openhands
3c8abb6fbf
CI / check (push) Successful in 39s
CI / tests-imaging-browsers (push) Successful in 2m9s
CI / tests-integration (push) Successful in 2m47s
CI / tests-unit (push) Failing after 3m22s
CI / tests-ui (push) Failing after 4m14s
CI / preflight (push) Skipped
CI / deploy (push) Skipped
Bundle the remaining imaging hardening and the host/CI fixes from the
"Doe alles" pass into one release.
Furniture:
- Resolve the local bundle extension from FURNI_BUNDLE_EXT (".hab" default,
".nitro" for a stock Nitro client). The configured extension is written by
imports/repairs and preferred on lookup; the other stays a legacy fallback.
Imaging:
- Avatar proxy sends s-maxage=86400 + stale-while-revalidate (300/3600 for the
fallback path) so the edge can hold a render a day.
- Cloudflare cache rule now covers /api/imaging/ (verified MISS->HIT live).
- Document that bare /imaging is shadowed by the edge proxy to the renderer.
Ops/CI:
- docker-update.sh skips a CI-managed host (exit 0) instead of failing cron.
- ci-deploy.sh runs the cross-browser imaging gate (chromium+firefox+webkit)
against the candidate before cutover; DEPLOY_SKIP_CROSS_BROWSER=1 as escape.
- scripts/imager-health-alert.sh alerts (Discord) on imager up/down transitions;
runs from cron every 5 minutes.
Tests:
- Furniture bundle-ext resolver + FURNI_BUNDLE_EXT wiring.
- Imaging performance budget (bytes + warm latency).
- classifyDdos: /api/imaging/* stays in the api bucket.
48 lines
1.4 KiB
TypeScript
48 lines
1.4 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
|
|
import { classifyDdos, isSuspiciousPath } from "@/lib/ddos";
|
|
|
|
describe("classifyDdos", () => {
|
|
it.each([
|
|
["/", "pages"],
|
|
["/community", "pages"],
|
|
["/login", "auth"],
|
|
["/login/", "auth"],
|
|
["/register", "auth"],
|
|
["/admin", "auth"],
|
|
["/admin/home", "auth"],
|
|
["/api/auth/callback/credentials", "auth"],
|
|
["/api/articles/hello", "api"],
|
|
["/api/radio/stream", "api"],
|
|
// Imaging is deliberately in the `api` bucket: it is high-volume and
|
|
// cacheable, so it gets the generous api budget, not the page budget.
|
|
["/api/imaging/avatar", "api"],
|
|
["/api/imaging/badge", "api"],
|
|
])(`classifies %s as %s`, (pathname, expected) => {
|
|
expect(classifyDdos(pathname)).toBe(expected);
|
|
});
|
|
});
|
|
|
|
describe("isSuspiciousPath", () => {
|
|
it.each([
|
|
["/wp-admin/index.php", true],
|
|
["/wp-login.php", true],
|
|
["/.env", true],
|
|
["/.git/config", true],
|
|
["/phpmyadmin/", true],
|
|
["/server-status", true],
|
|
["/index.php", true],
|
|
["/shell.aspx", true],
|
|
])(`flags scanner path %s`, (pathname, expected) => {
|
|
expect(isSuspiciousPath(pathname)).toBe(expected);
|
|
});
|
|
|
|
it("does not flag real app routes", () => {
|
|
expect(isSuspiciousPath("/")).toBe(false);
|
|
expect(isSuspiciousPath("/community")).toBe(false);
|
|
expect(isSuspiciousPath("/api/health")).toBe(false);
|
|
expect(isSuspiciousPath("/login")).toBe(false);
|
|
expect(isSuspiciousPath("/news/article/hello-world")).toBe(false);
|
|
});
|
|
});
|