openhands
5628e7d6b7
1. env.ts: APP_KEY placeholder detection with validation 2. schema.prisma: password column widened to varchar(255) for argon2id 3. auth.ts: trustHost restricted to development only 4. next.config.ts: added CSP, HSTS, X-Frame-Options, and other security headers 5. api.ts: CORS restricted to APP_URL instead of wildcard 6. register-form.tsx: migrated from REST API fetch to server action (useActionState) 7. twofactor.ts + 2fa page: TOTP recovery codes (8 one-time codes, generated and displayed) 8. register.ts: password min length 8 + complexity requirements (upper, lower, digit) 9. register.ts + help-tickets.ts + radio-shouts.ts: Zod schema validation 10. rate-limit.ts: improved periodic cleanup with aggressive eviction at 10k buckets 11. guard.ts + admin actions: rate-limited admin actions (30 req/min per staff) 12. help-tickets.ts + radio-shouts.ts: content moderation via moderateOrThrow
55 lines
1.4 KiB
TypeScript
55 lines
1.4 KiB
TypeScript
"use server";
|
|
|
|
import { revalidatePath } from "next/cache";
|
|
import { z } from "zod";
|
|
import { auth } from "@/lib/auth";
|
|
import { prisma } from "@/lib/prisma";
|
|
import { moderateOrThrow } from "@/lib/services/moderation";
|
|
import { clientIp, rateLimit } from "@/lib/rate-limit";
|
|
|
|
const ticketSchema = z.object({
|
|
title: z.string().min(1, "Title is required").max(255),
|
|
content: z.string().min(1, "Content is required").max(5000),
|
|
});
|
|
|
|
export async function createTicket(formData: FormData): Promise<void> {
|
|
// Re-read the session user id server-side; never trust a form-supplied id.
|
|
const session = await auth();
|
|
const userId = Number(session?.user?.id);
|
|
if (!Number.isInteger(userId) || userId <= 0) return;
|
|
|
|
const ip = await clientIp();
|
|
if (!rateLimit(`ticket:${userId}`, 3, 60_000).ok) return;
|
|
|
|
const raw = {
|
|
title: String(formData.get("title") ?? "").trim().slice(0, 255),
|
|
content: String(formData.get("content") ?? "").trim().slice(0, 5000),
|
|
};
|
|
|
|
const parsed = ticketSchema.safeParse(raw);
|
|
if (!parsed.success) return;
|
|
|
|
const { title, content } = parsed.data;
|
|
|
|
// Moderation check
|
|
try {
|
|
await moderateOrThrow(`${title} ${content}`);
|
|
} catch {
|
|
return;
|
|
}
|
|
|
|
const now = new Date();
|
|
await prisma.websiteHelpCenterTickets.create({
|
|
data: {
|
|
userId,
|
|
title,
|
|
content,
|
|
open: true,
|
|
createdAt: now,
|
|
updatedAt: now,
|
|
},
|
|
});
|
|
|
|
revalidatePath("/help/tickets");
|
|
}
|