||||
const r = simulateBlueGreen("port-taken");
|
||||
expect(r.status, r.output).not.toBe(0);
|
||||
expect(r.output).toContain("already in use");
|
||||
// Er is geen kandidaat gestart, dus er is ook niets om te verwijderen.
|
||||
expect(r.calls).not.toContain("docker run");
|
||||
// De live release draait ongestoord door en nginx wijst nog steeds
|
||||
// naar de oude poort: geen halve cutover.
|
||||
expect(r.upstream).toContain("127.0.0.1:3002");
|
||||
expect(r.upstream).not.toContain("127.0.0.1:3003");
|
||||
});
|
||||
|
||||
it("removes a compose replica that squats the candidate port and then deploys", () => {
|
||||
// Live op 3003, dus de kandidaat moet op 3002. Een compose-replica uit
|
||||
// deze checkout zit daar al: precies de situatie die de release tegenhield
|
||||
// totdat iemand de container met de hand verwijderde.
|
||||
const r = simulateBlueGreen("port-taken-compose", 3003);
|
||||
expect(r.status, r.output).toBe(0);
|
||||
expect(r.output).toContain(
|
||||
"Removing compose replica epicnext-cms on port 3002",
|
||||
);
|
||||
// Vóór het starten van de kandidaat, anders blijft 3002 bezet.
|
||||
expect(r.calls.indexOf("docker rm -f epicnext-cms\n")).toBeGreaterThan(-1);
|
||||
expect(r.calls.indexOf("docker rm -f epicnext-cms\n")).toBeLessThan(
|
||||
r.calls.indexOf("docker run -d --name epicnext-cms-app"),
|
||||
);
|
||||
expect(r.upstream).toContain("127.0.0.1:3002");
|
||||
});
|
||||
|
||||
it("leaves a compose replica alone when it is the live release", () => {
|
||||
// De replica draait hier op 3003, de poort waar nginx naar wijst. Hoe
|
||||
// onheilijk een compose-container ook is, hij serveert het verkeer en
|
||||
// wordt dus niet weggenomen.
|
||||
const r = simulateBlueGreen("compose-live", 3003);
|
||||
expect(r.status, r.output).toBe(0);
|
||||
expect(r.calls).not.toContain("docker rm -f epicnext-cms\n");
|
||||
expect(r.upstream).toContain("127.0.0.1:3002");
|
||||
});
|
||||
|
||||
it.each([
|
||||
"run-failure",
|
||||
"health-failure",
|
||||
|
||||
@@ -0,0 +1,66 @@
|
||||
import "server-only";
|
||||
|
||||
import { env } from "@/env";
|
||||
import { logger } from "@/lib/logger";
|
||||
import { redis } from "@/lib/redis";
|
||||
import { type SendAlertInput, sendAlert } from "@/lib/services/alert";
|
||||
|
||||
// === CrowdSec operational alerts ===========================================
|
||||
//
|
||||
// Thin, fire-and-forget wrapper around the app's alert service for the
|
||||
// reputation pipeline. Every raise is cooldown-gated through a Redis NX lock
|
||||
// (key crowdsec:alert:{key}, TTL = HEALTH_ALERT_COOLDOWN_MIN), so N instances
|
||||
// and flapping conditions surface exactly one alert per window instead of
|
||||
// spamming Discord/email/alert_logs. Falls back to alerting anyway when Redis
|
||||
// is unreachable — a silent quota blowout is worse than one duplicate alert.
|
||||
|
||||
const ALERT_PREFIX = "crowdsec:alert:";
|
||||
|
||||
function cooldownSeconds(): number {
|
||||
const raw = Number(env.HEALTH_ALERT_COOLDOWN_MIN ?? 15);
|
||||
return Math.ceil((Number.isFinite(raw) && raw > 0 ? raw : 15) * 60);
|
||||
}
|
||||
|
||||
/**
|
||||
* Raise an alert unless the cooldown window is still active. Returns the
|
||||
* sendAlert promise when the alert was actually raised, or false when it was
|
||||
* suppressed. Never throws; the caller may `void` the result on hot paths.
|
||||
*/
|
||||
export async function raiseCrowdsecAlert(
|
||||
key: string,
|
||||
input: {
|
||||
type?: string;
|
||||
severity: SendAlertInput["severity"];
|
||||
message: string;
|
||||
context?: SendAlertInput["context"];
|
||||
},
|
||||
): Promise<false | Awaited<ReturnType<typeof sendAlert>>> {
|
||||
if (redis) {
|
||||
try {
|
||||
const acquired = await redis.set(
|
||||
`${ALERT_PREFIX}${key}`,
|
||||
String(Date.now()),
|
||||
"EX",
|
||||
cooldownSeconds(),
|
||||
"NX",
|
||||
);
|
||||
if (acquired !== "OK") return false;
|
||||
} catch {
|
||||
// Cooldown bookkeeping failed — alert anyway rather than silently drop.
|
||||
}
|
||||
}
|
||||
try {
|
||||
return await sendAlert({
|
||||
type: "ddos",
|
||||
severity: input.severity,
|
||||
message: input.message,
|
||||
context: input.context,
|
||||
});
|
||||
} catch (error) {
|
||||
logger.error("[crowdsec-alert] sendAlert raised an unexpected error", {
|
||||
key,
|
||||
err: error,
|
||||
});
|
||||
return false;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,798 @@
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
||||
import {
|
||||
type CrowdsecVerdict,
|
||||
crowdsecEnabled,
|
||||
getCrowdsecApiConfig,
|
||||
getCrowdsecBlockMeta,
|
||||
getCrowdsecQuotaUsage,
|
||||
getLastCrowdsecVerify,
|
||||
getMemoryVerdictCacheSize,
|
||||
lookupCrowdsecVerdict,
|
||||
maybeAutoBlockCrowdsec,
|
||||
resetCrowdsecCache,
|
||||
setLastCrowdsecVerify,
|
||||
verdictIsMalicious,
|
||||
verifyCrowdsecConnection,
|
||||
} from "./crowdsec-api";
|
||||
import { type CrowdsecDailyStat, getCrowdsecStats } from "./crowdsec-stats";
|
||||
|
||||
// Unit-test the CTI client in isolation: a deterministic in-memory Redis fake
|
||||
// and a silenced logger, so fetch calls count only CrowdSec lookups. CrowdSec
|
||||
// deliberately never touches Cloudflare, so no Cloudflare surface is stubbed.
|
||||
const state = vi.hoisted(() => ({
|
||||
map: new Map<string, string>(),
|
||||
z: new Map<string, Array<[number, string]>>(),
|
||||
sendAlert: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock("@/lib/services/alert", () => ({
|
||||
sendAlert: state.sendAlert,
|
||||
ddosDetected: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock("@/lib/redis", () => ({
|
||||
redis: {
|
||||
get: async (key: string) => state.map.get(key) ?? null,
|
||||
set: async (
|
||||
key: string,
|
||||
value: string,
|
||||
_mode?: string,
|
||||
_seconds?: number,
|
||||
nx?: string,
|
||||
) => {
|
||||
if (nx === "NX" && state.map.has(key)) return null;
|
||||
state.map.set(key, value);
|
||||
return "OK";
|
||||
},
|
||||
del: async (...keys: string[]) => {
|
||||
for (const key of keys) state.map.delete(key);
|
||||
return keys.length;
|
||||
},
|
||||
incr: async (key: string) => {
|
||||
const next = (Number(state.map.get(key)) || 0) + 1;
|
||||
state.map.set(key, String(next));
|
||||
return next;
|
||||
},
|
||||
decr: async (key: string) => {
|
||||
const next = (Number(state.map.get(key)) || 0) - 1;
|
||||
state.map.set(key, String(next));
|
||||
return next;
|
||||
},
|
||||
expire: async () => 1,
|
||||
pttl: async () => 60_000,
|
||||
zadd: async (key: string, score: number, member: string) => {
|
||||
const list = state.z.get(key) ?? [];
|
||||
list.push([score, member]);
|
||||
list.sort((a, b) => a[0] - b[0]);
|
||||
state.z.set(key, list);
|
||||
return 1;
|
||||
},
|
||||
zremrangebyscore: async (key: string, min: number, max: number) => {
|
||||
const list = (state.z.get(key) ?? []).filter(
|
||||
([score]) => score < min || score > max,
|
||||
);
|
||||
state.z.set(key, list);
|
||||
return 1;
|
||||
},
|
||||
zcard: async (key: string) => (state.z.get(key) ?? []).length,
|
||||
},
|
||||
__esModule: true,
|
||||
}));
|
||||
|
||||
vi.mock("@/lib/logger", () => ({
|
||||
logger: {
|
||||
info: vi.fn(),
|
||||
warn: vi.fn(),
|
||||
error: vi.fn(),
|
||||
debug: vi.fn(),
|
||||
},
|
||||
}));
|
||||
|
||||
const tick = () => new Promise((resolve) => setTimeout(resolve, 20));
|
||||
|
||||
function jsonResponse(body: unknown, status = 200): Response {
|
||||
return new Response(JSON.stringify(body), {
|
||||
status,
|
||||
headers: { "content-type": "application/json" },
|
||||
});
|
||||
}
|
||||
|
||||
function maliciousItem(ip: string, score = 5): unknown {
|
||||
return {
|
||||
ip,
|
||||
reputation: "malicious",
|
||||
confidence: "0.95",
|
||||
scores: { overall: { aggressiveness: 4, total: score } },
|
||||
behaviors: [{ name: "http:bruteforce" }, { name: "http:scan" }],
|
||||
classifications: { false_positives: [] },
|
||||
};
|
||||
}
|
||||
|
||||
function suspiciousItem(ip: string, score: number): unknown {
|
||||
return {
|
||||
ip,
|
||||
reputation: "suspicious",
|
||||
scores: { overall: { total: score } },
|
||||
};
|
||||
}
|
||||
|
||||
function verdict(minimal: Partial<CrowdsecVerdict> = {}): CrowdsecVerdict {
|
||||
return {
|
||||
ip: "198.51.100.1",
|
||||
reputation: "suspicious",
|
||||
score: 3,
|
||||
aggressiveness: 0,
|
||||
confidence: null,
|
||||
behaviors: [],
|
||||
falsePositive: false,
|
||||
checkedAt: Date.now(),
|
||||
...minimal,
|
||||
};
|
||||
}
|
||||
|
||||
function blockIp(): string {
|
||||
return "198.51.100.1";
|
||||
}
|
||||
|
||||
describe("crowdsec-api", () => {
|
||||
let fetchMock: ReturnType<typeof vi.fn>;
|
||||
|
||||
beforeEach(() => {
|
||||
vi.unstubAllGlobals();
|
||||
vi.unstubAllEnvs();
|
||||
state.map.clear();
|
||||
state.z.clear();
|
||||
state.sendAlert.mockReset();
|
||||
resetCrowdsecCache();
|
||||
fetchMock = vi.fn();
|
||||
vi.stubGlobal("fetch", fetchMock);
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
vi.unstubAllGlobals();
|
||||
vi.unstubAllEnvs();
|
||||
state.map.clear();
|
||||
resetCrowdsecCache();
|
||||
vi.restoreAllMocks();
|
||||
});
|
||||
|
||||
it("is enabled only when a non-blank API key is configured", () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
vi.stubEnv("CROWDSEC_CTI_BASE_URL", "https://cti.example.test");
|
||||
expect(crowdsecEnabled()).toBe(true);
|
||||
expect(getCrowdsecApiConfig().apiKey).toBe("cs_key");
|
||||
expect(getCrowdsecApiConfig().baseUrl).toBe("https://cti.example.test");
|
||||
|
||||
vi.stubEnv("CROWDSEC_API_KEY", " ");
|
||||
expect(crowdsecEnabled()).toBe(false);
|
||||
vi.stubEnv("CROWDSEC_CTI_BASE_URL", "");
|
||||
expect(getCrowdsecApiConfig().baseUrl).toBe(
|
||||
"https://cti.api.crowdsec.net/v2",
|
||||
);
|
||||
});
|
||||
|
||||
it("blocks malicious reputations at any threshold", () => {
|
||||
expect(
|
||||
verdictIsMalicious(verdict({ reputation: "malicious", score: 0 }), 5),
|
||||
).toBe(true);
|
||||
});
|
||||
|
||||
it("never blocks safe or benign reputations", () => {
|
||||
expect(verdictIsMalicious(verdict({ reputation: "safe" }), 0)).toBe(false);
|
||||
expect(verdictIsMalicious(verdict({ reputation: "benign" }), 1)).toBe(
|
||||
false,
|
||||
);
|
||||
});
|
||||
|
||||
it("vetoes a false-positive tag even for a malicious reputation", () => {
|
||||
expect(
|
||||
verdictIsMalicious(
|
||||
verdict({ reputation: "malicious", score: 5, falsePositive: true }),
|
||||
4,
|
||||
),
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
it("applies the score threshold to suspicious/known attackers", () => {
|
||||
const v4 = verdict({ reputation: "suspicious", score: 4 });
|
||||
expect(verdictIsMalicious(v4, 4)).toBe(true);
|
||||
expect(verdictIsMalicious(v4, 5)).toBe(false);
|
||||
expect(verdictIsMalicious(verdict({ score: 3 }), 4)).toBe(false);
|
||||
});
|
||||
|
||||
it("never blocks score-0 (unknown) IPs even at threshold 0", () => {
|
||||
expect(
|
||||
verdictIsMalicious(verdict({ score: 0, reputation: "unknown" }), 0),
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
it("does nothing without an API key", async () => {
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
expect(fetchMock).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("does nothing when the runtime toggle is off", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: false,
|
||||
});
|
||||
expect(fetchMock).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("never consults CrowdSec for the unknown-IP sentinel", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "0.0.0.0",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
expect(fetchMock).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("hard-blocks a malicious IP in the shared gate key only", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse(maliciousItem(blockIp())));
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 86_400,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
|
||||
expect(state.map.get(`antiddos:block:${blockIp()}`)).toBe("crowdsec");
|
||||
// No Cloudflare keys may ever be written by CrowdSec.
|
||||
expect(
|
||||
[...state.map.keys()].some((key) => key.includes("cloudflare")),
|
||||
).toBe(false);
|
||||
expect(fetchMock).toHaveBeenCalledTimes(1);
|
||||
const [url, init] = fetchMock.mock.calls[0];
|
||||
expect(String(url)).toContain(`/smoke/${blockIp()}`);
|
||||
expect((init.headers as Record<string, string>)["x-api-key"]).toBe(
|
||||
"cs_key",
|
||||
);
|
||||
});
|
||||
|
||||
it("does not block an IP the community knows nothing about", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse({}, 404));
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
|
||||
expect(state.map.has(`antiddos:block:${blockIp()}`)).toBe(false);
|
||||
});
|
||||
|
||||
it("respects a custom score threshold", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse(suspiciousItem(blockIp(), 3)));
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
expect(state.map.has(`antiddos:block:${blockIp()}`)).toBe(false);
|
||||
|
||||
fetchMock.mockResolvedValue(jsonResponse(suspiciousItem(blockIp(), 3)));
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 3,
|
||||
enabled: true,
|
||||
});
|
||||
expect(state.map.get(`antiddos:block:${blockIp()}`)).toBe("crowdsec");
|
||||
});
|
||||
|
||||
it("dedupes concurrent lookups into a single API call", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse(maliciousItem(blockIp())));
|
||||
|
||||
await Promise.all([
|
||||
maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
}),
|
||||
maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
}),
|
||||
]);
|
||||
expect(fetchMock).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("reuses the Redis verdict cache for repeat offenders", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse(maliciousItem(blockIp())));
|
||||
|
||||
for (let i = 0; i < 3; i += 1) {
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
}
|
||||
expect(fetchMock).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("never shortens an existing longer host block", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse(maliciousItem(blockIp())));
|
||||
|
||||
state.map.set(`antiddos:block:${blockIp()}`, "1");
|
||||
const redis = (await import("@/lib/redis")).redis;
|
||||
vi.spyOn(redis as NonNullable<typeof redis>, "pttl").mockImplementation(
|
||||
async () => 86_400_000,
|
||||
);
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
|
||||
expect(state.map.get(`antiddos:block:${blockIp()}`)).toBe("1");
|
||||
});
|
||||
|
||||
it("backs off after a 403 so it stops hammering a rejected key", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse({ message: "Invalid key" }, 403));
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "203.0.113.9",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
expect(fetchMock).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("publishes the backoff to shared Redis so every instance respects it", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse({ message: "Invalid key" }, 403));
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
// The shared marker exists and points into the future.
|
||||
const until = Number(state.map.get("crowdsec:backoff-until"));
|
||||
expect(Number.isFinite(until)).toBe(true);
|
||||
expect(until).toBeGreaterThan(Date.now());
|
||||
|
||||
// A fresh instance (reset in-process state) still honours the marker.
|
||||
resetCrowdsecCache();
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "203.0.113.44",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
expect(fetchMock).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("backs off after a 429 rate limit as well", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse({ message: "rate limited" }, 429));
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "198.51.100.2",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
expect(fetchMock).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("raises a critical ops alert when the CTI key is rejected (403)", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse({ message: "Invalid key" }, 403));
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
await tick();
|
||||
expect(state.sendAlert).toHaveBeenCalledTimes(1);
|
||||
const [input] = state.sendAlert.mock.calls[0];
|
||||
expect(input.type).toBe("ddos");
|
||||
expect(input.severity).toBe("critical");
|
||||
expect(input.message).toContain("403");
|
||||
expect(input.message).toContain("CROWDSEC_API_KEY");
|
||||
expect(input.context).toMatchObject({ status: 403 });
|
||||
});
|
||||
|
||||
it("raises a warning ops alert when the CTI rate limit is hit (429)", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse({ message: "rate limited" }, 429));
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
await tick();
|
||||
expect(state.sendAlert).toHaveBeenCalledTimes(1);
|
||||
const [input] = state.sendAlert.mock.calls[0];
|
||||
expect(input.type).toBe("ddos");
|
||||
expect(input.severity).toBe("warning");
|
||||
expect(input.message).toContain("rate limited");
|
||||
expect(input.context).toMatchObject({ status: 429 });
|
||||
});
|
||||
|
||||
it("swallows API failures instead of throwing on the hot path", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse({ message: "boom" }, 500));
|
||||
|
||||
await expect(
|
||||
maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
}),
|
||||
).resolves.toBeUndefined();
|
||||
expect(state.map.has(`antiddos:block:${blockIp()}`)).toBe(false);
|
||||
});
|
||||
|
||||
it("reports a missing credential without calling the API", async () => {
|
||||
const status = await verifyCrowdsecConnection();
|
||||
expect(status.ok).toBe(false);
|
||||
expect(status.message).toContain("CROWDSEC_API_KEY");
|
||||
expect(fetchMock).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("verifies the key against the CTI probe endpoint", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(
|
||||
jsonResponse({ ip: "1.1.1.1", reputation: "safe" }),
|
||||
);
|
||||
|
||||
const status = await verifyCrowdsecConnection();
|
||||
expect(status.ok).toBe(true);
|
||||
expect(status.message).toContain("1.1.1.1");
|
||||
expect(String(fetchMock.mock.calls[0][0])).toContain("/smoke/1.1.1.1");
|
||||
expect(
|
||||
(fetchMock.mock.calls[0][1].headers as Record<string, string>)[
|
||||
"x-api-key"
|
||||
],
|
||||
).toBe("cs_key");
|
||||
});
|
||||
|
||||
it("surfaces a rejected credential", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse({ message: "Invalid key" }, 403));
|
||||
|
||||
const status = await verifyCrowdsecConnection();
|
||||
expect(status.ok).toBe(false);
|
||||
expect(status.message).toContain("Invalid key");
|
||||
});
|
||||
|
||||
it("round-trips the last verify status through Redis and memory", async () => {
|
||||
const status = { ok: true, message: "CTI key accepted", at: Date.now() };
|
||||
await setLastCrowdsecVerify(status);
|
||||
expect(await getLastCrowdsecVerify()).toEqual(status);
|
||||
expect(JSON.parse(state.map.get("crowdsec:last-verify") ?? "{}")).toEqual(
|
||||
status,
|
||||
);
|
||||
});
|
||||
|
||||
it("records why it blocked an IP next to the gate key", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
fetchMock.mockResolvedValue(jsonResponse(maliciousItem(blockIp())));
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 86_400,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
|
||||
const meta = await getCrowdsecBlockMeta(blockIp());
|
||||
expect(meta).not.toBeNull();
|
||||
expect(meta?.source).toBe("crowdsec");
|
||||
expect(meta?.reputation).toBe("malicious");
|
||||
expect(meta?.score).toBe(5);
|
||||
expect(meta?.behaviors).toEqual(["http:bruteforce", "http:scan"]);
|
||||
expect(meta?.category).toBe("api");
|
||||
expect(meta?.ttlSeconds).toBe(86_400);
|
||||
expect(meta?.blockedAt).toBeGreaterThan(0);
|
||||
});
|
||||
|
||||
it("stops consulting the API once today's quota is spent", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
vi.stubEnv("CROWDSEC_CTI_DAILY_QUOTA", "2");
|
||||
// Fresh Response per call — a consumed body must never be re-parsed.
|
||||
fetchMock.mockImplementation(() =>
|
||||
Promise.resolve(jsonResponse(maliciousItem(blockIp()))),
|
||||
);
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "198.51.100.2",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
expect(fetchMock).toHaveBeenCalledTimes(2);
|
||||
expect(state.map.get(`antiddos:block:198.51.100.2`)).toBe("crowdsec");
|
||||
|
||||
// Third bucket-tripping IP arrives after the quota counter hit 2.
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "198.51.100.3",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
expect(fetchMock).toHaveBeenCalledTimes(2);
|
||||
expect(state.map.has(`antiddos:block:198.51.100.3`)).toBe(false);
|
||||
|
||||
const usage = await getCrowdsecQuotaUsage();
|
||||
expect(usage.quota).toBe(2);
|
||||
expect(usage.used).toBe(2);
|
||||
expect(usage.exhausted).toBe(true);
|
||||
});
|
||||
|
||||
it("exposes today's quota usage for the admin panel", async () => {
|
||||
vi.stubEnv("CROWDSEC_CTI_DAILY_QUOTA", "10000");
|
||||
const before = await getCrowdsecQuotaUsage();
|
||||
expect(before.quota).toBe(10000);
|
||||
expect(before.used).toBe(0);
|
||||
expect(before.exhausted).toBe(false);
|
||||
expect(before.date).toMatch(/^\d{4}-\d{2}-\d{2}$/);
|
||||
|
||||
state.map.set(`crowdsec:usage:${before.date}`, "9876");
|
||||
const after = await getCrowdsecQuotaUsage();
|
||||
expect(after.used).toBe(9876);
|
||||
});
|
||||
|
||||
it("caps the in-process verdict cache so it cannot grow forever", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
vi.stubEnv("CROWDSEC_CTI_DAILY_QUOTA", "0");
|
||||
fetchMock.mockImplementation((url: string | URL) =>
|
||||
Promise.resolve(
|
||||
jsonResponse(maliciousItem(String(url).split("/").pop() ?? "ip")),
|
||||
),
|
||||
);
|
||||
|
||||
// One lookup per distinct IP (never cached before), exceeding the cap —
|
||||
// the oldest entries are evicted first, so the cache stays bounded.
|
||||
for (let i = 0; i < 2100; i += 1) {
|
||||
await lookupCrowdsecVerdict(`198.51.100.${i}`);
|
||||
}
|
||||
expect(getMemoryVerdictCacheSize()).toBe(2000);
|
||||
});
|
||||
|
||||
it("raises an ops alert when the daily quota is exhausted", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
vi.stubEnv("CROWDSEC_CTI_DAILY_QUOTA", "1");
|
||||
fetchMock.mockImplementation(() =>
|
||||
Promise.resolve(jsonResponse(maliciousItem(blockIp()))),
|
||||
);
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "198.51.100.2",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
await tick();
|
||||
expect(fetchMock).toHaveBeenCalledTimes(1);
|
||||
expect(state.sendAlert).toHaveBeenCalledTimes(1);
|
||||
const [input] = state.sendAlert.mock.calls[0];
|
||||
expect(input.type).toBe("ddos");
|
||||
expect(input.severity).toBe("warning");
|
||||
expect(input.message).toContain("quota exhausted");
|
||||
expect(input.context).toMatchObject({ quota: 1 });
|
||||
});
|
||||
|
||||
it("alerts once when quota becomes available again after exhaustion", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
vi.stubEnv("CROWDSEC_CTI_DAILY_QUOTA", "1");
|
||||
fetchMock.mockImplementation(() =>
|
||||
Promise.resolve(jsonResponse(maliciousItem(blockIp()))),
|
||||
);
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: blockIp(),
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
// Exhaust the counter.
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "198.51.100.2",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
// The counter is externally reset (new billing day / fresh deployment):
|
||||
// the next successful reserve should call it out.
|
||||
const date = new Date().toISOString().slice(0, 10);
|
||||
state.map.set(`crowdsec:usage:${date}`, "0");
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "198.51.100.3",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
await tick();
|
||||
|
||||
expect(fetchMock).toHaveBeenCalledTimes(2);
|
||||
expect(state.sendAlert).toHaveBeenCalledTimes(2);
|
||||
const alerts = state.sendAlert.mock.calls.map(([input]) => input);
|
||||
expect(alerts[0].severity).toBe("warning");
|
||||
expect(alerts[1].severity).toBe("info");
|
||||
expect(alerts[1].message).toContain("available again");
|
||||
expect(alerts[1].context).toMatchObject({ quota: 1 });
|
||||
});
|
||||
|
||||
it("floods once per cooldown window when blocks burst past the threshold", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
vi.stubEnv("CROWDSEC_ALERT_BLOCK_BURST", "2");
|
||||
vi.stubEnv("CROWDSEC_CTI_DAILY_QUOTA", "0");
|
||||
fetchMock.mockImplementation((url: string | URL) =>
|
||||
Promise.resolve(
|
||||
jsonResponse(maliciousItem(String(url).split("/").pop() ?? "ip")),
|
||||
),
|
||||
);
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "198.51.100.71",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "198.51.100.72",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
// Third block in the same window: threshold crossed, but the alert is
|
||||
// cooldown-gated so it still fires exactly once.
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "198.51.100.73",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
await tick();
|
||||
expect(state.sendAlert).toHaveBeenCalledTimes(1);
|
||||
const [input] = state.sendAlert.mock.calls[0];
|
||||
expect(input.type).toBe("ddos");
|
||||
expect(input.context).toMatchObject({ blocks: 2, threshold: 2 });
|
||||
expect(state.map.get(`antiddos:block:198.51.100.72`)).toBe("crowdsec");
|
||||
});
|
||||
|
||||
it("tallies lookups and blocks into the daily stats histogram", async () => {
|
||||
vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
|
||||
vi.stubEnv("CROWDSEC_CTI_DAILY_QUOTA", "0");
|
||||
fetchMock.mockImplementation((url: string | URL) => {
|
||||
const ip = String(url).split("/").pop() ?? "ip";
|
||||
return Promise.resolve(
|
||||
jsonResponse(
|
||||
ip === "198.51.100.83" ? suspiciousItem(ip, 3) : maliciousItem(ip),
|
||||
),
|
||||
);
|
||||
});
|
||||
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "198.51.100.81",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "198.51.100.82",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 4,
|
||||
enabled: true,
|
||||
});
|
||||
await maybeAutoBlockCrowdsec({
|
||||
ip: "198.51.100.83",
|
||||
category: "api",
|
||||
ttlSeconds: 600,
|
||||
scoreThreshold: 7, // suspicious/known verdicts below threshold: lookup only
|
||||
enabled: true,
|
||||
});
|
||||
await tick();
|
||||
|
||||
const stats = await getCrowdsecStats(1);
|
||||
const today: CrowdsecDailyStat | undefined = stats.find(
|
||||
(row) => row.date === new Date().toISOString().slice(0, 10),
|
||||
);
|
||||
expect(today?.lookups).toBe(3);
|
||||
expect(today?.blocks).toBe(2);
|
||||
expect(today?.reportFailures).toBe(0);
|
||||
expect(today?.categories).toMatchObject({ api: 2 });
|
||||
expect(today?.reputations).toMatchObject({ malicious: 2 });
|
||||
expect(
|
||||
state.map.get(
|
||||
`crowdsec:stat:lookups:${new Date().toISOString().slice(0, 10)}`,
|
||||
),
|
||||
).toBe("3");
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,789 @@
|
||||
import "server-only";
|
||||
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { env } from "@/env";
|
||||
import { raiseCrowdsecAlert } from "@/lib/crowdsec-alerts";
|
||||
import { reportCrowdsecSignal } from "@/lib/crowdsec-report";
|
||||
import {
|
||||
bumpCrowdsecBreakdownStat,
|
||||
bumpCrowdsecStat,
|
||||
} from "@/lib/crowdsec-stats";
|
||||
import { logger } from "@/lib/logger";
|
||||
import { redis } from "@/lib/redis";
|
||||
import { UNKNOWN_CLIENT_IP } from "./client-ip";
|
||||
|
||||
/**
|
||||
* CrowdSec CTI (community threat intelligence) integration for the anti-DDoS
|
||||
* gate — the reputation side of the auto-block pipeline.
|
||||
*
|
||||
* When an IP trips a rate bucket, the gate consults CrowdSec's community
|
||||
* reputation for that IP (`GET /smoke/{ip}`, the freemium Enrichment API,
|
||||
* `x-api-key` auth) and hard-blocks known-bad repeat offenders immediately
|
||||
* instead of waiting for the local `maxViolations` threshold. The block lives
|
||||
* only in the gate's own shared Redis key (`antiddos:block:{ip}`) so every
|
||||
* existing consumer — the proxy check, the admin block list, the admin unban —
|
||||
* keeps working unchanged. CrowdSec never talks to Cloudflare and never
|
||||
* creates edge rules; if a Cloudflare mirror is wanted it is the gate's own
|
||||
* escalation logic that decides, never this module.
|
||||
*
|
||||
* Quota safety: lookups only run for IPs that already tripped a bucket (never
|
||||
* on the plain hot path), verdicts are cached in Redis for an hour (so a
|
||||
* flood from one IP costs at most one API call), concurrent lookups for the
|
||||
* same IP are deduped across instances with a Redis NX lock, and a 403/429
|
||||
* response trips a module-wide backoff instead of hammering the API.
|
||||
*
|
||||
* Credentials come from env only (`CROWDSEC_API_KEY`) and are never written
|
||||
* into the admin-visible config — same contract as the Cloudflare token.
|
||||
*
|
||||
* Quota guard: every enrichment call counts against a per-day Redis counter so
|
||||
* a spread DDoS (many distinct IPs tripping buckets) can exhaust the day's
|
||||
* freemium quota only until the configured ceiling, after which lookups pause
|
||||
* until tomorrow instead of hammering a 429 wall.
|
||||
*
|
||||
* Sharing detections back: after a block is created this module fires the
|
||||
* signal push in `@/lib/crowdsec-report` (Central API watcher login + POST
|
||||
* /signals), strictly opt-in via CROWDSEC_REPORT_ENABLED and always
|
||||
* fire-and-forget.
|
||||
*/
|
||||
|
||||
export class CrowdsecApiError extends Error {}
|
||||
|
||||
export interface CrowdsecApiConfig {
|
||||
baseUrl: string;
|
||||
apiKey: string | null;
|
||||
}
|
||||
|
||||
export type CrowdsecReputation =
|
||||
| "malicious"
|
||||
| "suspicious"
|
||||
| "known"
|
||||
| "safe"
|
||||
| "benign"
|
||||
| "unknown";
|
||||
|
||||
export interface CrowdsecVerdict {
|
||||
ip: string;
|
||||
/** Raw CTI reputation enum; null when the IP is unknown to the community. */
|
||||
reputation: CrowdsecReputation | null;
|
||||
/** `scores.overall.total` — CrowdSec malevolence score, 0-5. */
|
||||
score: number;
|
||||
/** `scores.overall.aggressiveness` — 0-5. */
|
||||
aggressiveness: number;
|
||||
confidence: string | null;
|
||||
/** Reported attack categories, e.g. ["http:scan", "ssh:bruteforce"]. */
|
||||
behaviors: string[];
|
||||
/** CrowdSec tags IPs carrying false-positive classifications as safe. */
|
||||
falsePositive: boolean;
|
||||
checkedAt: number;
|
||||
}
|
||||
|
||||
export interface CrowdsecConnectionStatus {
|
||||
ok: boolean;
|
||||
message?: string;
|
||||
at: number;
|
||||
}
|
||||
|
||||
/** Why a CrowdSec-sourced block exists — persisted next to the block key. */
|
||||
export interface CrowdsecBlockMeta {
|
||||
source: typeof CROWDSEC_BLOCK_SOURCE | "gate";
|
||||
category: string;
|
||||
reputation: CrowdsecReputation | null;
|
||||
score: number;
|
||||
behaviors: string[];
|
||||
ttlSeconds: number;
|
||||
blockedAt: number;
|
||||
}
|
||||
|
||||
/** Daily CTI usage counter as shown in the admin panel. */
|
||||
export interface CrowdsecQuotaUsage {
|
||||
/** UTC calendar day the counter belongs to (YYYY-MM-DD). */
|
||||
date: string;
|
||||
used: number;
|
||||
/** 0 = unlimited. */
|
||||
quota: number;
|
||||
exhausted: boolean;
|
||||
}
|
||||
|
||||
/** Value written into the shared block key so the admin UI can label the source. */
|
||||
export const CROWDSEC_BLOCK_SOURCE = "crowdsec";
|
||||
|
||||
const API_TIMEOUT_MS = 10_000;
|
||||
const VERDICT_CACHE_TTL_SECONDS = 3600;
|
||||
const VERDICT_CACHE_TTL_MS = VERDICT_CACHE_TTL_SECONDS * 1000;
|
||||
const LOOKUP_LOCK_TTL_SECONDS = 60;
|
||||
const RATE_LIMIT_BACKOFF_MS = 60_000;
|
||||
const AUTH_BACKOFF_MS = 300_000;
|
||||
const VERDICT_PREFIX = "crowdsec:cti:";
|
||||
const LOOKUP_LOCK_PREFIX = "crowdsec:lock:";
|
||||
const LAST_VERIFY_KEY = "crowdsec:last-verify";
|
||||
const BLOCK_META_PREFIX = "antiddos:block:meta:";
|
||||
const QUOTA_PREFIX = "crowdsec:usage:";
|
||||
const QUOTA_KEY_TTL_SECONDS = 48 * 3_600;
|
||||
/** Shared 403/429 pause marker, so every instance respects the backoff. */
|
||||
const BACKOFF_KEY = "crowdsec:backoff-until";
|
||||
/** Short-window block burst counter: crowdsec:burst:recent (ZSET of timestamps). */
|
||||
const BURST_PREFIX = "crowdsec:burst:";
|
||||
const BURST_WINDOW_SECONDS = 300;
|
||||
/** In-process verdict cache cap so a flood of distinct IPs cannot grow it forever. */
|
||||
const MEMORY_VERDICT_CACHE_MAX = 2_000;
|
||||
/** Warn at this fraction of the daily quota, once per day. */
|
||||
const QUOTA_WARN_RATIO = 0.8;
|
||||
/** Well-known, community-safe address used by the admin "verify" button. */
|
||||
const PROBE_IP = "1.1.1.1";
|
||||
|
||||
export function getCrowdsecApiConfig(): CrowdsecApiConfig {
|
||||
return {
|
||||
baseUrl: env.CROWDSEC_CTI_BASE_URL || "https://cti.api.crowdsec.net/v2",
|
||||
apiKey: env.CROWDSEC_API_KEY?.trim() || null,
|
||||
};
|
||||
}
|
||||
|
||||
/** True when a CTI API key is present so the gate may call the API. */
|
||||
export function crowdsecEnabled(): boolean {
|
||||
return Boolean(getCrowdsecApiConfig().apiKey);
|
||||
}
|
||||
|
||||
interface CrowdsecScore {
|
||||
aggressiveness?: number;
|
||||
threat?: number;
|
||||
trust?: number;
|
||||
anomaly?: number;
|
||||
total?: number;
|
||||
}
|
||||
|
||||
interface CrowdsecSmokeItem {
|
||||
ip?: string;
|
||||
reputation?: string;
|
||||
confidence?: string;
|
||||
scores?: { overall?: CrowdsecScore };
|
||||
classifications?: { false_positives?: unknown[] };
|
||||
behaviors?: { name?: string }[];
|
||||
}
|
||||
|
||||
async function crowdsecRequest(
|
||||
path: string,
|
||||
init: { method?: "GET" | "POST"; body?: unknown } = {},
|
||||
): Promise<Response> {
|
||||
const config = getCrowdsecApiConfig();
|
||||
if (!config.apiKey) {
|
||||
throw new CrowdsecApiError("CROWDSEC_API_KEY is not configured");
|
||||
}
|
||||
const controller = new AbortController();
|
||||
const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
|
||||
try {
|
||||
return await fetch(`${config.baseUrl}${path}`, {
|
||||
method: init.method ?? "GET",
|
||||
headers: {
|
||||
"x-api-key": config.apiKey,
|
||||
Accept: "application/json",
|
||||
"Content-Type": "application/json",
|
||||
},
|
||||
body: init.body === undefined ? undefined : JSON.stringify(init.body),
|
||||
signal: controller.signal,
|
||||
cache: "no-store",
|
||||
});
|
||||
} finally {
|
||||
clearTimeout(timer);
|
||||
}
|
||||
}
|
||||
|
||||
async function errorDetail(response: Response): Promise<string> {
|
||||
try {
|
||||
const body = (await response.json()) as { message?: string };
|
||||
return body.message ?? `HTTP ${response.status}`;
|
||||
} catch {
|
||||
return `HTTP ${response.status}`;
|
||||
}
|
||||
}
|
||||
|
||||
function toNumber(value: unknown): number {
|
||||
const n = Number(value);
|
||||
return Number.isFinite(n) ? n : 0;
|
||||
}
|
||||
|
||||
function parseVerdict(ip: string, item: CrowdsecSmokeItem): CrowdsecVerdict {
|
||||
const overall = item.scores?.overall;
|
||||
const falsePositives = item.classifications?.false_positives ?? [];
|
||||
return {
|
||||
ip,
|
||||
reputation: (item.reputation as CrowdsecReputation | undefined) ?? null,
|
||||
score: toNumber(overall?.total),
|
||||
aggressiveness: toNumber(overall?.aggressiveness),
|
||||
confidence: item.confidence ?? null,
|
||||
behaviors: (item.behaviors ?? [])
|
||||
.map((behavior) => behavior?.name)
|
||||
.filter((name): name is string => Boolean(name)),
|
||||
// CrowdSec: "Any IP with false_positives tags shouldn't be considered
|
||||
// as malicious" — this veto always wins over reputation and score.
|
||||
falsePositive: falsePositives.length > 0,
|
||||
checkedAt: Date.now(),
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve a cached CTI verdict into a block/no-block decision against the
|
||||
* admin-configurable score threshold. `malicious` is always blocked; `safe`
|
||||
* and `benign` never are; everything else follows the 0-5 score threshold
|
||||
* (with score 0 = "unknown" never blocking, even at threshold 0).
|
||||
*/
|
||||
export function verdictIsMalicious(
|
||||
verdict: CrowdsecVerdict,
|
||||
threshold: number,
|
||||
): boolean {
|
||||
if (verdict.falsePositive) return false;
|
||||
if (verdict.reputation === "malicious") return true;
|
||||
if (verdict.reputation === "safe" || verdict.reputation === "benign") {
|
||||
return false;
|
||||
}
|
||||
const effective = Math.min(5, Math.max(0, threshold));
|
||||
return verdict.score >= effective && verdict.score >= 1;
|
||||
}
|
||||
|
||||
// --- Verdict cache (Redis backed, in-process fallback) ---
|
||||
|
||||
const memoryVerdicts = new Map<string, CrowdsecVerdict>();
|
||||
|
||||
/**
|
||||
* Insert/refresh an in-process verdict while keeping the cache bounded: Map
|
||||
* iteration order is insertion order, so the oldest (leftmost) entry is
|
||||
* dropped first and re-inserted entries are refreshed to the back.
|
||||
*/
|
||||
function rememberVerdict(verdict: CrowdsecVerdict): void {
|
||||
memoryVerdicts.delete(verdict.ip);
|
||||
memoryVerdicts.set(verdict.ip, verdict);
|
||||
while (memoryVerdicts.size > MEMORY_VERDICT_CACHE_MAX) {
|
||||
const oldest = memoryVerdicts.keys().next();
|
||||
if (oldest.done) break;
|
||||
memoryVerdicts.delete(oldest.value);
|
||||
}
|
||||
}
|
||||
|
||||
/** Test hook only — reports the bounded in-process cache size. */
|
||||
export function getMemoryVerdictCacheSize(): number {
|
||||
return memoryVerdicts.size;
|
||||
}
|
||||
|
||||
function verdictKey(ip: string): string {
|
||||
return `${VERDICT_PREFIX}${ip}`;
|
||||
}
|
||||
|
||||
async function readVerdictCache(ip: string): Promise<CrowdsecVerdict | null> {
|
||||
const cached = memoryVerdicts.get(ip);
|
||||
if (cached && Date.now() - cached.checkedAt < VERDICT_CACHE_TTL_MS) {
|
||||
return cached;
|
||||
}
|
||||
if (redis) {
|
||||
try {
|
||||
const raw = await redis.get(verdictKey(ip));
|
||||
if (raw) {
|
||||
const parsed = JSON.parse(raw) as CrowdsecVerdict;
|
||||
rememberVerdict(parsed);
|
||||
return parsed;
|
||||
}
|
||||
} catch {
|
||||
// fall through to a cache miss — the API call below is the fallback.
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
async function writeVerdictCache(verdict: CrowdsecVerdict): Promise<void> {
|
||||
rememberVerdict(verdict);
|
||||
if (redis) {
|
||||
try {
|
||||
await redis.set(
|
||||
verdictKey(verdict.ip),
|
||||
JSON.stringify(verdict),
|
||||
"EX",
|
||||
VERDICT_CACHE_TTL_SECONDS,
|
||||
);
|
||||
} catch {
|
||||
// cache is best-effort — a miss only costs one extra API call later.
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/** Cross-instance dedupe so a cold-cache flood costs one lookup, not N. */
|
||||
async function acquireLookupLock(ip: string): Promise<boolean> {
|
||||
if (!redis) return true;
|
||||
try {
|
||||
const acquired = await redis.set(
|
||||
`${LOOKUP_LOCK_PREFIX}${ip}`,
|
||||
"1",
|
||||
"EX",
|
||||
LOOKUP_LOCK_TTL_SECONDS,
|
||||
"NX",
|
||||
);
|
||||
return acquired === "OK";
|
||||
} catch {
|
||||
// Redis hiccup — allow the lookup; the verdict cache still dedupes.
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
let backoffUntil = 0;
|
||||
let quotaWarnedDate: string | null = null;
|
||||
let quotaExhaustedDate: string | null = null;
|
||||
|
||||
/**
|
||||
* Next moment (epoch ms) the CTI API may be called again — the max of the
|
||||
* in-process view and the shared Redis marker so every instance respects a
|
||||
* backoff discovered by any of them. Redis is only read when the local view is
|
||||
* not already active, keeping the hot path cheap.
|
||||
*/
|
||||
async function getBackoffUntil(): Promise<number> {
|
||||
if (Date.now() < backoffUntil) return backoffUntil;
|
||||
if (redis) {
|
||||
try {
|
||||
const raw = await redis.get(BACKOFF_KEY);
|
||||
const shared = Number(raw ?? 0);
|
||||
if (Number.isFinite(shared) && shared > backoffUntil) {
|
||||
backoffUntil = shared;
|
||||
}
|
||||
} catch {
|
||||
// Redis hiccup — local view is enough
|
||||
}
|
||||
}
|
||||
return backoffUntil;
|
||||
}
|
||||
|
||||
async function setBackoff(ms: number): Promise<void> {
|
||||
const until = Date.now() + ms;
|
||||
backoffUntil = until;
|
||||
if (redis) {
|
||||
try {
|
||||
// EX rounds up so the marker outlives the wait it encodes, plus a
|
||||
// second of slack for the read path.
|
||||
await redis.set(
|
||||
BACKOFF_KEY,
|
||||
String(until),
|
||||
"EX",
|
||||
Math.ceil(ms / 1000) + 1,
|
||||
);
|
||||
} catch {
|
||||
// local view still protects this instance
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function quotaDate(): string {
|
||||
return new Date().toISOString().slice(0, 10);
|
||||
}
|
||||
|
||||
function quotaKey(date: string): string {
|
||||
return `${QUOTA_PREFIX}${date}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Today's configured ceiling. Coerced because tests run with
|
||||
* SKIP_ENV_VALIDATION (raw process.env strings, no zod defaults) while
|
||||
* production gets a parsed number. 0 (or unset) = unlimited.
|
||||
*/
|
||||
function dailyQuota(): number {
|
||||
const raw = Number(env.CROWDSEC_CTI_DAILY_QUOTA ?? 0);
|
||||
return Number.isFinite(raw) && raw > 0 ? raw : 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Today's CTI usage against the configured daily ceiling. Counted in Redis so
|
||||
* every instance shares one budget.
|
||||
*/
|
||||
export async function getCrowdsecQuotaUsage(): Promise<CrowdsecQuotaUsage> {
|
||||
const date = quotaDate();
|
||||
const quota = dailyQuota();
|
||||
let used = 0;
|
||||
if (redis) {
|
||||
try {
|
||||
used = Number((await redis.get(quotaKey(date))) ?? 0);
|
||||
if (!Number.isFinite(used)) used = 0;
|
||||
} catch {
|
||||
// counter unavailable — report zero rather than blocking the admin
|
||||
}
|
||||
}
|
||||
return { date, used, quota, exhausted: quota > 0 && used >= quota };
|
||||
}
|
||||
|
||||
/**
|
||||
* Reserve one API call against today's quota. Atomic: the counter is INCR'd
|
||||
* BEFORE the call and compared to the ceiling, so concurrent instances can
|
||||
* never slip calls past the budget; a reserve that overshoots rolls itself
|
||||
* back. Returns false once the budget is spent (and raises an ops alert).
|
||||
*/
|
||||
async function reserveQuota(): Promise<boolean> {
|
||||
const quota = dailyQuota();
|
||||
if (quota <= 0) return true;
|
||||
if (!redis) return true; // no shared counter → unlimited best-effort
|
||||
const date = quotaDate();
|
||||
const key = quotaKey(date);
|
||||
try {
|
||||
const used = await redis.incr(key);
|
||||
await redis.expire(key, QUOTA_KEY_TTL_SECONDS);
|
||||
if (used > quota) {
|
||||
// Concurrent reserves nudged us past the ceiling — give the slot
|
||||
// back and refuse: the budget would be spent the very next call
|
||||
// anyway, so stopping here is both safe and quota-exact.
|
||||
await redis.decr(key);
|
||||
quotaExhaustedDate = date;
|
||||
logger.warn(
|
||||
"[crowdsec-api] CTI daily quota exhausted — pausing lookups until tomorrow",
|
||||
{ quota },
|
||||
);
|
||||
void raiseCrowdsecAlert("quota", {
|
||||
type: "ddos",
|
||||
severity: "warning",
|
||||
message: `CrowdSec reputation quota exhausted for today (${used} of ${quota} enrichment calls) — lookups are paused until tomorrow.`,
|
||||
context: { used, quota, date },
|
||||
});
|
||||
return false;
|
||||
}
|
||||
if (used >= quota * QUOTA_WARN_RATIO && quotaWarnedDate !== date) {
|
||||
quotaWarnedDate = date;
|
||||
logger.warn("[crowdsec-api] CTI daily quota nearing its limit", {
|
||||
used,
|
||||
quota,
|
||||
});
|
||||
}
|
||||
if (quotaExhaustedDate) {
|
||||
// A reserve just succeeded after an exhaustion day (counter was
|
||||
// reset or the calendar rolled over) — say so, once per cooldown.
|
||||
void raiseCrowdsecAlert("quota-restored", {
|
||||
type: "ddos",
|
||||
severity: "info",
|
||||
message: `CrowdSec reputation quota is available again (${used} of ${quota} used today) — lookups resumed.`,
|
||||
context: { used, quota, date },
|
||||
});
|
||||
quotaExhaustedDate = null;
|
||||
}
|
||||
return true;
|
||||
} catch {
|
||||
// Redis hiccup at a moment we could not count — allow the call rather
|
||||
// than break the gate; the verdict cache still limits frequency.
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
/** Block burst threshold from env, defensively coerced (falls back to 10). */
|
||||
function dailyBlockBurstThreshold(): number {
|
||||
const raw = Number(env.CROWDSEC_ALERT_BLOCK_BURST ?? 10);
|
||||
return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : 10;
|
||||
}
|
||||
|
||||
/**
|
||||
* A burst of new blocks is usually an automated attack wave. Track block
|
||||
* timestamps in a rolling window (Redis sorted set, 5 minutes) so a burst that
|
||||
* straddles a bucket boundary is still counted together, and alert once per
|
||||
* cooldown window when the count crosses CROWDSEC_ALERT_BLOCK_BURST.
|
||||
* Fire-and-forget.
|
||||
*/
|
||||
async function trackBlockBurst(): Promise<void> {
|
||||
if (!redis) return;
|
||||
const now = Date.now();
|
||||
const key = `${BURST_PREFIX}recent`;
|
||||
const threshold = dailyBlockBurstThreshold();
|
||||
try {
|
||||
await redis.zadd(key, now, randomUUID());
|
||||
await redis.zremrangebyscore(key, 0, now - BURST_WINDOW_SECONDS * 1000);
|
||||
const count = await redis.zcard(key);
|
||||
await redis.expire(key, BURST_WINDOW_SECONDS * 2);
|
||||
if (count >= threshold) {
|
||||
void raiseCrowdsecAlert("block-burst", {
|
||||
type: "ddos",
|
||||
severity: "warning",
|
||||
message: `Anti-DDoS auto-block created ${count} blocks in the last ${BURST_WINDOW_SECONDS / 60} minutes — likely an automated attack wave.`,
|
||||
context: {
|
||||
blocks: count,
|
||||
windowSeconds: BURST_WINDOW_SECONDS,
|
||||
threshold,
|
||||
},
|
||||
});
|
||||
}
|
||||
} catch {
|
||||
// alert is best-effort — never break the block path
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Community reputation verdict for an IP, from cache when possible. Returns
|
||||
* null when the API is not configured, the lookup failed, the API is in
|
||||
* backoff, or today's quota is spent — never throws, so it is safe on the
|
||||
* gate's hot path.
|
||||
*/
|
||||
export async function lookupCrowdsecVerdict(
|
||||
ip: string,
|
||||
): Promise<CrowdsecVerdict | null> {
|
||||
if (!crowdsecEnabled()) return null;
|
||||
if (!ip || ip === UNKNOWN_CLIENT_IP) return null;
|
||||
if (Date.now() < (await getBackoffUntil())) return null;
|
||||
|
||||
const cached = await readVerdictCache(ip);
|
||||
if (cached) return cached;
|
||||
|
||||
if (!(await acquireLookupLock(ip))) {
|
||||
// Another instance is mid-lookup for this IP; skip rather than
|
||||
// double-spend API quota on the same address.
|
||||
return null;
|
||||
}
|
||||
|
||||
try {
|
||||
// Re-read after claiming the lock — a concurrent instance may have
|
||||
// filled the cache while we were acquiring it.
|
||||
const raced = await readVerdictCache(ip);
|
||||
if (raced) return raced;
|
||||
|
||||
// Cache miss costs a paid call — reserve against today's quota first.
|
||||
if (!(await reserveQuota())) {
|
||||
logger.warn(
|
||||
"[crowdsec-api] CTI daily quota exhausted — pausing lookups until tomorrow",
|
||||
{ quota: dailyQuota() },
|
||||
);
|
||||
return null;
|
||||
}
|
||||
|
||||
const response = await crowdsecRequest(`/smoke/${encodeURIComponent(ip)}`);
|
||||
// The enrichment call happened — count it for the daily histogram,
|
||||
// regardless of whether the verdict was positive, negative, or n/a.
|
||||
void bumpCrowdsecStat("lookups");
|
||||
|
||||
if (response.status === 404) {
|
||||
// Unknown to the community — cache the negative result so a clean
|
||||
// repeat offender never costs another API call this hour.
|
||||
const verdict = parseVerdict(ip, {});
|
||||
await writeVerdictCache(verdict);
|
||||
return verdict;
|
||||
}
|
||||
if (response.status === 403) {
|
||||
const detail = await errorDetail(response);
|
||||
await setBackoff(AUTH_BACKOFF_MS);
|
||||
// A rejected key paralyses the whole reputation pipeline — surface
|
||||
// it once (cooldown-gated) so rotating the key is an ops priority.
|
||||
void raiseCrowdsecAlert("cti-auth", {
|
||||
type: "ddos",
|
||||
severity: "critical",
|
||||
message: `CrowdSec CTI API key rejected (HTTP 403): ${detail} — reputation lookups are paused for ${Math.round(AUTH_BACKOFF_MS / 60_000)} minutes. Rotate CROWDSEC_API_KEY.`,
|
||||
context: { status: 403, detail, backoffMs: AUTH_BACKOFF_MS },
|
||||
});
|
||||
throw new CrowdsecApiError(
|
||||
`CrowdSec API key rejected (HTTP 403): ${detail}`,
|
||||
);
|
||||
}
|
||||
if (response.status === 429) {
|
||||
await setBackoff(RATE_LIMIT_BACKOFF_MS);
|
||||
logger.warn("[crowdsec-api] CTI API rate limit hit — backing off", {
|
||||
ip,
|
||||
backoffMs: RATE_LIMIT_BACKOFF_MS,
|
||||
});
|
||||
void raiseCrowdsecAlert("cti-ratelimit", {
|
||||
type: "ddos",
|
||||
severity: "warning",
|
||||
message: `CrowdSec CTI API rate limited — all instances backed off for ${Math.round(RATE_LIMIT_BACKOFF_MS / 1000)}s.`,
|
||||
context: { status: 429, backoffMs: RATE_LIMIT_BACKOFF_MS },
|
||||
});
|
||||
return null;
|
||||
}
|
||||
if (!response.ok) {
|
||||
throw new CrowdsecApiError(
|
||||
`CrowdSec CTI API error (HTTP ${response.status}): ${await errorDetail(response)}`,
|
||||
);
|
||||
}
|
||||
|
||||
const item = (await response.json()) as CrowdsecSmokeItem;
|
||||
const verdict = parseVerdict(ip, item);
|
||||
await writeVerdictCache(verdict);
|
||||
return verdict;
|
||||
} catch (error) {
|
||||
logger.error("[crowdsec-api] CTI lookup failed", { ip, err: error });
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Consult the CrowdSec community reputation of an IP that just tripped a rate
|
||||
* bucket and hard-block it when the community flags it as known-bad. Safe to
|
||||
* call fire-and-forget from the hot path: it is never awaited by the caller,
|
||||
* does nothing when the API is not configured or the runtime toggle is off,
|
||||
* never shortens an already-active block, and never lets an API failure
|
||||
* surface to the request.
|
||||
*/
|
||||
export async function maybeAutoBlockCrowdsec(input: {
|
||||
ip: string;
|
||||
category: string;
|
||||
ttlSeconds: number;
|
||||
scoreThreshold: number;
|
||||
enabled: boolean;
|
||||
}): Promise<void> {
|
||||
const { ip, category, ttlSeconds, scoreThreshold, enabled } = input;
|
||||
if (!enabled) return;
|
||||
if (!crowdsecEnabled()) return;
|
||||
if (!ip || ip === UNKNOWN_CLIENT_IP) return;
|
||||
// The gate only ever reads its block key through shared Redis — without it
|
||||
// there is nowhere durable to record the block.
|
||||
if (!redis) return;
|
||||
if (Date.now() < (await getBackoffUntil())) return;
|
||||
|
||||
try {
|
||||
const verdict = await lookupCrowdsecVerdict(ip);
|
||||
if (!verdict || !verdictIsMalicious(verdict, scoreThreshold)) return;
|
||||
|
||||
const blockKey = `antiddos:block:${ip}`;
|
||||
const existingTtl = await redis.pttl(blockKey);
|
||||
// -2 = no key, -1 = no expiry; both fall through and get overwritten
|
||||
// with the CrowdSec TTL. An equal or longer block is left untouched.
|
||||
if (existingTtl >= ttlSeconds * 1000) return;
|
||||
|
||||
await redis.set(blockKey, CROWDSEC_BLOCK_SOURCE, "EX", ttlSeconds);
|
||||
// Record why this block exists so the admin panel can surface the
|
||||
// community reasoning (reputation, score, behaviors) for the IP.
|
||||
const meta: CrowdsecBlockMeta = {
|
||||
source: CROWDSEC_BLOCK_SOURCE,
|
||||
category,
|
||||
reputation: verdict.reputation,
|
||||
score: verdict.score,
|
||||
behaviors: verdict.behaviors,
|
||||
ttlSeconds,
|
||||
blockedAt: Date.now(),
|
||||
};
|
||||
try {
|
||||
await redis.set(
|
||||
`${BLOCK_META_PREFIX}${ip}`,
|
||||
JSON.stringify(meta),
|
||||
"EX",
|
||||
ttlSeconds,
|
||||
);
|
||||
} catch {
|
||||
// metadata is display sugar only — the block itself is already set.
|
||||
}
|
||||
// CrowdSec only records the block in the gate's own key. It never
|
||||
// creates Cloudflare edge rules — the gate's own escalation logic is
|
||||
// the only place that may mirror a host-level block to the edge.
|
||||
logger.info(
|
||||
"[crowdsec-api] Automatic IP block created from community reputation",
|
||||
{
|
||||
ip,
|
||||
category,
|
||||
ttlSeconds,
|
||||
reputation: verdict.reputation,
|
||||
score: verdict.score,
|
||||
behaviors: verdict.behaviors,
|
||||
},
|
||||
);
|
||||
// Opt-in community signal push (CAPI), fire-and-forget: never awaited,
|
||||
// never throws, and internally deduped per IP.
|
||||
void reportCrowdsecSignal({ ip, category, ttlSeconds, verdict, meta });
|
||||
// Daily histogram + burst detection (cooldown-gated ops alert).
|
||||
void bumpCrowdsecStat("blocks");
|
||||
void bumpCrowdsecBreakdownStat("category", category);
|
||||
if (verdict.reputation) {
|
||||
void bumpCrowdsecBreakdownStat("reputation", verdict.reputation);
|
||||
}
|
||||
void trackBlockBurst();
|
||||
} catch (error) {
|
||||
logger.error("[crowdsec-api] Automatic IP block failed", {
|
||||
ip,
|
||||
err: error,
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
let lastVerifyMemory: CrowdsecConnectionStatus | null = null;
|
||||
|
||||
/** Validate that the configured key can query the CTI (Enrichment) API. */
|
||||
export async function verifyCrowdsecConnection(): Promise<CrowdsecConnectionStatus> {
|
||||
const config = getCrowdsecApiConfig();
|
||||
if (!config.apiKey) {
|
||||
return {
|
||||
ok: false,
|
||||
message: "CROWDSEC_API_KEY is not configured",
|
||||
at: Date.now(),
|
||||
};
|
||||
}
|
||||
try {
|
||||
const response = await crowdsecRequest(`/smoke/${PROBE_IP}`);
|
||||
if (response.ok) {
|
||||
const item = (await response
|
||||
.json()
|
||||
.catch(() => null)) as CrowdsecSmokeItem | null;
|
||||
const reputation = item?.reputation
|
||||
? ` (reputation ${item.reputation})`
|
||||
: "";
|
||||
return {
|
||||
ok: true,
|
||||
message: `CTI key accepted — probed ${PROBE_IP}${reputation}`,
|
||||
at: Date.now(),
|
||||
};
|
||||
}
|
||||
if (response.status === 403) {
|
||||
return {
|
||||
ok: false,
|
||||
message: `API key rejected: ${await errorDetail(response)}`,
|
||||
at: Date.now(),
|
||||
};
|
||||
}
|
||||
if (response.status === 429) {
|
||||
return {
|
||||
ok: false,
|
||||
message: "CTI API rate limit reached — try again shortly",
|
||||
at: Date.now(),
|
||||
};
|
||||
}
|
||||
return {
|
||||
ok: false,
|
||||
message: `CrowdSec CTI API error (HTTP ${response.status}): ${await errorDetail(response)}`,
|
||||
at: Date.now(),
|
||||
};
|
||||
} catch (error) {
|
||||
return {
|
||||
ok: false,
|
||||
message:
|
||||
error instanceof Error ? error.message : "CrowdSec API unreachable",
|
||||
at: Date.now(),
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
export async function getLastCrowdsecVerify(): Promise<CrowdsecConnectionStatus | null> {
|
||||
if (redis) {
|
||||
try {
|
||||
const raw = await redis.get(LAST_VERIFY_KEY);
|
||||
if (raw) return JSON.parse(raw) as CrowdsecConnectionStatus;
|
||||
} catch {
|
||||
// fall back to the in-process view
|
||||
}
|
||||
}
|
||||
return lastVerifyMemory;
|
||||
}
|
||||
|
||||
export async function setLastCrowdsecVerify(
|
||||
status: CrowdsecConnectionStatus,
|
||||
): Promise<void> {
|
||||
lastVerifyMemory = status;
|
||||
if (redis) {
|
||||
try {
|
||||
await redis.set(LAST_VERIFY_KEY, JSON.stringify(status));
|
||||
} catch {
|
||||
// redis unavailable — in-process view is enough
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/** Why an IP is blocked by CrowdSec, when known. */
|
||||
export async function getCrowdsecBlockMeta(
|
||||
ip: string,
|
||||
): Promise<CrowdsecBlockMeta | null> {
|
||||
if (!redis) return null;
|
||||
try {
|
||||
const raw = await redis.get(`${BLOCK_META_PREFIX}${ip}`);
|
||||
if (!raw) return null;
|
||||
return JSON.parse(raw) as CrowdsecBlockMeta;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/** Test hook only — drop in-memory state between unit runs. */
|
||||
export function resetCrowdsecCache(): void {
|
||||
memoryVerdicts.clear();
|
||||
backoffUntil = 0;
|
||||
quotaWarnedDate = null;
|
||||
quotaExhaustedDate = null;
|
||||
lastVerifyMemory = null;
|
||||
}
|
||||
@@ -0,0 +1,195 @@
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
||||
import {
|
||||
checkCrowdsecLocalBlock,
|
||||
isBlockingCrowdsecDecision,
|
||||
parseCrowdsecDecisionDuration,
|
||||
resetCrowdsecLocalCache,
|
||||
} from "@/lib/crowdsec-local";
|
||||
|
||||
const state = vi.hoisted(() => ({
|
||||
map: new Map<string, string>(),
|
||||
sendAlert: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock("@/lib/services/alert", () => ({
|
||||
sendAlert: state.sendAlert,
|
||||
ddosDetected: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock("@/lib/redis", () => ({
|
||||
redis: {
|
||||
get: async (key: string) => state.map.get(key) ?? null,
|
||||
set: async (
|
||||
key: string,
|
||||
value: string,
|
||||
_mode?: string,
|
||||
_seconds?: number,
|
||||
nx?: string,
|
||||
) => {
|
||||
if (nx === "NX" && state.map.has(key)) return null;
|
||||
state.map.set(key, value);
|
||||
return "OK";
|
||||
},
|
||||
del: async (...keys: string[]) => {
|
||||
for (const key of keys) state.map.delete(key);
|
||||
return keys.length;
|
||||
},
|
||||
incr: async (key: string) => {
|
||||
const next = (Number(state.map.get(key)) || 0) + 1;
|
||||
state.map.set(key, String(next));
|
||||
return next;
|
||||
},
|
||||
expire: async () => 1,
|
||||
pexpire: async () => 1,
|
||||
pttl: async () => 60_000,
|
||||
},
|
||||
__esModule: true,
|
||||
}));
|
||||
|
||||
function jsonResponse(body: unknown, status = 200): Response {
|
||||
return new Response(JSON.stringify(body), {
|
||||
status,
|
||||
headers: { "content-type": "application/json" },
|
||||
});
|
||||
}
|
||||
|
||||
const IP = "198.51.100.11";
|
||||
const LAPI_URL = "http://127.0.0.1:18080";
|
||||
|
||||
describe("crowdsec-local app-layer bouncer", () => {
|
||||
let fetchMock: ReturnType<typeof vi.fn>;
|
||||
|
||||
beforeEach(() => {
|
||||
vi.unstubAllGlobals();
|
||||
vi.unstubAllEnvs();
|
||||
state.map.clear();
|
||||
resetCrowdsecLocalCache();
|
||||
fetchMock = vi.fn();
|
||||
vi.stubGlobal("fetch", fetchMock);
|
||||
vi.stubEnv("NODE_ENV", "production");
|
||||
vi.stubEnv("CROWDSEC_LOCAL_ENABLED", "true");
|
||||
vi.stubEnv("CROWDSEC_LAPI_URL", LAPI_URL);
|
||||
vi.stubEnv("CROWDSEC_LAPI_API_KEY", "test-local-key");
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
vi.unstubAllGlobals();
|
||||
vi.unstubAllEnvs();
|
||||
state.map.clear();
|
||||
resetCrowdsecLocalCache();
|
||||
});
|
||||
|
||||
it("does nothing when the local stack is not enabled", async () => {
|
||||
vi.stubEnv("CROWDSEC_LOCAL_ENABLED", "false");
|
||||
const result = await checkCrowdsecLocalBlock(IP);
|
||||
expect(result.blocked).toBe(false);
|
||||
expect(fetchMock).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("does nothing without a bouncer key", async () => {
|
||||
vi.stubEnv("CROWDSEC_LAPI_API_KEY", "");
|
||||
const result = await checkCrowdsecLocalBlock(IP);
|
||||
expect(result.blocked).toBe(false);
|
||||
expect(fetchMock).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("blocks an IP with a local ban decision and caches it", async () => {
|
||||
fetchMock.mockResolvedValue(
|
||||
jsonResponse([
|
||||
{
|
||||
origin: "crowdsec",
|
||||
type: "ban",
|
||||
scope: "ip",
|
||||
value: IP,
|
||||
duration: "4h",
|
||||
},
|
||||
]),
|
||||
);
|
||||
|
||||
const first = await checkCrowdsecLocalBlock(IP);
|
||||
expect(first.blocked).toBe(true);
|
||||
expect(first.retryAfterSeconds).toBeGreaterThan(0);
|
||||
expect(fetchMock).toHaveBeenCalledTimes(1);
|
||||
expect(String(fetchMock.mock.calls[0][0])).toContain(
|
||||
`/v1/decisions?ip=${IP}`,
|
||||
);
|
||||
|
||||
const second = await checkCrowdsecLocalBlock(IP);
|
||||
expect(second.blocked).toBe(true);
|
||||
expect(fetchMock).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("treats captcha decisions as blocks", async () => {
|
||||
fetchMock.mockResolvedValue(
|
||||
jsonResponse([{ type: "captcha", scope: "ip", value: IP }]),
|
||||
);
|
||||
const result = await checkCrowdsecLocalBlock(IP);
|
||||
expect(result.blocked).toBe(true);
|
||||
});
|
||||
|
||||
it("passes non-blocking decisions and caches the negative", async () => {
|
||||
fetchMock.mockResolvedValue(
|
||||
jsonResponse([{ type: "probation", scope: "ip", value: IP }]),
|
||||
);
|
||||
const first = await checkCrowdsecLocalBlock(IP);
|
||||
expect(first.blocked).toBe(false);
|
||||
const second = await checkCrowdsecLocalBlock(IP);
|
||||
expect(second.blocked).toBe(false);
|
||||
expect(fetchMock).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("fails open when LAPI errors and backs off", async () => {
|
||||
fetchMock.mockRejectedValueOnce(new Error("connection refused"));
|
||||
const first = await checkCrowdsecLocalBlock(IP);
|
||||
expect(first.blocked).toBe(false);
|
||||
await new Promise((resolve) => setTimeout(resolve, 5));
|
||||
const second = await checkCrowdsecLocalBlock(IP);
|
||||
expect(second.blocked).toBe(false);
|
||||
expect(fetchMock).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("backs off for five minutes when the bouncer key is rejected", async () => {
|
||||
fetchMock.mockResolvedValue(jsonResponse({ message: "forbidden" }, 403));
|
||||
const first = await checkCrowdsecLocalBlock(IP);
|
||||
expect(first.blocked).toBe(false);
|
||||
const second = await checkCrowdsecLocalBlock(IP);
|
||||
expect(second.blocked).toBe(false);
|
||||
expect(fetchMock).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("does not query the LAPI for the unknown-IP sentinel", async () => {
|
||||
const result = await checkCrowdsecLocalBlock("0.0.0.0");
|
||||
expect(result.blocked).toBe(false);
|
||||
expect(fetchMock).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
|
||||
describe("crowdsec-local decision parsing", () => {
|
||||
it("parses Go-style durations into seconds", () => {
|
||||
expect(parseCrowdsecDecisionDuration("3h51m57s")).toBe(
|
||||
3 * 3_600 + 51 * 60 + 57,
|
||||
);
|
||||
expect(parseCrowdsecDecisionDuration("500ms")).toBeCloseTo(0.5);
|
||||
expect(parseCrowdsecDecisionDuration("")).toBe(0);
|
||||
expect(parseCrowdsecDecisionDuration(null)).toBe(0);
|
||||
});
|
||||
|
||||
it("recognises only ban/captcha ip/range decisions", () => {
|
||||
expect(
|
||||
isBlockingCrowdsecDecision({ type: "ban", scope: "ip", value: IP }),
|
||||
).toBe(true);
|
||||
expect(
|
||||
isBlockingCrowdsecDecision({ type: "ban", scope: "range", value: IP }),
|
||||
).toBe(true);
|
||||
expect(
|
||||
isBlockingCrowdsecDecision({ type: "captcha", scope: "ip", value: IP }),
|
||||
).toBe(true);
|
||||
expect(
|
||||
isBlockingCrowdsecDecision({ type: "probation", scope: "ip", value: IP }),
|
||||
).toBe(false);
|
||||
expect(
|
||||
isBlockingCrowdsecDecision({ type: "ban", scope: "as", value: IP }),
|
||||
).toBe(false);
|
||||
expect(isBlockingCrowdsecDecision(null)).toBe(false);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,304 @@
|
||||
import "server-only";
|
||||
|
||||
import { env } from "@/env";
|
||||
import {
|
||||
bumpCrowdsecBreakdownStat,
|
||||
bumpCrowdsecStat,
|
||||
} from "@/lib/crowdsec-stats";
|
||||
import { logger } from "@/lib/logger";
|
||||
import { redis } from "@/lib/redis";
|
||||
import { UNKNOWN_CLIENT_IP } from "./client-ip";
|
||||
|
||||
export interface CrowdsecLocalDecision {
|
||||
origin?: string;
|
||||
scope?: string;
|
||||
type?: string;
|
||||
value?: string;
|
||||
duration?: string | null;
|
||||
}
|
||||
|
||||
export interface CrowdsecLocalBlockResult {
|
||||
blocked: boolean;
|
||||
retryAfterSeconds: number;
|
||||
}
|
||||
|
||||
const DEFAULT_LAPI_URL = "http://127.0.0.1:18080";
|
||||
const REQUEST_TIMEOUT_MS = 500;
|
||||
const NEGATIVE_CACHE_TTL_MS = 2_000;
|
||||
const DECISION_CACHE_TTL_MS = 300_000;
|
||||
const DECISION_RETRY_MAX_SECONDS = 300;
|
||||
const FALLBACK_RETRY_SECONDS = 60;
|
||||
const BACKOFF_MS = 5_000;
|
||||
const AUTH_BACKOFF_MS = 300_000;
|
||||
const MEMORY_CACHE_MAX = 5_000;
|
||||
const CACHE_PREFIX = "crowdsec:local:";
|
||||
const BACKOFF_KEY = "crowdsec:local:backoff-until";
|
||||
|
||||
const DURATION_TOKEN = /(\d+(?:\.\d+)?)(ns|us|µs|ms|s|m|h)/g;
|
||||
|
||||
export function parseCrowdsecDecisionDuration(
|
||||
value: string | null | undefined,
|
||||
): number {
|
||||
if (!value) return 0;
|
||||
let total = 0;
|
||||
for (const match of value.matchAll(DURATION_TOKEN)) {
|
||||
const amount = Number(match[1]);
|
||||
if (!Number.isFinite(amount)) continue;
|
||||
const unit = match[2];
|
||||
if (unit === "h") total += amount * 3_600;
|
||||
else if (unit === "m") total += amount * 60;
|
||||
else if (unit === "s") total += amount;
|
||||
else if (unit === "ms") total += amount / 1_000;
|
||||
else if (unit === "us" || unit === "µs") total += amount / 1_000_000;
|
||||
else if (unit === "ns") total += amount / 1_000_000_000;
|
||||
}
|
||||
return total;
|
||||
}
|
||||
|
||||
export function isBlockingCrowdsecDecision(
|
||||
decision: CrowdsecLocalDecision | null | undefined,
|
||||
): boolean {
|
||||
if (!decision) return false;
|
||||
const type = decision.type?.toLowerCase();
|
||||
const scope = decision.scope?.toLowerCase();
|
||||
if ((type !== "ban" && type !== "captcha") || !decision.value) return false;
|
||||
return scope === "ip" || scope === "range";
|
||||
}
|
||||
|
||||
function localEnabled(): boolean {
|
||||
const flag: unknown = env.CROWDSEC_LOCAL_ENABLED;
|
||||
return flag === true || flag === "true" || flag === "1";
|
||||
}
|
||||
|
||||
function localConfig(): {
|
||||
url: string;
|
||||
apiKey: string;
|
||||
timeoutMs: number;
|
||||
} {
|
||||
return {
|
||||
url: (env.CROWDSEC_LAPI_URL || DEFAULT_LAPI_URL).replace(/\/+$/, ""),
|
||||
apiKey: String(env.CROWDSEC_LAPI_API_KEY ?? "").trim(),
|
||||
timeoutMs:
|
||||
Number(env.CROWDSEC_LAPI_TIMEOUT_MS) > 0
|
||||
? Number(env.CROWDSEC_LAPI_TIMEOUT_MS)
|
||||
: REQUEST_TIMEOUT_MS,
|
||||
};
|
||||
}
|
||||
|
||||
interface CacheEntry {
|
||||
blocked: boolean;
|
||||
retryAfterSeconds: number;
|
||||
until: number;
|
||||
}
|
||||
|
||||
const memoryCache = new Map<string, CacheEntry>();
|
||||
|
||||
let backoffUntil = 0;
|
||||
let authBackoffWarned = false;
|
||||
|
||||
async function rememberCache(
|
||||
ip: string,
|
||||
entry: CacheEntry,
|
||||
ttlMs: number,
|
||||
): Promise<void> {
|
||||
memoryCache.delete(ip);
|
||||
memoryCache.set(ip, entry);
|
||||
while (memoryCache.size > MEMORY_CACHE_MAX) {
|
||||
const oldest = memoryCache.keys().next();
|
||||
if (oldest.done) break;
|
||||
memoryCache.delete(oldest.value);
|
||||
}
|
||||
if (!redis) return;
|
||||
try {
|
||||
await redis.set(
|
||||
`${CACHE_PREFIX}block:${ip}`,
|
||||
JSON.stringify(entry),
|
||||
"EX",
|
||||
Math.max(1, Math.ceil(ttlMs / 1_000)),
|
||||
);
|
||||
} catch {
|
||||
// Cache is best-effort — a miss only costs one extra LAPI call.
|
||||
}
|
||||
}
|
||||
|
||||
async function readCache(ip: string): Promise<CacheEntry | null> {
|
||||
const memory = memoryCache.get(ip);
|
||||
if (memory && memory.until > Date.now()) return memory;
|
||||
if (redis) {
|
||||
try {
|
||||
const raw = await redis.get(`${CACHE_PREFIX}block:${ip}`);
|
||||
if (raw) {
|
||||
const parsed = JSON.parse(raw) as CacheEntry;
|
||||
if (parsed.until > Date.now()) return parsed;
|
||||
}
|
||||
} catch {
|
||||
// Redis hiccup — an extra local LAPI call is the only cost.
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
async function getBackoffUntil(): Promise<number> {
|
||||
if (Date.now() < backoffUntil) return backoffUntil;
|
||||
if (redis) {
|
||||
try {
|
||||
const raw = await redis.get(BACKOFF_KEY);
|
||||
const shared = Number(raw ?? 0);
|
||||
if (Number.isFinite(shared) && shared > backoffUntil) {
|
||||
backoffUntil = shared;
|
||||
}
|
||||
} catch {
|
||||
// Redis hiccup — the local view is enough.
|
||||
}
|
||||
}
|
||||
return backoffUntil;
|
||||
}
|
||||
|
||||
async function setBackoff(ms: number): Promise<void> {
|
||||
const until = Date.now() + ms;
|
||||
backoffUntil = until;
|
||||
if (redis) {
|
||||
try {
|
||||
await redis.set(
|
||||
BACKOFF_KEY,
|
||||
String(until),
|
||||
"EX",
|
||||
Math.ceil(ms / 1_000) + 1,
|
||||
);
|
||||
} catch {
|
||||
// Local view still protects this instance.
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function decisionRetrySeconds(decision: CrowdsecLocalDecision | null): number {
|
||||
const parsed = decision
|
||||
? parseCrowdsecDecisionDuration(decision.duration)
|
||||
: 0;
|
||||
if (parsed <= 0) return FALLBACK_RETRY_SECONDS;
|
||||
return Math.min(Math.max(1, Math.floor(parsed)), DECISION_RETRY_MAX_SECONDS);
|
||||
}
|
||||
|
||||
async function queryLocalDecision(
|
||||
baseUrl: string,
|
||||
apiKey: string,
|
||||
timeoutMs: number,
|
||||
ip: string,
|
||||
): Promise<CrowdsecLocalDecision | null> {
|
||||
const controller = new AbortController();
|
||||
const timer = setTimeout(() => controller.abort(), timeoutMs);
|
||||
try {
|
||||
const response = await fetch(
|
||||
`${baseUrl}/v1/decisions?ip=${encodeURIComponent(ip)}`,
|
||||
{
|
||||
headers: {
|
||||
"X-Api-Key": apiKey,
|
||||
Accept: "application/json",
|
||||
},
|
||||
signal: controller.signal,
|
||||
cache: "no-store",
|
||||
},
|
||||
);
|
||||
if (response.status === 401 || response.status === 403) {
|
||||
await setBackoff(AUTH_BACKOFF_MS);
|
||||
if (!authBackoffWarned) {
|
||||
authBackoffWarned = true;
|
||||
logger.warn(
|
||||
"[crowdsec-local] LAPI rejected the bouncer key — local decisions paused for 5 minutes",
|
||||
{ status: response.status },
|
||||
);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
if (!response.ok) {
|
||||
await setBackoff(BACKOFF_MS);
|
||||
logger.warn(
|
||||
"[crowdsec-local] LAPI decision request failed — failing open",
|
||||
{ ip, status: response.status },
|
||||
);
|
||||
return null;
|
||||
}
|
||||
const body = (await response.json()) as unknown;
|
||||
if (!Array.isArray(body)) return null;
|
||||
return body.find(isBlockingCrowdsecDecision) ?? null;
|
||||
} catch (error) {
|
||||
await setBackoff(BACKOFF_MS);
|
||||
logger.warn(
|
||||
"[crowdsec-local] LAPI decision request errored — failing open",
|
||||
{
|
||||
ip,
|
||||
error: error instanceof Error ? error.message : String(error),
|
||||
},
|
||||
);
|
||||
return null;
|
||||
} finally {
|
||||
clearTimeout(timer);
|
||||
}
|
||||
}
|
||||
|
||||
export async function checkCrowdsecLocalBlock(
|
||||
ip: string,
|
||||
): Promise<CrowdsecLocalBlockResult> {
|
||||
if (!localEnabled()) return { blocked: false, retryAfterSeconds: 0 };
|
||||
const config = localConfig();
|
||||
if (!config.apiKey) return { blocked: false, retryAfterSeconds: 0 };
|
||||
if (!ip || ip === UNKNOWN_CLIENT_IP) {
|
||||
return { blocked: false, retryAfterSeconds: 0 };
|
||||
}
|
||||
|
||||
if (Date.now() < (await getBackoffUntil())) {
|
||||
return { blocked: false, retryAfterSeconds: 0 };
|
||||
}
|
||||
|
||||
const cached = await readCache(ip);
|
||||
if (cached && cached.until > Date.now()) {
|
||||
return {
|
||||
blocked: cached.blocked,
|
||||
retryAfterSeconds: cached.blocked ? cached.retryAfterSeconds : 0,
|
||||
};
|
||||
}
|
||||
|
||||
const decision = await queryLocalDecision(
|
||||
config.url,
|
||||
config.apiKey,
|
||||
config.timeoutMs,
|
||||
ip,
|
||||
);
|
||||
if (decision) {
|
||||
const retryAfterSeconds = decisionRetrySeconds(decision);
|
||||
await rememberCache(
|
||||
ip,
|
||||
{
|
||||
blocked: true,
|
||||
retryAfterSeconds,
|
||||
until: Date.now() + DECISION_CACHE_TTL_MS,
|
||||
},
|
||||
DECISION_CACHE_TTL_MS,
|
||||
);
|
||||
void bumpCrowdsecStat("blocks");
|
||||
void bumpCrowdsecBreakdownStat("category", "local");
|
||||
logger.info("[crowdsec-local] IP blocked by a local CrowdSec decision", {
|
||||
ip,
|
||||
type: decision.type,
|
||||
retryAfterSeconds,
|
||||
});
|
||||
return { blocked: true, retryAfterSeconds };
|
||||
}
|
||||
|
||||
await rememberCache(
|
||||
ip,
|
||||
{
|
||||
blocked: false,
|
||||
retryAfterSeconds: 0,
|
||||
until: Date.now() + NEGATIVE_CACHE_TTL_MS,
|
||||
},
|
||||
NEGATIVE_CACHE_TTL_MS,
|
||||
);
|
||||
return { blocked: false, retryAfterSeconds: 0 };
|
||||
}
|
||||
|
||||
export function resetCrowdsecLocalCache(): void {
|
||||
memoryCache.clear();
|
||||
backoffUntil = 0;
|
||||
authBackoffWarned = false;
|
||||
}
|
||||
@@ -0,0 +1,378 @@
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
||||
import type { CrowdsecVerdict } from "./crowdsec-api";
|
||||
import {
|
||||
type CrowdsecReportStatus,
|
||||
crowdsecReportEnabled,
|
||||
getLastCrowdsecReport,
|
||||
reportCrowdsecSignal,
|
||||
resetCrowdsecReportCache,
|
||||
verifyCrowdsecReporting,
|
||||
} from "./crowdsec-report";
|
||||
|
||||
// The signal-push watcher is tested against a deterministic in-memory Redis
|
||||
// fake (NX lock + token cache) and a mocked fetch that routes the CAPI paths.
|
||||
const state = vi.hoisted(() => ({
|
||||
map: new Map<string, string>(),
|
||||
sendAlert: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock("@/lib/redis", () => ({
|
||||
redis: {
|
||||
get: async (key: string) => state.map.get(key) ?? null,
|
||||
set: async (
|
||||
key: string,
|
||||
value: string,
|
||||
_mode?: string,
|
||||
_seconds?: number,
|
||||
nx?: string,
|
||||
) => {
|
||||
if (nx === "NX" && state.map.has(key)) return null;
|
||||
state.map.set(key, value);
|
||||
return "OK";
|
||||
},
|
||||
del: async (...keys: string[]) => {
|
||||
for (const key of keys) state.map.delete(key);
|
||||
return keys.length;
|
||||
},
|
||||
incr: async (key: string) => {
|
||||
const next = (Number(state.map.get(key)) || 0) + 1;
|
||||
state.map.set(key, String(next));
|
||||
return next;
|
||||
},
|
||||
expire: async () => 1,
|
||||
},
|
||||
__esModule: true,
|
||||
}));
|
||||
|
||||
vi.mock("@/lib/logger", () => ({
|
||||
logger: {
|
||||
info: vi.fn(),
|
||||
warn: vi.fn(),
|
||||
error: vi.fn(),
|
||||
debug: vi.fn(),
|
||||
},
|
||||
}));
|
||||
|
||||
vi.mock("@/lib/services/alert", () => ({
|
||||
sendAlert: state.sendAlert,
|
||||
ddosDetected: vi.fn(),
|
||||
}));
|
||||
|
||||
const tick = () => new Promise((resolve) => setTimeout(resolve, 20));
|
||||
|
||||
const CAPI = "https://capi.example.test/v3";
|
||||
const MACHINE = "m".repeat(48);
|
||||
const PASSWORD = "Strong!1P@ssw0rdStrong!1P@ssw0rd";
|
||||
|
||||
function jsonResponse(body: unknown, status = 200): Response {
|
||||
return new Response(JSON.stringify(body), {
|
||||
status,
|
||||
headers: { "content-type": "application/json" },
|
||||
});
|
||||
}
|
||||
|
||||
function signalInput(ip = "198.51.100.9") {
|
||||
const verdict: CrowdsecVerdict = {
|
||||
ip,
|
||||
reputation: "malicious",
|
||||
score: 5,
|
||||
aggressiveness: 4,
|
||||
confidence: "0.95",
|
||||
behaviors: ["http:bruteforce", "http:scan"],
|
||||
falsePositive: false,
|
||||
checkedAt: Date.now(),
|
||||
};
|
||||
return {
|
||||
ip,
|
||||
category: "api",
|
||||
ttlSeconds: 86_400,
|
||||
verdict,
|
||||
meta: {
|
||||
source: "crowdsec" as const,
|
||||
category: "api",
|
||||
reputation: verdict.reputation,
|
||||
score: verdict.score,
|
||||
behaviors: verdict.behaviors,
|
||||
ttlSeconds: 86_400,
|
||||
blockedAt: Date.now(),
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
describe("crowdsec-report", () => {
|
||||
let fetchMock: ReturnType<typeof vi.fn>;
|
||||
|
||||
function routeCapi(overrides: Record<string, number> = {}) {
|
||||
const statusFor = (path: string) =>
|
||||
overrides[path] ?? (path === "/signals" ? 200 : 200);
|
||||
fetchMock.mockImplementation((url: string) => {
|
||||
const path = String(url).replace(CAPI, "");
|
||||
const status = statusFor(path);
|
||||
if (status !== 200) {
|
||||
return Promise.resolve(jsonResponse({ message: "boom" }, status));
|
||||
}
|
||||
if (path === "/watchers/login") {
|
||||
return Promise.resolve(
|
||||
jsonResponse({
|
||||
token: "jwt-xyz",
|
||||
expire: new Date(Date.now() + 3_600_000).toISOString(),
|
||||
}),
|
||||
);
|
||||
}
|
||||
return Promise.resolve(jsonResponse({}));
|
||||
});
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
vi.unstubAllGlobals();
|
||||
vi.unstubAllEnvs();
|
||||
state.map.clear();
|
||||
state.sendAlert.mockReset();
|
||||
resetCrowdsecReportCache();
|
||||
fetchMock = vi.fn();
|
||||
vi.stubGlobal("fetch", fetchMock);
|
||||
vi.stubEnv("CROWDSEC_REPORT_ENABLED", "true");
|
||||
vi.stubEnv("CROWDSEC_REPORT_MACHINE_ID", MACHINE);
|
||||
vi.stubEnv("CROWDSEC_REPORT_PASSWORD", PASSWORD);
|
||||
vi.stubEnv("CROWDSEC_CAPI_BASE_URL", CAPI);
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
vi.unstubAllGlobals();
|
||||
vi.unstubAllEnvs();
|
||||
state.map.clear();
|
||||
resetCrowdsecReportCache();
|
||||
vi.restoreAllMocks();
|
||||
});
|
||||
|
||||
it("is enabled only when the toggle and credentials are present", async () => {
|
||||
expect(await crowdsecReportEnabled()).toBe(true);
|
||||
|
||||
vi.stubEnv("CROWDSEC_REPORT_ENABLED", "");
|
||||
resetCrowdsecReportCache();
|
||||
expect(await crowdsecReportEnabled()).toBe(false);
|
||||
|
||||
// Machine id supplied but no password: falls back to generating a
|
||||
// stable credential pair persisted in Redis.
|
||||
vi.stubEnv("CROWDSEC_REPORT_ENABLED", "true");
|
||||
vi.stubEnv("CROWDSEC_REPORT_PASSWORD", "");
|
||||
resetCrowdsecReportCache();
|
||||
expect(await crowdsecReportEnabled()).toBe(true);
|
||||
const storedMachine = state.map.get("crowdsec:report:machine");
|
||||
expect(storedMachine).toMatch(/^[A-Za-z0-9]{48}$/);
|
||||
expect(state.map.get("crowdsec:report:pass")).toBeTruthy();
|
||||
});
|
||||
|
||||
it("does nothing when the channel is disabled", async () => {
|
||||
vi.stubEnv("CROWDSEC_REPORT_ENABLED", "");
|
||||
resetCrowdsecReportCache();
|
||||
|
||||
await reportCrowdsecSignal(signalInput());
|
||||
expect(fetchMock).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("registers once, caches the token and pushes one signal per IP", async () => {
|
||||
routeCapi();
|
||||
|
||||
await reportCrowdsecSignal(signalInput("198.51.100.10"));
|
||||
await reportCrowdsecSignal(signalInput("198.51.100.11"));
|
||||
await reportCrowdsecSignal(signalInput("198.51.100.10"));
|
||||
// Let the fire-and-forget network body land.
|
||||
await new Promise((resolve) => setTimeout(resolve, 20));
|
||||
|
||||
const urls = fetchMock.mock.calls.map((call) => String(call[0]));
|
||||
expect(urls.filter((u) => u.endsWith("/watchers/register"))).toHaveLength(
|
||||
1,
|
||||
);
|
||||
expect(urls.filter((u) => u.endsWith("/watchers/login"))).toHaveLength(1);
|
||||
expect(urls.filter((u) => u.endsWith("/signals"))).toHaveLength(2);
|
||||
// No enrollment requested without an attachment key.
|
||||
expect(urls.some((u) => u.endsWith("/watchers/enroll"))).toBe(false);
|
||||
});
|
||||
|
||||
it("builds a well-formed CrowdSec signal with a ban decision", async () => {
|
||||
routeCapi();
|
||||
|
||||
await reportCrowdsecSignal(signalInput());
|
||||
await new Promise((resolve) => setTimeout(resolve, 20));
|
||||
|
||||
const signalsCall = fetchMock.mock.calls.find((call) =>
|
||||
String(call[0]).endsWith("/signals"),
|
||||
);
|
||||
expect(signalsCall).toBeDefined();
|
||||
if (!signalsCall) throw new Error("expected a /signals call");
|
||||
const init = signalsCall[1] as {
|
||||
body: string;
|
||||
headers: Record<string, string>;
|
||||
};
|
||||
const body = JSON.parse(init.body) as Record<string, unknown>[];
|
||||
expect(body).toHaveLength(1);
|
||||
const signal = body[0] as {
|
||||
machine_id: string;
|
||||
scenario: string;
|
||||
scenario_version: string;
|
||||
source: { scope: string; value: string; ip: string };
|
||||
decisions: {
|
||||
scope: string;
|
||||
type: string;
|
||||
value: string;
|
||||
duration: string;
|
||||
}[];
|
||||
context: { key: string; value: string }[];
|
||||
created_at: string;
|
||||
start_at: string;
|
||||
stop_at: string;
|
||||
};
|
||||
expect(signal.machine_id).toBe(MACHINE);
|
||||
expect(signal.scenario).toBe("community/anti-ddos-block");
|
||||
expect(signal.scenario_version).toBe("1.0.0");
|
||||
expect(signal.source).toEqual({
|
||||
scope: "ip",
|
||||
value: "198.51.100.9",
|
||||
ip: "198.51.100.9",
|
||||
});
|
||||
expect(signal.decisions).toHaveLength(1);
|
||||
expect(signal.decisions[0]).toMatchObject({
|
||||
origin: "crowdsec",
|
||||
scope: "ip",
|
||||
type: "ban",
|
||||
value: "198.51.100.9",
|
||||
});
|
||||
expect(String(signal.decisions[0].duration)).toMatch(/^24h0m0s$/);
|
||||
for (const key of ["created_at", "start_at", "stop_at"] as const) {
|
||||
expect(typeof signal[key]).toBe("string");
|
||||
}
|
||||
expect(
|
||||
signal.context.find((c) => c.key === "crowdsec_reputation")?.value,
|
||||
).toBe("malicious");
|
||||
});
|
||||
|
||||
it("records a healthy last-report state after a successful push", async () => {
|
||||
routeCapi();
|
||||
await reportCrowdsecSignal(signalInput());
|
||||
await new Promise((resolve) => setTimeout(resolve, 20));
|
||||
const last = await getLastCrowdsecReport();
|
||||
expect(last?.ok).toBe(true);
|
||||
});
|
||||
|
||||
it("never throws and logs the failure when the CAPI rejects the signal", async () => {
|
||||
fetchMock.mockImplementation((url: string) => {
|
||||
const path = String(url).replace(CAPI, "");
|
||||
if (path === "/watchers/login") {
|
||||
return Promise.resolve(
|
||||
jsonResponse({
|
||||
token: "jwt-xyz",
|
||||
expire: new Date(Date.now() + 3_600_000).toISOString(),
|
||||
}),
|
||||
);
|
||||
}
|
||||
if (path === "/signals") {
|
||||
return Promise.resolve(jsonResponse({ message: "boom" }, 500));
|
||||
}
|
||||
return Promise.resolve(jsonResponse({}));
|
||||
});
|
||||
|
||||
await expect(reportCrowdsecSignal(signalInput())).resolves.toBeUndefined();
|
||||
await tick();
|
||||
const last: CrowdsecReportStatus | null = await getLastCrowdsecReport();
|
||||
expect(last?.ok).toBe(false);
|
||||
expect(last?.message).toContain("signal push rejected");
|
||||
});
|
||||
|
||||
it("counts a failed push and raises a cooldown-gated ops alert", async () => {
|
||||
fetchMock.mockImplementation((url: string) => {
|
||||
const path = String(url).replace(CAPI, "");
|
||||
if (path === "/watchers/login") {
|
||||
return Promise.resolve(
|
||||
jsonResponse({
|
||||
token: "jwt-xyz",
|
||||
expire: new Date(Date.now() + 3_600_000).toISOString(),
|
||||
}),
|
||||
);
|
||||
}
|
||||
if (path === "/signals") {
|
||||
return Promise.resolve(jsonResponse({ message: "boom" }, 500));
|
||||
}
|
||||
return Promise.resolve(jsonResponse({}));
|
||||
});
|
||||
|
||||
await reportCrowdsecSignal(signalInput("198.51.100.20"));
|
||||
await tick();
|
||||
const today = new Date().toISOString().slice(0, 10);
|
||||
expect(state.map.get(`crowdsec:stat:report_fail:${today}`)).toBe("1");
|
||||
expect(state.sendAlert).toHaveBeenCalledTimes(1);
|
||||
const [input] = state.sendAlert.mock.calls[0];
|
||||
expect(input.type).toBe("ddos");
|
||||
expect(input.severity).toBe("warning");
|
||||
expect(input.context).toMatchObject({ ip: "198.51.100.20" });
|
||||
|
||||
// A second failed push inside the cooldown window stays silent.
|
||||
await reportCrowdsecSignal(signalInput("198.51.100.21"));
|
||||
await tick();
|
||||
expect(state.sendAlert).toHaveBeenCalledTimes(1);
|
||||
expect(state.map.get(`crowdsec:stat:report_fail:${today}`)).toBe("2");
|
||||
});
|
||||
|
||||
it("tallies successful pushes into the daily stats histogram", async () => {
|
||||
routeCapi();
|
||||
await reportCrowdsecSignal(signalInput("198.51.100.30"));
|
||||
await reportCrowdsecSignal(signalInput("198.51.100.31"));
|
||||
await tick();
|
||||
const today = new Date().toISOString().slice(0, 10);
|
||||
expect(state.map.get(`crowdsec:stat:reports:${today}`)).toBe("2");
|
||||
expect(state.sendAlert).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("raises an info alert the first time the channel heals after failures", async () => {
|
||||
fetchMock.mockImplementation((url: string) => {
|
||||
const path = String(url).replace(CAPI, "");
|
||||
if (path === "/watchers/login") {
|
||||
return Promise.resolve(
|
||||
jsonResponse({
|
||||
token: "jwt-xyz",
|
||||
expire: new Date(Date.now() + 3_600_000).toISOString(),
|
||||
}),
|
||||
);
|
||||
}
|
||||
if (path === "/signals") {
|
||||
return Promise.resolve(jsonResponse({ message: "boom" }, 500));
|
||||
}
|
||||
return Promise.resolve(jsonResponse({}));
|
||||
});
|
||||
|
||||
await reportCrowdsecSignal(signalInput("198.51.100.40"));
|
||||
await tick();
|
||||
expect(state.sendAlert).toHaveBeenCalledTimes(1);
|
||||
expect((await getLastCrowdsecReport())?.ok).toBe(false);
|
||||
|
||||
// Channel heals: the first success after a failure is worth a notice.
|
||||
routeCapi();
|
||||
await reportCrowdsecSignal(signalInput("198.51.100.41"));
|
||||
await tick();
|
||||
const last: CrowdsecReportStatus | null = await getLastCrowdsecReport();
|
||||
expect(last?.ok).toBe(true);
|
||||
|
||||
expect(state.sendAlert).toHaveBeenCalledTimes(2);
|
||||
const alerts = state.sendAlert.mock.calls.map(([input]) => input);
|
||||
expect(alerts[0].severity).toBe("warning");
|
||||
expect(alerts[1].severity).toBe("info");
|
||||
expect(alerts[1].message).toContain("recovered");
|
||||
expect(alerts[1].context).toMatchObject({ ip: "198.51.100.41" });
|
||||
});
|
||||
|
||||
it("verifies the watcher channel end to end", async () => {
|
||||
routeCapi();
|
||||
const status = await verifyCrowdsecReporting();
|
||||
expect(status.ok).toBe(true);
|
||||
expect(String(fetchMock.mock.calls[0][0])).toContain("/watchers/register");
|
||||
});
|
||||
|
||||
it("reports a clear reason when verification is impossible", async () => {
|
||||
vi.stubEnv("CROWDSEC_REPORT_ENABLED", "");
|
||||
resetCrowdsecReportCache();
|
||||
const status = await verifyCrowdsecReporting();
|
||||
expect(status.ok).toBe(false);
|
||||
expect(status.message).toContain("CROWDSEC_REPORT_ENABLED");
|
||||
expect(fetchMock).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,571 @@
|
||||
import "server-only";
|
||||
|
||||
import { createHash, randomBytes } from "node:crypto";
|
||||
import { env } from "@/env";
|
||||
import { raiseCrowdsecAlert } from "@/lib/crowdsec-alerts";
|
||||
import type {
|
||||
CrowdsecBlockMeta,
|
||||
CrowdsecConnectionStatus,
|
||||
CrowdsecVerdict,
|
||||
} from "@/lib/crowdsec-api";
|
||||
import { bumpCrowdsecStat } from "@/lib/crowdsec-stats";
|
||||
import { logger } from "@/lib/logger";
|
||||
import { redis } from "@/lib/redis";
|
||||
import { UNKNOWN_CLIENT_IP } from "./client-ip";
|
||||
|
||||
/**
|
||||
* CrowdSec Central API (CAPI) signal push — the "give back" side of the
|
||||
* anti-DDoS pipeline.
|
||||
*
|
||||
* When the gate blocks an IP based on the CTI community reputation, this
|
||||
* module reports that detection back to CrowdSec (POST /v3/signals) so the
|
||||
* community blocklist also protects every other member. Strictly opt-in
|
||||
* (CROWDSEC_REPORT_ENABLED) and always fire-and-forget: a failure here never
|
||||
* blocks the hot path, never throws to the caller, and records the last
|
||||
* outcome for the admin panel.
|
||||
*
|
||||
* A plain CTI API key cannot push signals, so we act as a CAPI "watcher":
|
||||
* 1. generate/load a stable 48-char alnum machine_id + password pair
|
||||
* (persisted in Redis when not provided via env),
|
||||
* 2. register it once (POST /v3/watchers/register),
|
||||
* 3. login to obtain a JWT (POST /v3/watchers/login), cached in Redis and
|
||||
* refreshed against its expiry,
|
||||
* 4. optional console enrollment via attachment key (POST /v3/watchers/enroll),
|
||||
* 5. push the block as a signal (POST /v3/signals), deduped per IP.
|
||||
*/
|
||||
|
||||
const API_TIMEOUT_MS = 10_000;
|
||||
const TOKEN_CACHE_KEY = "crowdsec:report:token";
|
||||
const MACHINE_KEY = "crowdsec:report:machine";
|
||||
const PASSWORD_KEY = "crowdsec:report:pass";
|
||||
const REGISTERED_KEY = "crowdsec:report:registered";
|
||||
const ENROLLED_KEY = "crowdsec:report:enrolled";
|
||||
const LAST_REPORT_KEY = "crowdsec:last-report";
|
||||
const REPORT_LOCK_PREFIX = "crowdsec:report:";
|
||||
/** An IP is only reported once per window — the block itself already deters. */
|
||||
const REPORT_DEDUPE_SECONDS = 6 * 3_600;
|
||||
const SCENARIO = "community/anti-ddos-block";
|
||||
const SCENARIO_VERSION = "1.0.0";
|
||||
|
||||
export class CrowdsecReportError extends Error {}
|
||||
|
||||
/** True when the reporting channel is switched on AND usable. */
|
||||
export async function crowdsecReportEnabled(): Promise<boolean> {
|
||||
// Production parses CROWDSEC_REPORT_ENABLED to a boolean via zod; tests
|
||||
// (SKIP_ENV_VALIDATION) expose the raw env string, so accept both forms.
|
||||
const flag: unknown = env.CROWDSEC_REPORT_ENABLED;
|
||||
if (flag !== true && flag !== "true" && flag !== "1") return false;
|
||||
return (await loadReportCredentials()) !== null;
|
||||
}
|
||||
|
||||
function isAlnum48(value: string): boolean {
|
||||
return /^[A-Za-z0-9]{48}$/.test(value);
|
||||
}
|
||||
|
||||
function generateMachineId(): string {
|
||||
// CAPI schema: exactly 48 characters, [A-Za-z0-9].
|
||||
const alphabet =
|
||||
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
|
||||
const bytes = randomBytes(48);
|
||||
let id = "";
|
||||
for (let i = 0; i < 48; i += 1) {
|
||||
id += alphabet[bytes[i] % alphabet.length];
|
||||
}
|
||||
return id;
|
||||
}
|
||||
|
||||
function generatePassword(): string {
|
||||
// Deliberately generous: each class is present so common password-policy
|
||||
// rules on the CAPI side are satisfied.
|
||||
const upper = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
|
||||
const lower = "abcdefghijklmnopqrstuvwxyz";
|
||||
const digits = "0123456789";
|
||||
const symbols = "!@#$%^&*()-_=+[]{};:,.?";
|
||||
const charset = `${upper}${lower}${digits}${symbols}`;
|
||||
const bytes = randomBytes(32);
|
||||
let password = "";
|
||||
for (let i = 0; i < 8; i += 1) {
|
||||
// Guarantee at least one of each class.
|
||||
const pool = [upper, lower, digits, symbols][i % 4];
|
||||
password += pool[bytes[i] % pool.length];
|
||||
}
|
||||
for (let i = 8; i < 32; i += 1) {
|
||||
password += charset[bytes[i] % charset.length];
|
||||
}
|
||||
return password;
|
||||
}
|
||||
|
||||
interface ReportCredentials {
|
||||
machineId: string;
|
||||
password: string;
|
||||
}
|
||||
|
||||
let credentialsCache: ReportCredentials | null = null;
|
||||
let credentialsMissingRedisWarned = false;
|
||||
|
||||
/**
|
||||
* Load the configured watcher credentials, or generate a stable pair and
|
||||
* persist it in Redis so restarts and other instances reuse the same identity.
|
||||
*/
|
||||
async function loadReportCredentials(): Promise<ReportCredentials | null> {
|
||||
if (credentialsCache) return credentialsCache;
|
||||
const envMachine = env.CROWDSEC_REPORT_MACHINE_ID?.trim();
|
||||
const envPassword = env.CROWDSEC_REPORT_PASSWORD;
|
||||
if (envMachine && envPassword) {
|
||||
credentialsCache = { machineId: envMachine, password: envPassword };
|
||||
return credentialsCache;
|
||||
}
|
||||
if (!redis) {
|
||||
if (!credentialsMissingRedisWarned) {
|
||||
credentialsMissingRedisWarned = true;
|
||||
logger.warn(
|
||||
"[crowdsec-report] Redis is required to persist auto-generated watcher credentials — set CROWDSEC_REPORT_MACHINE_ID and CROWDSEC_REPORT_PASSWORD, or REDIS_URL",
|
||||
);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
try {
|
||||
let machineId: string | null = null;
|
||||
let password: string | null = null;
|
||||
const storedMachine = await redis.get(MACHINE_KEY);
|
||||
const storedPassword = await redis.get(PASSWORD_KEY);
|
||||
if (storedMachine && isAlnum48(storedMachine)) machineId = storedMachine;
|
||||
if (storedPassword) password = storedPassword;
|
||||
if (!machineId) machineId = generateMachineId();
|
||||
if (!password) password = generatePassword();
|
||||
await redis.set(MACHINE_KEY, machineId);
|
||||
await redis.set(PASSWORD_KEY, password);
|
||||
credentialsCache = { machineId, password };
|
||||
return credentialsCache;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
async function capiRequest(
|
||||
path: string,
|
||||
init: { method?: "POST" | "GET"; token?: string; body?: unknown } = {},
|
||||
): Promise<Response> {
|
||||
const controller = new AbortController();
|
||||
const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
|
||||
const headers: Record<string, string> = {
|
||||
Accept: "application/json",
|
||||
"Content-Type": "application/json",
|
||||
};
|
||||
if (init.token) headers.Authorization = `Bearer ${init.token}`;
|
||||
try {
|
||||
return await fetch(`${env.CROWDSEC_CAPI_BASE_URL}${path}`, {
|
||||
method: init.method ?? "POST",
|
||||
headers,
|
||||
body: init.body === undefined ? undefined : JSON.stringify(init.body),
|
||||
signal: controller.signal,
|
||||
cache: "no-store",
|
||||
});
|
||||
} finally {
|
||||
clearTimeout(timer);
|
||||
}
|
||||
}
|
||||
|
||||
async function errorDetail(response: Response): Promise<string> {
|
||||
try {
|
||||
const body = (await response.json()) as { message?: string };
|
||||
return body.message ?? `HTTP ${response.status}`;
|
||||
} catch {
|
||||
return `HTTP ${response.status}`;
|
||||
}
|
||||
}
|
||||
|
||||
interface CapToken {
|
||||
raw: string;
|
||||
expiresAt: number;
|
||||
}
|
||||
|
||||
let capToken: CapToken | null = null;
|
||||
let tokenPromise: Promise<string> | null = null;
|
||||
|
||||
function scenarioHash(): string {
|
||||
return createHash("sha256")
|
||||
.update(`${SCENARIO}:${SCENARIO_VERSION}`)
|
||||
.digest("hex")
|
||||
.slice(0, 16);
|
||||
}
|
||||
|
||||
async function registerWatcher(
|
||||
machineId: string,
|
||||
password: string,
|
||||
): Promise<void> {
|
||||
if (!redis) return;
|
||||
try {
|
||||
const already = await redis.get(REGISTERED_KEY);
|
||||
if (already) return;
|
||||
} catch {
|
||||
// proceed anyway — registering is idempotent-ish (400 = already exists)
|
||||
}
|
||||
const response = await capiRequest("/watchers/register", {
|
||||
body: { machine_id: machineId, password },
|
||||
});
|
||||
if (response.ok || response.status === 400) {
|
||||
try {
|
||||
await redis.set(REGISTERED_KEY, "1", "EX", 30 * 24 * 3_600);
|
||||
} catch {
|
||||
// fine — will just attempt registration again later
|
||||
}
|
||||
return;
|
||||
}
|
||||
throw new CrowdsecReportError(
|
||||
`watcher registration failed (HTTP ${response.status}): ${await errorDetail(response)}`,
|
||||
);
|
||||
}
|
||||
|
||||
/** Login and cache the JWT; guarded against concurrent logins. */
|
||||
async function acquireCapToken(): Promise<string> {
|
||||
if (capToken && capToken.expiresAt > Date.now() + 60_000) {
|
||||
return capToken.raw;
|
||||
}
|
||||
if (tokenPromise) return tokenPromise;
|
||||
const credentials = await loadReportCredentials();
|
||||
if (!credentials) {
|
||||
throw new CrowdsecReportError(
|
||||
"CrowdSec reporting is not configured (no watcher credentials)",
|
||||
);
|
||||
}
|
||||
|
||||
tokenPromise = (async () => {
|
||||
if (capToken && capToken.expiresAt > Date.now() + 60_000) {
|
||||
return capToken.raw;
|
||||
}
|
||||
if (redis) {
|
||||
try {
|
||||
const cached = await redis.get(TOKEN_CACHE_KEY);
|
||||
if (cached) {
|
||||
const parsed = JSON.parse(cached) as CapToken;
|
||||
if (parsed.expiresAt > Date.now() + 60_000) {
|
||||
capToken = parsed;
|
||||
return parsed.raw;
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
// fall through to a fresh login
|
||||
}
|
||||
}
|
||||
|
||||
// First signal push needs the watcher to exist on the CAPI.
|
||||
await registerWatcher(credentials.machineId, credentials.password);
|
||||
|
||||
const response = await capiRequest("/watchers/login", {
|
||||
body: {
|
||||
machine_id: credentials.machineId,
|
||||
password: credentials.password,
|
||||
scenarios: [SCENARIO],
|
||||
},
|
||||
});
|
||||
if (!response.ok) {
|
||||
throw new CrowdsecReportError(
|
||||
`CAPI watcher login failed (HTTP ${response.status}): ${await errorDetail(response)}`,
|
||||
);
|
||||
}
|
||||
const body = (await response.json()) as { token?: string; expire?: string };
|
||||
if (!body.token) {
|
||||
throw new CrowdsecReportError("CAPI watcher login returned no token");
|
||||
}
|
||||
let expiresAt = Date.now() + 3_600_000;
|
||||
const expire = body.expire ? Date.parse(body.expire) : NaN;
|
||||
if (Number.isFinite(expire) && expire > Date.now()) {
|
||||
expiresAt = expire;
|
||||
}
|
||||
const token: CapToken = { raw: body.token, expiresAt };
|
||||
capToken = token;
|
||||
if (redis) {
|
||||
try {
|
||||
await redis.set(TOKEN_CACHE_KEY, JSON.stringify(token), "EX", 3_600);
|
||||
} catch {
|
||||
// in-process view is enough
|
||||
}
|
||||
}
|
||||
return token.raw;
|
||||
})().finally(() => {
|
||||
tokenPromise = null;
|
||||
});
|
||||
|
||||
return tokenPromise;
|
||||
}
|
||||
|
||||
async function enrollWatcher(token: string): Promise<void> {
|
||||
const attachmentKey = env.CROWDSEC_REPORT_ENROLL_KEY?.trim();
|
||||
if (!attachmentKey) return;
|
||||
if (!redis) return;
|
||||
try {
|
||||
const enrolled = await redis.get(ENROLLED_KEY);
|
||||
if (enrolled) return;
|
||||
} catch {
|
||||
// best effort below
|
||||
}
|
||||
try {
|
||||
const response = await capiRequest("/watchers/enroll", {
|
||||
token,
|
||||
body: { attachment_key: attachmentKey, name: "atomcms-next" },
|
||||
});
|
||||
if (response.ok) {
|
||||
try {
|
||||
await redis.set(ENROLLED_KEY, "1", "EX", 30 * 24 * 3_600);
|
||||
} catch {
|
||||
// best effort
|
||||
}
|
||||
}
|
||||
} catch (error) {
|
||||
// Enrollment only affects Console visibility — not worth failing a push.
|
||||
logger.debug("[crowdsec-report] Console enrollment skipped", {
|
||||
err: error instanceof Error ? error.message : String(error),
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
function formatCapiDuration(seconds: number): string {
|
||||
const safe = Math.max(1, Math.floor(seconds));
|
||||
const hours = Math.floor(safe / 3_600);
|
||||
const minutes = Math.floor((safe % 3_600) / 60);
|
||||
const rest = safe % 60;
|
||||
if (hours > 0) return `${hours}h${minutes}m${rest}s`;
|
||||
if (minutes > 0) return `${minutes}m${rest}s`;
|
||||
return `${rest}s`;
|
||||
}
|
||||
|
||||
async function pushSignal(input: {
|
||||
credentials: ReportCredentials;
|
||||
token: string;
|
||||
ip: string;
|
||||
category: string;
|
||||
ttlSeconds: number;
|
||||
verdict: CrowdsecVerdict;
|
||||
meta: CrowdsecBlockMeta;
|
||||
}): Promise<CrowdsecReportStatus> {
|
||||
const now = new Date();
|
||||
try {
|
||||
await enrollWatcher(input.token);
|
||||
const duration = formatCapiDuration(input.ttlSeconds);
|
||||
const response = await capiRequest("/signals", {
|
||||
token: input.token,
|
||||
body: [
|
||||
{
|
||||
machine_id: input.credentials.machineId,
|
||||
message: input.verdict.reputation
|
||||
? "atomcms-next anti-DDoS gate blocked a community-flagged IP"
|
||||
: "atomcms-next anti-DDoS gate blocked a repeat rate-limit offender",
|
||||
scenario: SCENARIO,
|
||||
scenario_version: SCENARIO_VERSION,
|
||||
scenario_hash: scenarioHash(),
|
||||
created_at: now.toISOString(),
|
||||
start_at: now.toISOString(),
|
||||
stop_at: now.toISOString(),
|
||||
source: { scope: "ip", value: input.ip, ip: input.ip },
|
||||
decisions: [
|
||||
{
|
||||
id: 0,
|
||||
origin: "crowdsec",
|
||||
scenario: SCENARIO,
|
||||
scope: "ip",
|
||||
type: "ban",
|
||||
value: input.ip,
|
||||
duration,
|
||||
},
|
||||
],
|
||||
context: [
|
||||
{ key: "crowdsec_category", value: input.category },
|
||||
{
|
||||
key: "crowdsec_reputation",
|
||||
value: input.verdict.reputation ?? "unknown",
|
||||
},
|
||||
{
|
||||
key: "crowdsec_score",
|
||||
value: String(input.verdict.score),
|
||||
},
|
||||
{
|
||||
key: "crowdsec_behaviors",
|
||||
value: input.verdict.behaviors.join(",") || "none",
|
||||
},
|
||||
],
|
||||
},
|
||||
],
|
||||
});
|
||||
if (!response.ok) {
|
||||
throw new CrowdsecReportError(
|
||||
`signal push rejected (HTTP ${response.status}): ${await errorDetail(response)}`,
|
||||
);
|
||||
}
|
||||
// Was the channel down before this? A first success after failures
|
||||
// deserves a recovery notice (separate cooldown key from the failure).
|
||||
const before = await getLastCrowdsecReport();
|
||||
const status: CrowdsecReportStatus = { ok: true, at: Date.now() };
|
||||
await setLastCrowdsecReport(status);
|
||||
void bumpCrowdsecStat("reports");
|
||||
if (before && !before.ok) {
|
||||
void raiseCrowdsecAlert("report-recovered", {
|
||||
type: "ddos",
|
||||
severity: "info",
|
||||
message:
|
||||
"CrowdSec signal push recovered — detections are reaching the community again.",
|
||||
context: { ip: input.ip },
|
||||
});
|
||||
}
|
||||
logger.info("[crowdsec-report] Detection shared with the community", {
|
||||
ip: input.ip,
|
||||
category: input.category,
|
||||
ttlSeconds: input.ttlSeconds,
|
||||
score: input.verdict.score,
|
||||
});
|
||||
return status;
|
||||
} catch (error) {
|
||||
const status: CrowdsecReportStatus = {
|
||||
ok: false,
|
||||
at: Date.now(),
|
||||
message: String(error),
|
||||
};
|
||||
await setLastCrowdsecReport(status);
|
||||
void bumpCrowdsecStat("report_fail");
|
||||
// Ops alert, cooldown-gated: a silently broken channel means the
|
||||
// community never learns about the blocks we keep sharing.
|
||||
void raiseCrowdsecAlert("report", {
|
||||
type: "ddos",
|
||||
severity: "warning",
|
||||
message:
|
||||
"CrowdSec signal push failed — detections are not reaching the community.",
|
||||
context: {
|
||||
ip: input.ip,
|
||||
detail: String(error).slice(0, 300),
|
||||
},
|
||||
});
|
||||
logger.error("[crowdsec-report] Signal push failed", {
|
||||
ip: input.ip,
|
||||
err: error,
|
||||
});
|
||||
return status;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Share a CrowdSec-reputation block back into the community. Safe to call
|
||||
* fire-and-forget: does nothing when reporting is off, never throws, and
|
||||
* dedupes so the same IP is only reported once per window.
|
||||
*/
|
||||
export async function reportCrowdsecSignal(input: {
|
||||
ip: string;
|
||||
category: string;
|
||||
ttlSeconds: number;
|
||||
verdict: CrowdsecVerdict;
|
||||
meta: CrowdsecBlockMeta;
|
||||
}): Promise<void> {
|
||||
const { ip, category, ttlSeconds, verdict, meta } = input;
|
||||
if (!(await crowdsecReportEnabled())) return;
|
||||
if (!ip || ip === UNKNOWN_CLIENT_IP) return;
|
||||
const credentials = await loadReportCredentials();
|
||||
if (!credentials) return;
|
||||
|
||||
try {
|
||||
if (redis) {
|
||||
// Cross-instance dedupe: one report per IP per window.
|
||||
const acquired = await redis.set(
|
||||
`${REPORT_LOCK_PREFIX}${ip}`,
|
||||
"1",
|
||||
"EX",
|
||||
REPORT_DEDUPE_SECONDS,
|
||||
"NX",
|
||||
);
|
||||
if (acquired !== "OK") return;
|
||||
}
|
||||
const token = await acquireCapToken();
|
||||
await pushSignal({
|
||||
credentials,
|
||||
token,
|
||||
ip,
|
||||
category,
|
||||
ttlSeconds,
|
||||
verdict,
|
||||
meta,
|
||||
});
|
||||
} catch (error) {
|
||||
logger.error("[crowdsec-report] Signal push preparation failed", {
|
||||
ip,
|
||||
err: error,
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
export interface CrowdsecReportStatus {
|
||||
ok: boolean;
|
||||
message?: string;
|
||||
at: number;
|
||||
}
|
||||
|
||||
let lastReportMemory: CrowdsecReportStatus | null = null;
|
||||
|
||||
export async function getLastCrowdsecReport(): Promise<CrowdsecReportStatus | null> {
|
||||
if (redis) {
|
||||
try {
|
||||
const raw = await redis.get(LAST_REPORT_KEY);
|
||||
if (raw) return JSON.parse(raw) as CrowdsecReportStatus;
|
||||
} catch {
|
||||
// fall back to the in-process view
|
||||
}
|
||||
}
|
||||
return lastReportMemory;
|
||||
}
|
||||
|
||||
export async function setLastCrowdsecReport(
|
||||
status: CrowdsecReportStatus,
|
||||
): Promise<void> {
|
||||
lastReportMemory = status;
|
||||
if (redis) {
|
||||
try {
|
||||
await redis.set(
|
||||
LAST_REPORT_KEY,
|
||||
JSON.stringify(status),
|
||||
"EX",
|
||||
48 * 3_600,
|
||||
);
|
||||
} catch {
|
||||
// in-process view is enough
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/** Probe the full register → login path and report the outcome for the admin. */
|
||||
export async function verifyCrowdsecReporting(): Promise<CrowdsecConnectionStatus> {
|
||||
if (!env.CROWDSEC_REPORT_ENABLED) {
|
||||
return {
|
||||
ok: false,
|
||||
message: "CROWDSEC_REPORT_ENABLED is not set",
|
||||
at: Date.now(),
|
||||
};
|
||||
}
|
||||
const credentials = await loadReportCredentials();
|
||||
if (!credentials) {
|
||||
return {
|
||||
ok: false,
|
||||
message:
|
||||
"CrowdSec reporting is not configured (set CROWDSEC_REPORT_MACHINE_ID + CROWDSEC_REPORT_PASSWORD, or REDIS_URL)",
|
||||
at: Date.now(),
|
||||
};
|
||||
}
|
||||
try {
|
||||
await acquireCapToken();
|
||||
return {
|
||||
ok: true,
|
||||
message: "CAPI watcher connected — signal push ready",
|
||||
at: Date.now(),
|
||||
};
|
||||
} catch (error) {
|
||||
return {
|
||||
ok: false,
|
||||
message: error instanceof Error ? error.message : String(error),
|
||||
at: Date.now(),
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
/** Test hook only. */
|
||||
export function resetCrowdsecReportCache(): void {
|
||||
credentialsCache = null;
|
||||
capToken = null;
|
||||
tokenPromise = null;
|
||||
lastReportMemory = null;
|
||||
}
|
||||
@@ -0,0 +1,170 @@
|
||||
import "server-only";
|
||||
|
||||
import { redis } from "@/lib/redis";
|
||||
|
||||
// === CrowdSec daily counters ===============================================
|
||||
//
|
||||
// Small Redis counters so ops can see whether the reputation pipeline is
|
||||
// actually doing anything: lookups executed, blocks created, signals pushed,
|
||||
// push failures, and per-block breakdowns (request category / CrowdSec
|
||||
// reputation) — all bucketed per UTC calendar day
|
||||
// (crowdsec:stat:{metric}:{YYYY-MM-DD}). Both the CTI client and the signal
|
||||
// pusher feed them; the admin panel renders the last N days. Cheap INCRs on
|
||||
// non-hot paths only, so they never tax the request path.
|
||||
|
||||
export type CrowdsecStatMetric =
|
||||
| "lookups"
|
||||
| "blocks"
|
||||
| "reports"
|
||||
| "report_fail";
|
||||
|
||||
export type CrowdsecBreakdownKind = "category" | "reputation";
|
||||
|
||||
const STAT_PREFIX = "crowdsec:stat:";
|
||||
const STAT_KEY_TTL_SECONDS = 16 * 24 * 3_600;
|
||||
|
||||
function statDate(): string {
|
||||
return new Date().toISOString().slice(0, 10);
|
||||
}
|
||||
|
||||
function statKey(metric: CrowdsecStatMetric, date: string): string {
|
||||
return `${STAT_PREFIX}${metric}:${date}`;
|
||||
}
|
||||
|
||||
function breakdownKey(kind: CrowdsecBreakdownKind, date: string): string {
|
||||
return `${STAT_PREFIX}${kind}:${date}`;
|
||||
}
|
||||
|
||||
/** Count one occurrence of a pipeline event for today. Best effort. */
|
||||
export async function bumpCrowdsecStat(
|
||||
metric: CrowdsecStatMetric,
|
||||
): Promise<void> {
|
||||
if (!redis) return;
|
||||
const key = statKey(metric, statDate());
|
||||
try {
|
||||
await redis.incr(key);
|
||||
await redis.expire(key, STAT_KEY_TTL_SECONDS);
|
||||
} catch {
|
||||
// tracking is best-effort — a miss only loses a day's histogram
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Count one block into today's per-category / per-reputation breakdown. Stored
|
||||
* as a JSON object per day and merged by the admin reader; read-modify-write
|
||||
* is fine because blocks are rare and the panel is display-only.
|
||||
*/
|
||||
export async function bumpCrowdsecBreakdownStat(
|
||||
kind: CrowdsecBreakdownKind,
|
||||
value: string,
|
||||
): Promise<void> {
|
||||
if (!redis) return;
|
||||
const key = breakdownKey(kind, statDate());
|
||||
try {
|
||||
const raw = await redis.get(key);
|
||||
const counts: Record<string, number> = raw
|
||||
? (JSON.parse(raw) as Record<string, number>)
|
||||
: {};
|
||||
const label = String(value).slice(0, 64);
|
||||
counts[label] = (counts[label] ?? 0) + 1;
|
||||
await redis.set(key, JSON.stringify(counts), "EX", STAT_KEY_TTL_SECONDS);
|
||||
} catch {
|
||||
// best effort — a lost breakdown entry only hides a histogram bucket
|
||||
}
|
||||
}
|
||||
|
||||
export interface CrowdsecDailyStat {
|
||||
/** UTC calendar day (YYYY-MM-DD). */
|
||||
date: string;
|
||||
lookups: number;
|
||||
blocks: number;
|
||||
reports: number;
|
||||
reportFailures: number;
|
||||
/** Blocks per request category (api/pages/auth/global), today-to-date. */
|
||||
categories: Record<string, number>;
|
||||
/** Blocks per CrowdSec reputation (only community-sourced ones). */
|
||||
reputations: Record<string, number>;
|
||||
}
|
||||
|
||||
function blankRow(date: string): CrowdsecDailyStat {
|
||||
return {
|
||||
date,
|
||||
lookups: 0,
|
||||
blocks: 0,
|
||||
reports: 0,
|
||||
reportFailures: 0,
|
||||
categories: {},
|
||||
reputations: {},
|
||||
};
|
||||
}
|
||||
|
||||
function toCount(raw: string | null): number {
|
||||
const n = Number(raw ?? 0);
|
||||
return Number.isFinite(n) ? n : 0;
|
||||
}
|
||||
|
||||
function toMap(raw: string | null): Record<string, number> {
|
||||
if (!raw) return {};
|
||||
try {
|
||||
const parsed = JSON.parse(raw) as unknown;
|
||||
if (parsed && typeof parsed === "object") {
|
||||
return Object.fromEntries(
|
||||
Object.entries(parsed as Record<string, unknown>)
|
||||
.map(([k, v]) => [k, typeof v === "number" ? v : Number(v) || 0])
|
||||
.filter(([, v]) => Number.isFinite(v)),
|
||||
);
|
||||
}
|
||||
} catch {
|
||||
// corrupt counter — treat as empty
|
||||
}
|
||||
return {};
|
||||
}
|
||||
|
||||
/**
|
||||
* Read the per-day counters for the last `days` days (oldest first, ending
|
||||
* with today). Every key is fetched in one parallel burst (6 GETs per day),
|
||||
* then assembled client-side; never throws.
|
||||
*/
|
||||
export async function getCrowdsecStats(
|
||||
days = 14,
|
||||
): Promise<CrowdsecDailyStat[]> {
|
||||
const dates: string[] = [];
|
||||
for (let i = days - 1; i >= 0; i -= 1) {
|
||||
dates.push(
|
||||
new Date(Date.now() - i * 86_400_000).toISOString().slice(0, 10),
|
||||
);
|
||||
}
|
||||
if (!redis) {
|
||||
// No shared store — still return a blank timeline for the UI.
|
||||
return dates.map(blankRow);
|
||||
}
|
||||
const store = redis;
|
||||
return Promise.all(
|
||||
dates.map(async (date) => {
|
||||
const [
|
||||
lookups,
|
||||
blocks,
|
||||
reports,
|
||||
reportFailures,
|
||||
categories,
|
||||
reputations,
|
||||
] = await Promise.all([
|
||||
store.get(statKey("lookups", date)).catch(() => null),
|
||||
store.get(statKey("blocks", date)).catch(() => null),
|
||||
store.get(statKey("reports", date)).catch(() => null),
|
||||
store.get(statKey("report_fail", date)).catch(() => null),
|
||||
store.get(breakdownKey("category", date)).catch(() => null),
|
||||
store.get(breakdownKey("reputation", date)).catch(() => null),
|
||||
]);
|
||||
return {
|
||||
date,
|
||||
lookups: toCount(lookups),
|
||||
blocks: toCount(blocks),
|
||||
reports: toCount(reports),
|
||||
reportFailures: toCount(reportFailures),
|
||||
categories: toMap(categories),
|
||||
reputations: toMap(reputations),
|
||||
};
|
||||
}),
|
||||
);
|
||||
}
|
||||
Loaded 100 of 150 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user