Add renovate.json

drizzle/drafts/0001_breezy_maestro.sql

@@ -1,25 +0,0 @@
-CREATE TABLE `website_daily_reward_claims` (
-	`id` bigint unsigned AUTO_INCREMENT NOT NULL,
-	`user_id` int NOT NULL,
-	`claim_date` date NOT NULL,
-	`streak` int unsigned NOT NULL DEFAULT 1,
-	`reward_day` int unsigned NOT NULL DEFAULT 1,
-	`currency` varchar(20) NOT NULL DEFAULT 'credits',
-	`amount` int NOT NULL DEFAULT 0,
-	`created_at` datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
-	CONSTRAINT `website_daily_reward_claims_id` PRIMARY KEY(`id`),
-	CONSTRAINT `daily_claim_user_date_uk` UNIQUE(`user_id`,`claim_date`)
-);
---> statement-breakpoint
-CREATE TABLE `website_daily_rewards` (
-	`id` int unsigned AUTO_INCREMENT NOT NULL,
-	`day` int unsigned NOT NULL DEFAULT 1,
-	`currency` varchar(20) NOT NULL DEFAULT 'credits',
-	`amount` int NOT NULL DEFAULT 0,
-	`created_at` datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
-	`updated_at` datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
-	CONSTRAINT `website_daily_rewards_id` PRIMARY KEY(`id`)
-);
---> statement-breakpoint
-ALTER TABLE `admin_audit_log` MODIFY COLUMN `before` mediumtext;--> statement-breakpoint
-ALTER TABLE `admin_audit_log` MODIFY COLUMN `after` mediumtext;

drizzle/drafts/meta/_journal.json

@@ -8,13 +8,6 @@
       "when": 1788791201804,
       "tag": "0000_premium_spirit",
       "breakpoints": true
-    },
-    {
-      "idx": 1,
-      "version": "5",
-      "when": 1791828901011,
-      "tag": "0001_breezy_maestro",
-      "breakpoints": true
     }
   ]
 }

pnpm-lock.yaml

@@ -167,7 +167,6 @@ overrides:
   '@esbuild-kit/core-utils': npm:tsx@^4.23.15
   '@esbuild-kit/esm-loader': npm:tsx@^4.23.15
   source-map-js: 1.2.2
-  postcss-selector-parser: ^7.1.6
 
 importers:
 
@@ -3256,8 +3255,8 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-UUlyE2KlxmvwMGq060onF/VWU3zD6dVW31FwokQ5v26jWd35fbs2MoTFzh+jXnPwAyV2MULMKXcBInGOl5TO6Q==}
 
-  postcss-selector-parser@7.1.6:
-    resolution: {integrity: sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==}
+  postcss-selector-parser@6.0.10:
+    resolution: {integrity: sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==}
     engines: {node: '>=4'}
 
   [email protected]:
@@ -4962,7 +4961,7 @@ snapshots:
 
   '@tailwindcss/[email protected]([email protected])':
     dependencies:
-      postcss-selector-parser: 7.1.6
+      postcss-selector-parser: 6.0.10
       tailwindcss: 4.3.3
 
   '@tanstack/[email protected]': {}
@@ -6111,7 +6110,7 @@ snapshots:
 
   [email protected]: {}
 
-  postcss-selector-parser@7.1.6:
+  postcss-selector-parser@6.0.10:
     dependencies:
       cssesc: 3.0.0
       util-deprecate: 1.0.2

pnpm-workspace.yaml

@@ -17,8 +17,3 @@ overrides:
   '@esbuild-kit/core-utils': 'npm:tsx@^4.23.15'
   '@esbuild-kit/esm-loader': 'npm:tsx@^4.23.15'
   source-map-js: '1.2.2'
-  # GHSA advisory: postcss-selector-parser <7.1.6. Pulled in only by
-  # @tailwindcss/typography (build-time prose selectors), which pins 6.0.10
-  # exactly and has no upstream bump. The API subset it uses is unchanged in
-  # v7, so force the patched major.
-  postcss-selector-parser: '^7.1.6'

src/app/(site)/news/page.tsx

@@ -99,7 +99,6 @@ async function NewsPage({
 											fill
 											sizes="(max-width: 1024px) 50vw, 300px"
 											style={{ objectFit: "cover" }}
-											unoptimized
 										/>
 									</div>
 								) : (

src/app/(site)/page.tsx

@@ -170,9 +170,12 @@ function GlassPanel({
 }
 
 async function getHotelData() {
+	const [hotelName, logo] = await Promise.all([
+		resolveHotelName(),
+		siteSettings.get("cms_logo", ""),
+	]);
+
 	const [
-		hotelName,
-		logo,
 		online,
 		users,
 		rooms,
@@ -182,8 +185,6 @@ async function getHotelData() {
 		recentUsers,
 		recentPhotos,
 	] = await Promise.all([
-		resolveHotelName(),
-		siteSettings.get("cms_logo", ""),
 		cachedOnlineCount().catch(publicReadFailure("home.online")),
 		cached("total_users", 300_000, countUsers, { staleMs: 300000 }).catch(
 			publicReadFailure("home.users"),
@@ -242,34 +243,22 @@ export default async function Home() {
 	const session = await auth();
 	if (session?.user?.id) redirect("/me");
 
-	const [
-		tp,
-		te,
-		th,
-		tn,
-		{
-			hotelName,
-			online,
-			users,
-			rooms,
-			totalPhotos,
-			articleCount,
-			articles,
-			recentUsers: rawRecentUsers,
-			recentPhotos,
-			logo,
-		},
-		captcha,
-		nonceHeaders,
-	] = await Promise.all([
-		getTranslations("pages.home"),
-		getTranslations("publicData"),
-		getTranslations("header"),
-		getTranslations("nav"),
-		getHotelData(),
-		captchaConfig(),
-		headers(),
-	]);
+	const tp = await getTranslations("pages.home");
+	const te = await getTranslations("publicData");
+	const th = await getTranslations("header");
+	const tn = await getTranslations("nav");
+	const {
+		hotelName,
+		online,
+		users,
+		rooms,
+		totalPhotos,
+		articleCount,
+		articles,
+		recentUsers: rawRecentUsers,
+		recentPhotos,
+		logo,
+	} = await getHotelData();
 
 	// Users who hide their online state must not surface in the "who is online"
 	// rails on the homepage either.
@@ -282,7 +271,8 @@ export default async function Home() {
 			: rawRecentUsers.filter(
 					(u) => recentUserPrivacy.get(u.id)?.online !== false,
 				);
-	const nonce = nonceHeaders.get("x-nonce") ?? undefined;
+	const captcha = await captchaConfig();
+	const nonce = (await headers()).get("x-nonce") ?? undefined;
 
 	const features = [
 		{
@@ -325,7 +315,6 @@ export default async function Home() {
 					fill
 					sizes={featured ? "100vw" : "(max-width: 640px) 100vw, 33vw"}
 					className="rounded-2xl object-cover transition-transform duration-700 ease-out group-hover:scale-108"
-					unoptimized
 				/>
 				<div
 					className="absolute right-2.5 top-2.5 flex h-8 w-8 translate-x-1 items-center justify-center rounded-full opacity-0 backdrop-blur-sm transition-all duration-300 group-hover:translate-x-0 group-hover:opacity-100"

src/app/api/imaging/avatar/route.ts

@@ -1,6 +1,5 @@
 import { type NextRequest, NextResponse } from "next/server";
 import { AVATAR_FALLBACK_SRC } from "@/lib/imager";
-import { ifNoneMatchSatisfied, strongEtag } from "@/lib/imager-http";
 import {
 	fetchAvatarImage,
 	ImagerUnavailableError,
@@ -44,52 +43,24 @@ export async function GET(request: NextRequest) {
 			parsed.params,
 		);
 
-		const etag = strongEtag(body);
-		const cacheControl = cacheControlFor(source);
-		if (ifNoneMatchSatisfied(request.headers.get("if-none-match"), etag)) {
-			return new NextResponse(null, {
-				status: 304,
-				headers: {
-					ETag: etag,
-					"Cache-Control": cacheControl,
-					"X-Imager-Source": source,
-					"Access-Control-Allow-Origin": "*",
-				},
-			});
-		}
-
 		return new NextResponse(body as unknown as BodyInit, {
 			status: 200,
 			headers: {
 				"Content-Type": contentType,
 				"Content-Length": String(body.length),
-				"Cache-Control": cacheControl,
-				ETag: etag,
+				"Cache-Control": cacheControlFor(source),
 				"X-Imager-Source": source,
 				"Access-Control-Allow-Origin": "*",
 			},
 		});
 	} catch (error) {
 		if (error instanceof ImagerUnavailableError) {
-			const etag = strongEtag(PLACEHOLDER_SVG_BYTES);
-			if (ifNoneMatchSatisfied(request.headers.get("if-none-match"), etag)) {
-				return new NextResponse(null, {
-					status: 304,
-					headers: {
-						ETag: etag,
-						"Cache-Control": cacheControlFor("unavailable"),
-						"X-Imager-Source": "unavailable",
-						"Access-Control-Allow-Origin": "*",
-					},
-				});
-			}
 			return new NextResponse(PLACEHOLDER_SVG_BYTES as unknown as BodyInit, {
 				status: 200,
 				headers: {
 					"Content-Type": "image/svg+xml",
 					"Content-Length": String(PLACEHOLDER_SVG_BYTES.length),
 					"Cache-Control": cacheControlFor("unavailable"),
-					ETag: etag,
 					"X-Imager-Source": "unavailable",
 					"Access-Control-Allow-Origin": "*",
 				},

src/app/api/imaging/badge/route.ts

@@ -7,7 +7,6 @@ import {
 	readImagingCache,
 	writeImagingCache,
 } from "@/lib/imager-cache";
-import { ifNoneMatchSatisfied, strongEtag } from "@/lib/imager-http";
 import { resolveBadgeBase } from "@/lib/runtime-asset-config";
 import { siteSettings } from "@/lib/services/site-settings";
 
@@ -34,64 +33,6 @@ const BADGE_PLACEHOLDER_SVG =
 
 type BadgeSource = "upstream" | "local" | "cache" | "unavailable";
 
-interface ResolvedBadge {
-	body: Uint8Array;
-	contentType: string;
-	source: BadgeSource;
-}
-
-/**
- * Concurrent cold-cache requests for the same badge would otherwise each walk
- * the whole candidate list, and when the first candidate is a slow/unreachable
- * CDN that means every one of them waits out the fetch timeout before falling
- * back. Sharing a single resolution keeps a cold cache from stacking identical
- * upstream work. Held on globalThis because Next can evaluate this module more
- * than once per process.
- */
-const globalForBadgeFetches = globalThis as typeof globalThis & {
-	imagingBadgeFetches?: Map<string, Promise<ResolvedBadge>>;
-};
-const inFlight =
-	globalForBadgeFetches.imagingBadgeFetches ??
-	new Map<string, Promise<ResolvedBadge>>();
-globalForBadgeFetches.imagingBadgeFetches = inFlight;
-
-async function resolveBadge(
-	cacheKey: string,
-	code: string,
-	candidates: string[],
-): Promise<ResolvedBadge> {
-	const pending = inFlight.get(cacheKey);
-	if (pending) return pending;
-
-	const work = (async (): Promise<ResolvedBadge> => {
-		for (const base of candidates) {
-			const result = await fetchCandidate(base, code);
-			if (result) {
-				await writeImagingCache(
-					badgeCacheDir(),
-					cacheKey,
-					result.body,
-					result.contentType,
-				);
-				return result;
-			}
-		}
-		return {
-			body: new TextEncoder().encode(BADGE_PLACEHOLDER_SVG),
-			contentType: "image/svg+xml",
-			source: "unavailable",
-		};
-	})();
-
-	inFlight.set(cacheKey, work);
-	try {
-		return await work;
-	} finally {
-		if (inFlight.get(cacheKey) === work) inFlight.delete(cacheKey);
-	}
-}
-
 export async function GET(request: NextRequest) {
 	const code = request.nextUrl.searchParams.get("code")?.trim();
 	if (!code || code.length > CODE_MAX_LEN || !CODE_RE.test(code)) {
@@ -115,20 +56,25 @@ export async function GET(request: NextRequest) {
 
 	const cacheKey = imagingCacheKey(`${code}\n${candidates.join("\n")}`);
 	const cached = await readImagingCache(badgeCacheDir(), cacheKey);
-	if (cached)
-		return badgeResponse(
-			cached.body,
-			cached.contentType,
-			"cache",
-			request.headers.get("if-none-match"),
-		);
+	if (cached) return badgeResponse(cached.body, cached.contentType, "cache");
+
+	for (const base of candidates) {
+		const result = await fetchCandidate(base, code);
+		if (result) {
+			await writeImagingCache(
+				badgeCacheDir(),
+				cacheKey,
+				result.body,
+				result.contentType,
+			);
+			return badgeResponse(result.body, result.contentType, result.source);
+		}
+	}
 
-	const resolved = await resolveBadge(cacheKey, code, candidates);
 	return badgeResponse(
-		resolved.body,
-		resolved.contentType,
-		resolved.source,
-		request.headers.get("if-none-match"),
+		new TextEncoder().encode(BADGE_PLACEHOLDER_SVG),
+		"image/svg+xml",
+		"unavailable",
 	);
 }
 
@@ -194,31 +140,16 @@ function badgeResponse(
 	body: Uint8Array,
 	contentType: string,
 	source: BadgeSource,
-	ifNoneMatch: string | null = null,
 ) {
-	const etag = strongEtag(body);
-	const cacheControl =
-		source === "unavailable" ? "no-cache, max-age=0" : "public, max-age=3600";
-	// Same bytes the client already has: skip the body. Validators are hashed
-	// from the body, so a fallback→upstream swap still forces a fresh 200.
-	if (ifNoneMatchSatisfied(ifNoneMatch, etag)) {
-		return new NextResponse(null, {
-			status: 304,
-			headers: {
-				ETag: etag,
-				"Cache-Control": cacheControl,
-				"X-Imager-Source": source,
-				"Access-Control-Allow-Origin": "*",
-			},
-		});
-	}
 	return new NextResponse(body as unknown as BodyInit, {
 		status: 200,
 		headers: {
 			"Content-Type": contentType,
 			"Content-Length": String(body.length),
-			"Cache-Control": cacheControl,
-			ETag: etag,
+			"Cache-Control":
+				source === "unavailable"
+					? "no-cache, max-age=0"
+					: "public, max-age=3600",
 			"X-Imager-Source": source,
 			"Access-Control-Allow-Origin": "*",
 		},

src/app/imaging/route.ts

@@ -1,33 +1,8 @@
 import { type NextRequest, NextResponse } from "next/server";
 import sharp from "sharp";
-import { AVATAR_FALLBACK_SRC } from "@/lib/imager";
-import {
-	avatarCacheDir,
-	imagingCacheKey,
-	readImagingCache,
-	writeImagingCache,
-} from "@/lib/imager-cache";
-import { ifNoneMatchSatisfied, strongEtag } from "@/lib/imager-http";
-import { isAnimatedPng } from "@/lib/imager-png";
-import {
-	fetchAvatarImage,
-	ImagerUnavailableError,
-	parseAvatarQuery,
-} from "@/lib/imager-upstream";
-import { resolveImagerBase } from "@/lib/runtime-asset-config";
+import { fetchAvatarImage, parseAvatarQuery } from "@/lib/imager-upstream";
 
 type AvatarFormat = "png" | "webp" | "avif";
-type TranscodeFormat = Exclude<AvatarFormat, "png">;
-
-// Same neutral silhouette the sibling /api/imaging/avatar route serves, so a
-// figure no upstream can render still shows a graceful image instead of the
-// browser's broken-image glyph. This is the site-wide default imager endpoint,
-// so a 502 here would blank avatars across every server-rendered page.
-const PLACEHOLDER_SVG_BYTES = new TextEncoder().encode(
-	decodeURIComponent(
-		AVATAR_FALLBACK_SRC.slice("data:image/svg+xml;utf8,".length),
-	),
-);
 
 function resolveFormat(raw: string | null): AvatarFormat {
 	switch (raw?.toLowerCase()) {
@@ -40,89 +15,6 @@ function resolveFormat(raw: string | null): AvatarFormat {
 	}
 }
 
-/**
- * Concurrent cold-cache requests for the same figure all arrive with the same
- * decoded PNG and the same target format, so they would each run the same
- * sharp transcode — the one operation on this route that is CPU-bound. Sharing
- * a single transcode across those requests keeps a cold cache from stacking
- * identical encoder work. Held on globalThis because Next can evaluate this
- * module more than once per process; separate copies would each start their own
- * transcode and defeat the point.
- */
-const globalForTranscodes = globalThis as typeof globalThis & {
-	imagingTranscodes?: Map<string, Promise<TranscodeResult | null>>;
-};
-const inFlight =
-	globalForTranscodes.imagingTranscodes ??
-	new Map<string, Promise<TranscodeResult | null>>();
-globalForTranscodes.imagingTranscodes = inFlight;
-
-interface TranscodeResult {
-	body: Uint8Array;
-	contentType: string;
-}
-
-/**
- * Serve a WebP/AVIF variant of the decoded render, cached on disk so sharp only
- * runs once per (figure, variant) rather than on every avatar request. This
- * endpoint is the default imager, so re-encoding on each hit would burn CPU for
- * an image that never changes.
- *
- * Returns `null` when a conversion cannot be produced (e.g. sharp cannot decode
- * the input) so the caller falls back to serving the original render unchanged.
- */
-async function transcodeToVariant(
-	body: Uint8Array,
-	format: TranscodeFormat,
-	variantKey: string,
-): Promise<TranscodeResult | null> {
-	if (isAnimatedPng(body)) return null;
-
-	const cached = await readImagingCache(avatarCacheDir(), variantKey);
-	if (cached) return cached;
-
-	const pending = inFlight.get(variantKey);
-	if (pending) return pending;
-
-	const work = runTranscode(body, format, variantKey);
-	inFlight.set(variantKey, work);
-	try {
-		return await work;
-	} finally {
-		if (inFlight.get(variantKey) === work) inFlight.delete(variantKey);
-	}
-}
-
-async function runTranscode(
-	body: Uint8Array,
-	format: TranscodeFormat,
-	variantKey: string,
-): Promise<TranscodeResult | null> {
-	try {
-		// `animated: true` lets sharp carry animation through for inputs it can
-		// decode frame-by-frame (animated GIF/WebP). APNG is handled before this
-		// point: libvips here reads only its first frame, so those are left as-is.
-		const pipeline = sharp(Buffer.from(body), { animated: true });
-		const out =
-			format === "webp"
-				? await pipeline.webp().toBuffer()
-				: await pipeline.avif().toBuffer();
-		const contentType = format === "webp" ? "image/webp" : "image/avif";
-		const result = { body: new Uint8Array(out), contentType };
-		// Best-effort: a failed write must never turn a good render into an
-		// error; the next request simply re-runs the transcode.
-		await writeImagingCache(
-			avatarCacheDir(),
-			variantKey,
-			result.body,
-			contentType,
-		);
-		return result;
-	} catch {
-		return null;
-	}
-}
-
 export async function GET(request: NextRequest) {
 	const { searchParams } = new URL(request.url);
 
@@ -139,84 +31,48 @@ export async function GET(request: NextRequest) {
 			parsed.params,
 		);
 
+		// Re-encode PNG avatars to WebP/AVIF with sharp to cut bandwidth.
+		// Falls back to the original PNG if conversion fails.
 		let respBody: Uint8Array = body;
 		let respContentType = contentType;
 		if (format !== "png") {
-			// The variant is keyed off the exact render that produced it (the
-			// resolved upstream + the normalized query) plus the target format,
-			// mirroring how the underlying render itself is cached.
-			const variantKey = imagingCacheKey(
-				`${resolveImagerBase(new URL(request.url).origin)}\n${parsed.params.toString()}\n${format}`,
-			);
-			const converted = await transcodeToVariant(body, format, variantKey);
-			if (converted) {
-				respBody = converted.body;
-				respContentType = converted.contentType;
+			try {
+				if (format === "webp") {
+					respBody = new Uint8Array(
+						await sharp(Buffer.from(body)).webp().toBuffer(),
+					);
+					respContentType = "image/webp";
+				} else {
+					respBody = new Uint8Array(
+						await sharp(Buffer.from(body)).avif().toBuffer(),
+					);
+					respContentType = "image/avif";
+				}
+			} catch {
+				respBody = body;
+				respContentType = contentType;
 			}
 		}
 
-		const etag = strongEtag(respBody);
-		// s-maxage lets Cloudflare/edge cache avatars (currently DYNAMIC),
-		// stale-while-revalidate keeps them fresh without blocking requests.
-		// The ?format= param is part of the URL, so variants cache separately.
-		// Fallback renders use a shorter TTL so the configured imager is
-		// retried soon instead of being masked for hours.
-		const cacheControl =
-			source === "fallback"
-				? "public, max-age=300, s-maxage=3600, stale-while-revalidate=3600"
-				: "public, max-age=3600, s-maxage=86400, stale-while-revalidate=86400";
-		if (ifNoneMatchSatisfied(request.headers.get("if-none-match"), etag)) {
-			return new NextResponse(null, {
-				status: 304,
-				headers: {
-					ETag: etag,
-					"Cache-Control": cacheControl,
-					"X-Imager-Source": source,
-					"Access-Control-Allow-Origin": "*",
-				},
-			});
-		}
-
 		return new NextResponse(respBody as unknown as BodyInit, {
 			status: 200,
 			headers: {
 				"Content-Type": respContentType,
 				"Content-Length": String(respBody.length),
-				"Cache-Control": cacheControl,
-				ETag: etag,
+				// s-maxage lets Cloudflare/edge cache avatars (currently DYNAMIC),
+				// stale-while-revalidate keeps them fresh without blocking requests.
+				// The ?format= param is part of the URL, so variants cache separately.
+				// Fallback renders use a shorter TTL so the configured imager is
+				// retried soon instead of being masked for hours.
+				"Cache-Control":
+					source === "fallback"
+						? "public, max-age=300, s-maxage=3600, stale-while-revalidate=3600"
+						: "public, max-age=3600, s-maxage=86400, stale-while-revalidate=86400",
 				"X-Imager-Source": source,
 				"Access-Control-Allow-Origin": "*",
 			},
 		});
-	} catch (error) {
-		if (error instanceof ImagerUnavailableError) {
-			// Every upstream is down and nothing was cached: serve the graceful
-			// silhouette as a 200 so <img> tags never break, and keep it
-			// uncached so a real render is picked up as soon as one recovers.
-			const etag = strongEtag(PLACEHOLDER_SVG_BYTES);
-			if (ifNoneMatchSatisfied(request.headers.get("if-none-match"), etag)) {
-				return new NextResponse(null, {
-					status: 304,
-					headers: {
-						ETag: etag,
-						"Cache-Control": "no-cache, max-age=0",
-						"X-Imager-Source": "unavailable",
-						"Access-Control-Allow-Origin": "*",
-					},
-				});
-			}
-			return new NextResponse(PLACEHOLDER_SVG_BYTES as unknown as BodyInit, {
-				status: 200,
-				headers: {
-					"Content-Type": "image/svg+xml",
-					"Content-Length": String(PLACEHOLDER_SVG_BYTES.length),
-					"Cache-Control": "no-cache, max-age=0",
-					ETag: etag,
-					"X-Imager-Source": "unavailable",
-					"Access-Control-Allow-Origin": "*",
-				},
-			});
-		}
+	} catch {
 		return NextResponse.json(
 			{ error: "Failed to fetch avatar from upstream" },
 			{ status: 502 },

src/lib/badge-route.test.ts

@@ -1,107 +0,0 @@
-// @ts-nocheck
-import { rm } from "node:fs/promises";
-import { NextRequest } from "next/server";
-import { afterAll, afterEach, beforeEach, expect, it, vi } from "vitest";
-import { GET } from "../app/api/imaging/badge/route";
-
-const SCRATCH_ROOT = `${process.cwd()}/storage/imaging/test-badge-route-${process.pid}`;
-
-beforeEach(async () => {
-	// Cold disk cache for every test so the candidate walk actually runs.
-	await rm(SCRATCH_ROOT, { recursive: true, force: true });
-	vi.stubEnv("IMAGING_CACHE_ROOT", SCRATCH_ROOT);
-	// A configured CDN short-circuits the database lookup for badge_base_url.
-	vi.stubEnv("BADGE_URL", "https://badges.test/album1584");
-	globalThis.imagingBadgeFetches?.clear?.();
-});
-
-afterEach(() => {
-	vi.unstubAllEnvs();
-	vi.unstubAllGlobals();
-});
-
-afterAll(async () => {
-	await rm(SCRATCH_ROOT, { recursive: true, force: true });
-});
-
-function gifResponse() {
-	return new Response(new Uint8Array([1, 2, 3]), {
-		headers: { "content-type": "image/gif" },
-	});
-}
-
-it("shares a single upstream fetch across concurrent cold-cache requests", async () => {
-	let calls = 0;
-	vi.stubGlobal(
-		"fetch",
-		vi.fn(async () => {
-			calls += 1;
-			await new Promise((resolve) => setTimeout(resolve, 20));
-			return gifResponse();
-		}),
-	);
-	const request = () =>
-		new NextRequest("https://hotel.test/api/imaging/badge?code=ADM");
-	const [a, b] = await Promise.all([GET(request()), GET(request())]);
-	expect(a.status).toBe(200);
-	expect(b.status).toBe(200);
-	expect(a.headers.get("content-type")).toBe("image/gif");
-	expect(calls).toBe(1);
-});
-
-it("serves a previously fetched badge from disk without re-fetching", async () => {
-	const fetcher = vi.fn(async () => gifResponse());
-	vi.stubGlobal("fetch", fetcher);
-	const request = new NextRequest(
-		"https://hotel.test/api/imaging/badge?code=HABBO",
-	);
-	const first = await GET(request);
-	expect(first.status).toBe(200);
-	const callsAfterFirst = fetcher.mock.calls.length;
-	expect(callsAfterFirst).toBeGreaterThan(0);
-
-	const second = await GET(request);
-	expect(second.status).toBe(200);
-	expect(second.headers.get("x-imager-source")).toBe("cache");
-	expect(fetcher.mock.calls.length).toBe(callsAfterFirst);
-});
-
-it("revalidates a cached badge with a 304 when the client already has it", async () => {
-	vi.stubGlobal(
-		"fetch",
-		vi.fn(async () => gifResponse()),
-	);
-	const url = "https://hotel.test/api/imaging/badge?code=ETAG";
-	const first = await GET(new NextRequest(url));
-	const etag = first.headers.get("etag");
-	expect(etag).toBeTruthy();
-
-	const second = await GET(
-		new NextRequest(url, { headers: { "if-none-match": etag } }),
-	);
-	expect(second.status).toBe(304);
-	expect(second.headers.get("etag")).toBe(etag);
-});
-
-it("serves a placeholder when every candidate is unavailable", async () => {
-	vi.stubGlobal(
-		"fetch",
-		vi.fn(async () => new Response("nope", { status: 404 })),
-	);
-	const result = await GET(
-		new NextRequest("https://hotel.test/api/imaging/badge?code=GONE"),
-	);
-	expect(result.status).toBe(200);
-	expect(result.headers.get("content-type")).toBe("image/svg+xml");
-	expect(result.headers.get("x-imager-source")).toBe("unavailable");
-});
-
-it("rejects malformed badge codes without contacting any candidate", async () => {
-	const fetcher = vi.fn();
-	vi.stubGlobal("fetch", fetcher);
-	const result = await GET(
-		new NextRequest("https://hotel.test/api/imaging/badge?code=../bad"),
-	);
-	expect(result.status).toBe(400);
-	expect(fetcher).not.toHaveBeenCalled();
-});

src/lib/csp.test.ts

@@ -1,5 +1,5 @@
 // @ts-nocheck
-import { describe, expect, it, vi } from "vitest";
+import { describe, expect, it } from "vitest";
 import { buildContentSecurityPolicy, createCspNonce } from "./csp";
 
 describe("csp", () => {
@@ -19,20 +19,4 @@ describe("csp", () => {
 		expect(csp).toContain("https://challenges.cloudflare.com");
 		expect(csp).not.toContain("https://cdn.jsdelivr.net");
 	});
-
-	it("blocks framing and upgrades insecure requests outside development", () => {
-		vi.stubEnv("NODE_ENV", "production");
-		const csp = buildContentSecurityPolicy("n");
-		expect(csp).toContain("frame-ancestors 'none'");
-		expect(csp).toContain("upgrade-insecure-requests");
-		vi.unstubAllEnvs();
-	});
-
-	it("omits upgrade-insecure-requests in development", () => {
-		vi.stubEnv("NODE_ENV", "development");
-		const csp = buildContentSecurityPolicy("n");
-		expect(csp).toContain("frame-ancestors 'none'");
-		expect(csp).not.toContain("upgrade-insecure-requests");
-		vi.unstubAllEnvs();
-	});
 });

src/lib/csp.ts

@@ -28,17 +28,11 @@ export function buildContentSecurityPolicy(nonce: string): string {
 		"style-src-attr 'unsafe-inline'",
 		"img-src 'self' data: blob: https:",
 		"frame-src 'self' https://challenges.cloudflare.com https://www.google.com/recaptcha/",
-		// Clickjacking defence that also covers the `frame-ancestors`-aware
-		// browsers X-Frame-Options cannot reach. `upgrade-insecure-requests` is
-		// production-only: over plain-HTTP localhost it would rewrite same-origin
-		// asset URLs to https and break the dev server.
-		"frame-ancestors 'none'",
 		"connect-src 'self' https: wss:",
 		"font-src 'self' data: https://fonts.gstatic.com",
 		"object-src 'none'",
 		"base-uri 'self'",
 		"form-action 'self'",
-		...(isDev ? [] : ["upgrade-insecure-requests"]),
 	].join("; ");
 }
 

src/lib/imager-http.test.ts

@@ -1,39 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { ifNoneMatchSatisfied, strongEtag } from "./imager-http";
-
-describe("strongEtag", () => {
-	it("is deterministic and quote-wrapped", () => {
-		const body = new Uint8Array([1, 2, 3]);
-		expect(strongEtag(body)).toBe(strongEtag(new Uint8Array([1, 2, 3])));
-		expect(strongEtag(body)).toMatch(/^"[A-Za-z0-9_-]+"$/);
-	});
-
-	it("changes when the body changes", () => {
-		expect(strongEtag(new Uint8Array([1, 2, 3]))).not.toBe(
-			strongEtag(new Uint8Array([1, 2, 4])),
-		);
-	});
-});
-
-describe("ifNoneMatchSatisfied", () => {
-	const etag = strongEtag(new Uint8Array([9]));
-
-	it("returns false without a header", () => {
-		expect(ifNoneMatchSatisfied(null, etag)).toBe(false);
-		expect(ifNoneMatchSatisfied("", etag)).toBe(false);
-	});
-
-	it("matches an exact, weak or wildcard validator", () => {
-		expect(ifNoneMatchSatisfied(etag, etag)).toBe(true);
-		expect(ifNoneMatchSatisfied(`W/${etag}`, etag)).toBe(true);
-		expect(ifNoneMatchSatisfied("*", etag)).toBe(true);
-	});
-
-	it("matches any entry in a comma-separated list", () => {
-		expect(ifNoneMatchSatisfied(`"other", ${etag}`, etag)).toBe(true);
-	});
-
-	it("does not match a different validator", () => {
-		expect(ifNoneMatchSatisfied('"other"', etag)).toBe(false);
-	});
-});

src/lib/imager-http.ts

@@ -1,33 +0,0 @@
-import "server-only";
-
-import { createHash } from "node:crypto";
-
-/**
- * Strong HTTP validator for an imaging response body.
- *
- * Derived from the bytes rather than the request URL on purpose: the same URL
- * can legitimately return different bytes over its lifetime — a degraded
- * fallback render before the configured imager recovers, or a different
- * transcode variant — and a URL-based validator would let a browser keep the
- * worse image via a stale `304`. Hashing the body means the ETag changes
- * exactly when the bytes do.
- */
-export function strongEtag(body: Uint8Array): string {
-	return `"${createHash("sha1").update(body).digest("base64url")}"`;
-}
-
-/**
- * Whether an `If-None-Match` request header matches `etag`. Handles the
- * comma-separated list form, weak validators (`W/"…"`) and the `*` wildcard, so
- * a revalidating browser gets a `304` whenever its cached copy still matches.
- */
-export function ifNoneMatchSatisfied(
-	header: string | null,
-	etag: string,
-): boolean {
-	if (!header) return false;
-	return header.split(",").some((raw) => {
-		const tag = raw.trim();
-		return tag === "*" || tag === etag || tag === `W/${etag}`;
-	});
-}

src/lib/imager-png.test.ts

@@ -1,62 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { isAnimatedPng } from "./imager-png";
-
-function png(chunks: Array<{ type: string; data?: number[] }>): Uint8Array {
-	const bytes = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
-	for (const chunk of chunks) {
-		const data = chunk.data ?? [];
-		const len = data.length;
-		bytes.push(
-			(len >>> 24) & 0xff,
-			(len >>> 16) & 0xff,
-			(len >>> 8) & 0xff,
-			len & 0xff,
-			...chunk.type.split("").map((c) => c.charCodeAt(0)),
-			...data,
-			0,
-			0,
-			0,
-			0,
-		);
-	}
-	return new Uint8Array(bytes);
-}
-
-describe("isAnimatedPng", () => {
-	it("returns false for non-PNG input", () => {
-		expect(isAnimatedPng(new Uint8Array([1, 2, 3]))).toBe(false);
-		expect(isAnimatedPng(new Uint8Array())).toBe(false);
-	});
-
-	it("returns false for a plain PNG", () => {
-		const plain = png([{ type: "IHDR" }, { type: "IDAT" }, { type: "IEND" }]);
-		expect(isAnimatedPng(plain)).toBe(false);
-	});
-
-	it("returns true when an acTL chunk precedes IDAT", () => {
-		const anim = png([
-			{ type: "IHDR" },
-			{ type: "acTL", data: [0, 16, 0, 0] },
-			{ type: "IDAT" },
-			{ type: "IEND" },
-		]);
-		expect(isAnimatedPng(anim)).toBe(true);
-	});
-
-	it("ignores an acTL chunk that appears after IDAT", () => {
-		const late = png([
-			{ type: "IHDR" },
-			{ type: "IDAT" },
-			{ type: "acTL", data: [0, 16, 0, 0] },
-		]);
-		expect(isAnimatedPng(late)).toBe(false);
-	});
-
-	it("does not loop forever on a corrupt chunk length", () => {
-		const corrupt = new Uint8Array([
-			0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0xff, 0xff, 0xff, 0xff,
-			0x49, 0x48, 0x44, 0x52,
-		]);
-		expect(isAnimatedPng(corrupt)).toBe(false);
-	});
-});

src/lib/imager-png.ts

@@ -1,43 +0,0 @@
-import "server-only";
-
-const PNG_SIGNATURE = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
-
-/**
- * Whether a buffer is an animated PNG (APNG).
- *
- * APNG is a PNG carrying an `acTL` control chunk before `IDAT`; a plain PNG has
- * none. `sharp`/libvips in this build cannot decode APNG *animation* — it reads
- * only the first frame and re-encodes that — so a WebP/AVIF transcode of an
- * APNG silently turns a moving avatar into a still one. Callers that care about
- * quality use this to leave animated renders untouched and only re-encode the
- * static ones. Chunk walking stops at `IDAT`/`IEND` because the spec requires
- * `acTL` to precede them.
- */
-export function isAnimatedPng(bytes: Uint8Array): boolean {
-	if (bytes.length < 8) return false;
-	for (let i = 0; i < 8; i++) {
-		if (bytes[i] !== PNG_SIGNATURE[i]) return false;
-	}
-
-	let offset = 8;
-	while (offset + 8 <= bytes.length) {
-		const length =
-			((bytes[offset] << 24) |
-				(bytes[offset + 1] << 16) |
-				(bytes[offset + 2] << 8) |
-				bytes[offset + 3]) >>>
-			0;
-		const type = String.fromCharCode(
-			bytes[offset + 4],
-			bytes[offset + 5],
-			bytes[offset + 6],
-			bytes[offset + 7],
-		);
-		if (type === "acTL") return true;
-		if (type === "IDAT" || type === "IEND") return false;
-		// A corrupt length would loop forever; bail instead.
-		if (length > bytes.length) return false;
-		offset += 12 + length;
-	}
-	return false;
-}

src/lib/imager-upstream.test.ts

@@ -15,11 +15,7 @@ vi.mock("@/lib/runtime-asset-config", () => ({
 	resolveImagerBase: (origin: string) => `${origin}/imager`,
 }));
 
-import {
-	fetchAvatarImage,
-	ImagerUnavailableError,
-	parseAvatarQuery,
-} from "./imager-upstream";
+import { fetchAvatarImage, ImagerUnavailableError } from "./imager-upstream";
 
 const params = new URLSearchParams({ figure: "hr-1", direction: "2" });
 
@@ -140,19 +136,3 @@ it("does not queue a new caller behind a render that is already too old", async
 	expect([...shared[0].body]).toEqual([9]);
 	expect(shared[1].body).toBe(shared[0].body);
 });
-
-it("accepts figures the renderer understands even with a trailing segment", () => {
-	// The client appends extra segments the imager still draws (e.g. the
-	// trailing `.0` here). Rejecting them turned valid avatars into 400s.
-	const figure =
-		"hr-11782-40-40.hd-180-7-14.ch-11592-66.lg-10726-79-1408.sh-11764-1408.ha-11958-70-1408.wa-2007-0.0";
-	const parsed = parseAvatarQuery(new URLSearchParams({ figure }));
-	expect(parsed.ok).toBe(true);
-	if (parsed.ok) expect(parsed.params.get("figure")).toBe(figure);
-});
-
-it("still rejects a figure that is not a figure", () => {
-	for (const figure of ["../bad", "hd-180-1/../x", "", "0"]) {
-		expect(parseAvatarQuery(new URLSearchParams({ figure })).ok).toBe(false);
-	}
-});

src/lib/imager-upstream.ts

@@ -8,12 +8,7 @@ import {
 } from "@/lib/imager-cache";
 import { resolveImagerBase } from "@/lib/runtime-asset-config";
 
-// The client's figure strings are passed straight through to the imager, which
-// is the authority on what it can draw. Only the first segment is required to
-// look like a real part (`hd-180`); the rest is deliberately loose because some
-// clients append extra segments (e.g. a trailing `.0`) that the renderer still
-// accepts. Over-strict validation here turned valid avatars into 400s.
-export const FIGURE_RE = /^[a-z]{2}-\d+(?:[.-][a-z0-9]+)*$/i;
+export const FIGURE_RE = /^[a-z]{2}-\d+(?:-\d+)*(?:\.[a-z]{2}-\d+(?:-\d+)*)*$/i;
 export const FIGURE_MAX_LEN = 512;
 export const FIGURE_MAX_PARTS = 24;
 

src/lib/imaging-route.test.ts

@@ -1,171 +0,0 @@
-// @ts-nocheck
-import { rm } from "node:fs/promises";
-import { NextRequest } from "next/server";
-import { afterAll, afterEach, beforeEach, expect, it, vi } from "vitest";
-import { GET } from "../app/imaging/route";
-
-// sharp is the one CPU-bound operation on this default-imager route, so the
-// tests instrument it directly to prove transcodes are cached rather than
-// re-run on every request.
-const { sharpMock, counters } = vi.hoisted(() => {
-	const counters = {
-		calls: 0,
-		options: [] as unknown[],
-		behavior: "ok" as "ok" | "throw",
-	};
-	const sharpMock = (_input: unknown, options?: unknown) => {
-		counters.calls += 1;
-		counters.options.push(options);
-		if (counters.behavior === "throw") throw new Error("decode failed");
-		return {
-			webp: () => ({ toBuffer: async () => Buffer.from([1, 2, 3]) }),
-			avif: () => ({ toBuffer: async () => Buffer.from([4, 5, 6]) }),
-		};
-	};
-	return { sharpMock, counters };
-});
-
-vi.mock("sharp", () => ({ default: sharpMock }));
-
-// One scratch root for the whole file, removed afterwards, so the disk cache
-// never leaks state between tests or into the runtime cache tree.
-const SCRATCH_ROOT = `${process.cwd()}/storage/imaging/test-imaging-route-${process.pid}`;
-
-beforeEach(async () => {
-	// Cold disk cache for every test: a warm variant would short-circuit the
-	// transcode being asserted.
-	await rm(SCRATCH_ROOT, { recursive: true, force: true });
-	vi.stubEnv("IMAGING_CACHE_ROOT", SCRATCH_ROOT);
-	vi.stubEnv("IMAGER_URL", "https://imager.test/avatarimage");
-	counters.calls = 0;
-	counters.options = [];
-	counters.behavior = "ok";
-	// Drop any single-flight entries a prior test may have left behind.
-	globalThis.imagingTranscodes?.clear?.();
-});
-
-afterEach(() => {
-	vi.unstubAllEnvs();
-	vi.unstubAllGlobals();
-});
-
-afterAll(async () => {
-	await rm(SCRATCH_ROOT, { recursive: true, force: true });
-});
-
-function stubPngUpstream() {
-	const fetcher = vi.fn(
-		async () =>
-			new Response(new Uint8Array([9, 8, 7]), {
-				headers: { "content-type": "image/png" },
-			}),
-	);
-	vi.stubGlobal("fetch", fetcher);
-	return fetcher;
-}
-
-// A minimal APNG: the PNG signature followed by an `acTL` chunk, which is all
-// the animated-format detector needs. sharp cannot re-encode APNG animation in
-// this build, so these must be passed through untouched.
-function apngBytes(): Uint8Array {
-	return new Uint8Array([
-		0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0, 0x61, 0x63,
-		0x54, 0x4c, 0, 0, 0, 0,
-	]);
-}
-
-it("re-encodes an avatar to WebP and caches the variant across requests", async () => {
-	const fetcher = stubPngUpstream();
-	const request = new NextRequest(
-		"https://hotel.test/imaging?figure=hd-180-1&format=webp",
-	);
-
-	const first = await GET(request);
-	expect(first.status).toBe(200);
-	expect(first.headers.get("content-type")).toBe("image/webp");
-	expect(counters.calls).toBe(1);
-
-	const fetchesAfterFirst = fetcher.mock.calls.length;
-	const second = await GET(request);
-	expect(second.status).toBe(200);
-	expect(second.headers.get("content-type")).toBe("image/webp");
-	// Served entirely from disk cache: neither the upstream nor sharp re-ran.
-	expect(counters.calls).toBe(1);
-	expect(fetcher.mock.calls.length).toBe(fetchesAfterFirst);
-});
-
-it("decodes with animation awareness for transcodeable inputs", async () => {
-	stubPngUpstream();
-	const result = await GET(
-		new NextRequest("https://hotel.test/imaging?figure=hd-180-1&format=webp"),
-	);
-	expect(result.status).toBe(200);
-	expect(counters.options.at(-1)).toMatchObject({ animated: true });
-});
-
-it("leaves an animated PNG untouched instead of dropping its frames", async () => {
-	vi.stubGlobal(
-		"fetch",
-		vi.fn(
-			async () =>
-				new Response(apngBytes(), {
-					headers: { "content-type": "image/png" },
-				}),
-		),
-	);
-	const result = await GET(
-		new NextRequest("https://hotel.test/imaging?figure=hd-180-1&format=webp"),
-	);
-	expect(result.status).toBe(200);
-	// Original bytes/content-type preserved and sharp never ran.
-	expect(result.headers.get("content-type")).toBe("image/png");
-	expect(counters.calls).toBe(0);
-});
-
-it("shares a single transcode across concurrent cold-cache requests", async () => {
-	stubPngUpstream();
-	const request = () =>
-		new NextRequest("https://hotel.test/imaging?figure=hd-180-1&format=avif");
-	const [a, b] = await Promise.all([GET(request()), GET(request())]);
-	expect(a.status).toBe(200);
-	expect(b.status).toBe(200);
-	expect(counters.calls).toBe(1);
-});
-
-it("falls back to the original render when the transcode fails", async () => {
-	stubPngUpstream();
-	counters.behavior = "throw";
-	const result = await GET(
-		new NextRequest("https://hotel.test/imaging?figure=hd-180-1&format=webp"),
-	);
-	expect(result.status).toBe(200);
-	expect(result.headers.get("content-type")).toBe("image/png");
-});
-
-it("revalidates a cached avatar with a 304 when the client already has it", async () => {
-	stubPngUpstream();
-	const url = "https://hotel.test/imaging?figure=hd-55-1";
-	const first = await GET(new NextRequest(url));
-	const etag = first.headers.get("etag");
-	expect(etag).toBeTruthy();
-
-	const second = await GET(
-		new NextRequest(url, { headers: { "if-none-match": etag } }),
-	);
-	expect(second.status).toBe(304);
-	expect(second.headers.get("etag")).toBe(etag);
-});
-
-it("serves the graceful silhouette instead of a broken image when every upstream is down", async () => {
-	vi.stubGlobal(
-		"fetch",
-		vi.fn(async () => new Response("down", { status: 503 })),
-	);
-	const result = await GET(
-		new NextRequest("https://hotel.test/imaging?figure=xd-900-1&format=webp"),
-	);
-	expect(result.status).toBe(200);
-	expect(result.headers.get("content-type")).toBe("image/svg+xml");
-	expect(result.headers.get("x-imager-source")).toBe("unavailable");
-	expect(result.headers.get("cache-control")).toContain("no-cache");
-});

src/lib/runtime-avatar-route.test.ts

@@ -108,28 +108,6 @@ it("serves a previously rendered avatar from the disk cache without re-fetching"
 	expect(fetcher.mock.calls.length).toBe(callsAfterFirst);
 });
 
-it("revalidates a cached avatar with a 304 when the client already has it", async () => {
-	const fetcher = vi.fn(
-		async () =>
-			new Response(new Uint8Array([1, 2, 3]), {
-				headers: { "content-type": "image/png" },
-			}),
-	);
-	vi.stubGlobal("fetch", fetcher);
-	vi.stubEnv("IMAGER_URL", "https://etag.test/avatarimage");
-	const url = "https://hotel.test/api/imaging/avatar?figure=hd-77-1";
-	const first = await GET(new NextRequest(url));
-	const etag = first.headers.get("etag");
-	expect(etag).toBeTruthy();
-
-	const second = await GET(
-		new NextRequest(url, { headers: { "if-none-match": etag } }),
-	);
-	expect(second.status).toBe(304);
-	expect(second.headers.get("etag")).toBe(etag);
-	expect(second.headers.get("x-imager-source")).toBe("cache");
-});
-
 it("serves a graceful silhouette instead of a broken image when every upstream is down", async () => {
 	const fetcher = vi.fn(
 		async (_input: string | URL) =>

test-ci.txt

@@ -0,0 +1,3 @@
+test-ci-runner
+# final test
+# CI test via Gitea runner

test-clean.txt

@@ -0,0 +1 @@
+# clean v5 docker install test

test-final.txt

@@ -0,0 +1 @@
+# CI test na complete herinstallatie

test-label.txt

@@ -0,0 +1 @@
+# test nieuwe label aanpak

test-only-ubuntu.txt

@@ -0,0 +1 @@
+# test ubuntu-latest alleen

test-runner-test.txt

@@ -0,0 +1,4 @@
+// test: runner actief
+// second test
+// third test - token sync fix
+// fourth test - token config fix

test-ubuntu.txt

@@ -0,0 +1 @@
+# test met ubuntu-latest label

test-v5.txt

@@ -0,0 +1 @@
+# test na volledige schone installatie v5