Files
Epicnabbo-Catalogus-Updated…/src/app/(site)/room/[id]/page.tsx
T
openhands 6cc45d7413 feat: harden atoms-nexst against review findings (37 items)
Second review pass covering security, performance, admin tooling and the
public/room flows. All HIGH and MEDIUM findings from the audit are resolved;
nothing in this commit changes the visible feature set.

Authentication & session security
- CSP is now set on the request headers in the proxy, which is what Next.js
  uses to derive the render nonce, so the nonce is effective.
- 2FA: an already-enabled user cannot re-enroll, the setup endpoint is
  rate-limited per account, and confirmed codes are persisted so the second
  secret no longer silently never applies.
- Password reset revokes the ticket, authTicket and all personal access
  tokens, and bumps the token version so existing sessions die. The same
  revocation is now wired into the staff-side password reset.
- /reset and /verify return a stable error code instead of raw text; the
  mail lookups are ordered by id so duplicates cannot vary between runs.
- Resending the verification mail gets a per-address cooldown on top of the
  per-user limit.
- Issue API tokens with the narrower radio/ticket ability set instead of "*".

Authorization & input handling
- Mid-rank staff can no longer keep dynamically granted non-view admin.*
  permissions: existing grants are revoked by migration and the grant lookup
  is restricted to "%.view". Rank guards use the dynamic super-admin check.
- Alerting a user is permission-checked and audited like the other tools.
- Material mutations (giveCredits/giveDuckets/giveDiamonds, the admin user
  actions route, bulk user actions) are capped and rank-guarded, and bulk
  ids are bounded.
- updateRoom / updateRoomItem write through a field allowlist, and items
  may only be edited through their own room.
- Classnames reaching the filesystem are validated before use so a crafted
  value cannot escape the asset directories.
- The word filter now also covers offline mails, guild forum threads and
  replies, and user mottos.
- Media uploads are validated by magic bytes, /api/media requires the page
  edit permission, APP_URL must be configured once mail is enabled, and the
  diagnostics error route checks the fetch site header.

Admin tooling
- Secret settings render masked and cannot be overwritten with a blank or
  an arbitrary raw key; radio credentials are new password inputs.
- Commandocentrum balance changes are audited.
- Admin list pagination reads the caller's per-page instead of the max, and
  the log exporter caps offset and search length.

Performance
- Catalog translations are cached per module, with a cheap revision hash;
  the public online count uses a stale window instead of hammering the DB.
- The cache warmup now primes the payload the home route actually reads.
- TopHeader batches its queries into one round trip, and LCP avatars load
  eagerly.
- motion/react and sonner are no longer part of the root layout; the nav
  dropdown and mobile nav panels are lazy client chunks. Anonymous visitors
  again get the navigation chrome, and public pages get an edge cacheable
  response.

Accessibility
- Nested <main> elements in phase pages became <section>; the page entrance
  and route progress animations are pure CSS that respect reduced motion.
2026-10-09 16:19:48 +02:00

172 lines
4.5 KiB
TypeScript
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
import { eq } from "drizzle-orm";
import type { Metadata } from "next";
import { notFound } from "next/navigation";
import Link from "@/components/link";
import { ContentCard, EmptyState, StatBlock } from "@/components/public/ui";
import { db, Rooms, User } from "@/lib/db";
// Arcturus stores room access as a short string on rooms.state. Map each known
// value to a friendly label + lock icon; unknown values fall back to the raw
// string so we never hide a real (future) state from the visitor.
const STATE_LABELS: Record<string, { label: string; icon: string }> = {
open: { label: "Open", icon: "🔓" },
locked: { label: "Locked (doorbell)", icon: "🔒" },
password: { label: "Password", icon: "🔑" },
invisible: { label: "Invisible", icon: "👻" },
};
function describeState(state: string): { label: string; icon: string } {
// eslint-disable-next-line security/detect-object-injection -- STATE_LABELS has known keys, fallback provided
return STATE_LABELS[state] ?? { label: state || "Unknown", icon: "🚪" };
}
/** Parse a route id to a positive integer, or null when it isn't numeric. */
function parseRoomId(raw: string): number | null {
if (!/^\d+$/.test(raw)) return null;
const id = Number(raw);
return Number.isSafeInteger(id) && id > 0 ? id : null;
}
async function getRoom(raw: string) {
const id = parseRoomId(raw);
if (id === null) return null;
const [room] = await db
.select({
id: Rooms.id,
ownerId: Rooms.ownerId,
ownerName: Rooms.ownerName,
name: Rooms.name,
description: Rooms.description,
state: Rooms.state,
users: Rooms.users,
usersMax: Rooms.usersMax,
category: Rooms.category,
score: Rooms.score,
tags: Rooms.tags,
})
.from(Rooms)
.where(eq(Rooms.id, id))
.limit(1)
.catch(() => []);
return room ?? null;
}
export async function generateMetadata({
params,
}: {
params: Promise<{ id: string }>;
}): Promise<Metadata> {
const { id } = await params;
const room = await getRoom(id);
if (!room) return { title: "Room" };
return {
title: room.name || `Room #${room.id}`,
description:
room.description || `Visit ${room.name || "this room"} in the hotel.`,
};
}
export default async function RoomPage({
params,
}: {
params: Promise<{ id: string }>;
}) {
const { id } = await params;
// Guard non-numeric / absent ids before touching the DB.
if (parseRoomId(id) === null) notFound();
const room = await getRoom(id);
if (!room) notFound();
// Resolve the live owner username by id; fall back to the room's denormalised
// owner_name column if the account row is missing or the query degrades.
const owner =
room.ownerId > 0
? (
await db
.select({ username: User.username })
.from(User)
.where(eq(User.id, room.ownerId))
.limit(1)
.catch(() => [])
)[0]
: null;
const ownerName = owner?.username || room.ownerName || "Unknown";
const state = describeState(room.state);
const tags = room.tags
.split(/[,;\s]+/)
.map((t) => t.trim())
.filter(Boolean);
return (
<section className="page-grid">
<p style={{ margin: 0 }}>
<Link href="/" className="btn btn-outline">
← Back to the hotel
</Link>
</p>
<ContentCard
icon="🚪"
title={room.name || `Room #${room.id}`}
subtitle={
<>
Owned by{" "}
<Link href={`/u/${encodeURIComponent(ownerName)}`}>
{ownerName}
</Link>
</>
}
>
{room.description ? (
<p style={{ margin: "0 0 1rem" }}>{room.description}</p>
) : (
<p className="muted" style={{ margin: "0 0 1rem" }}>
This room has no description.
</p>
)}
<div className="stat-grid">
<StatBlock
icon="👥"
value={`${room.users.toLocaleString()} / ${room.usersMax.toLocaleString()}`}
label="Users"
/>
<StatBlock icon={state.icon} value={state.label} label="Access" />
<StatBlock
icon="⭐"
value={room.score.toLocaleString()}
label="Rating"
/>
<StatBlock icon="🏷️" value={`#${room.category}`} label="Category" />
</div>
{tags.length > 0 ? (
<div
style={{
display: "flex",
flexWrap: "wrap",
gap: "0.5rem",
marginTop: "1rem",
}}
>
{tags.map((tag) => (
<span key={tag} className="online-badge">
#{tag}
</span>
))}
</div>
) : null}
</ContentCard>
<ContentCard icon="ℹ️" title="About this room">
<EmptyState icon="🎮">
Enter the hotel to visit {room.name || `room #${room.id}`} in 3D.
</EmptyState>
</ContentCard>
</section>
);
}