openhands
179484642f
Gitea Actions Runner Test / test-job (push) Successful in 2s
CI / check (push) Successful in 28s
CI / tests-integration (push) Successful in 1m42s
CI / tests-unit (push) Failing after 1m45s
CI / tests-ui (push) Successful in 2m29s
CI / preflight (push) Skipped
CI / deploy (push) Skipped
Closes the four HIGH/MEDIUM items left open after the previous pass. Login lockout - The only login limits were keyed on the client IP, so a distributed attempt could grind on one account indefinitely. Added a per-account lockout with a budget of 8 failures per 15 minutes. - The bucket is keyed on the RESOLVED account id, not on the submitted string: users may sign in with either username or e-mail and neither the lookup nor the input normaliser folds case, so an input-keyed bucket would hand out a fresh budget per spelling of the same account. - precheckLogin and NextAuth's authorize share the bucket, so the pre-check cannot be used to buy extra attempts and a client that skips it entirely is still bounded. Both check the lockout BEFORE verifying the password: the success path clears the counter, which would otherwise walk a locked account straight back in on the right password. - A successful login clears the failures, which needs two new primitives in rate-limit.ts: peekRateLimit (read-only, does not consume a unit) and clearRateLimit. - Fixed a latent inconsistency while doing so: the in-process bucket capped its counter at the limit while Redis' INCR kept climbing, so the two backends disagreed about how far over the limit a key was. Both now track the true count. Mail lookup index - Added an index on users.mail (0035). Password reset, e-mail verification and the resend cooldown all resolve a single account from a submitted address and were full table scans of `users`. Deliberately non-unique: legacy rows can hold the same address more than once, so a unique index would fail to apply. Resend captcha - /verify's resend form triggers real outbound mail and was reachable with only a cooldown. It now runs the configured captcha before the account lookup and before any send. Client message payload - The root layout serialised the whole catalogue into every page. pages.admin and admin are ~177 KB of the ~235 KB and are unreachable from the public route group, so that layout now installs its own provider with the staff namespaces removed. Nested providers replace rather than merge, which is why this has to live in the segment layout. /admin, /mod, /client and /admin-next keep the full set; a guard test fails if a public page ever references a staff namespace.
80 lines
2.6 KiB
TypeScript
80 lines
2.6 KiB
TypeScript
import dynamic from "next/dynamic";
|
|
import { NextIntlClientProvider } from "next-intl";
|
|
import { getLocale, getMessages } from "next-intl/server";
|
|
import type { ReactNode } from "react";
|
|
import { CloudsField } from "@/components/clouds-field";
|
|
import MotionPageWrapper from "@/components/motion-page-wrapper";
|
|
import { Navigation } from "@/components/navigation";
|
|
import { SiteFooter } from "@/components/site-footer";
|
|
import { SiteHeader } from "@/components/site-header";
|
|
import { TopHeader } from "@/components/top-header";
|
|
import { auth } from "@/lib/auth";
|
|
import { publicClientMessages } from "@/lib/i18n-client-messages";
|
|
|
|
const RadioPlayerGate = dynamic(
|
|
() => import("@/components/public/radio-player-gate"),
|
|
{
|
|
loading: () => (
|
|
<div className="animate-pulse bg-[var(--admin-surface)] rounded h-12" />
|
|
),
|
|
},
|
|
);
|
|
|
|
/**
|
|
* Public site chrome. Route group `(site)` keeps this off `/admin` and `/client`,
|
|
* so housekeeping is never constrained by the public max-w-7xl grid.
|
|
*
|
|
* The message provider lives here rather than only in the root layout: nested
|
|
* NextIntlClientProviders replace the parent set instead of merging, so this is
|
|
* where the public catalogue is installed — without the ~177 KB of staff-tool
|
|
* namespaces that no page in this group can reach.
|
|
*/
|
|
export default async function SiteLayout({
|
|
children,
|
|
}: {
|
|
children: ReactNode;
|
|
}) {
|
|
const [session, locale, messages] = await Promise.all([
|
|
auth(),
|
|
getLocale(),
|
|
getMessages(),
|
|
]);
|
|
const clientMessages = publicClientMessages(messages);
|
|
|
|
return (
|
|
<NextIntlClientProvider locale={locale} messages={clientMessages}>
|
|
<CloudsField />
|
|
{/* Site chrome is public: hiding it all for anonymous visitors used to
|
|
strand them — from /news, /leaderboard or /shop there was no way to
|
|
reach any other page at all. */}
|
|
<div data-theme-block="top_header">
|
|
<TopHeader session={session} />
|
|
</div>
|
|
<div data-theme-block="site_header">
|
|
<SiteHeader />
|
|
</div>
|
|
<div data-theme-block="navigation">
|
|
<Navigation session={session} />
|
|
</div>
|
|
<main>
|
|
<div
|
|
data-theme-block="content_grid"
|
|
className="mx-auto mt-4 grid max-w-7xl grid-cols-12 gap-x-3 gap-y-5 px-3 py-3 sm:px-4 sm:py-4 md:mt-0 md:px-6 md:py-6 md:gap-y-6"
|
|
>
|
|
<div className="col-span-12 min-w-0">
|
|
<div data-theme-block="page_transition">
|
|
<MotionPageWrapper>{children}</MotionPageWrapper>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</main>
|
|
<div data-theme-block="footer">
|
|
<SiteFooter />
|
|
</div>
|
|
<div data-theme-block="radio_player">
|
|
<RadioPlayerGate />
|
|
</div>
|
|
</NextIntlClientProvider>
|
|
);
|
|
}
|