snowspeeder/roast_command_center
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: format auth code and update runtime

Browse Source
This commit is contained in:
snowspeeder
2026-07-29 22:11:08 -04:00
parent 892479dceb
commit 22e6e721a7
9 changed files with 132 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/app.js
+32 -25
View File
@@ -28,7 +28,14 @@ export function createApp({ db, root, env = process.env } = {}) {
const buckets = new Map();
const MAX_RATE_BUCKETS = 10_000;
const rateLimit = (name, max, windowMs) => {
if (!Number.isInteger(max) || max < 1 || max > 1_000 || !Number.isInteger(windowMs) || windowMs < 1_000 || windowMs > 3_600_000)
if (
!Number.isInteger(max) ||
max < 1 ||
max > 1_000 ||
!Number.isInteger(windowMs) ||
windowMs < 1_000 ||
windowMs > 3_600_000
)
throw new Error("Invalid rate-limit configuration");
return (req, res, next) => {
const key = `${name}:${req.ip}`;
@@ -53,7 +60,11 @@ export function createApp({ db, root, env = process.env } = {}) {
// identifies its proxy. A numeric hop count is unsafe when the topology changes.
app.set("trust proxy", env.TRUST_PROXY || false);
app.use((req, res, next) => {
if (req.path.startsWith("/api/") || req.path === "/app" || req.path === "/admin")
if (
req.path.startsWith("/api/") ||
req.path === "/app" ||
req.path === "/admin"
)
res.set("Cache-Control", "no-store, private");
res.set({
"X-Content-Type-Options": "nosniff",
@@ -146,14 +157,12 @@ export function createApp({ db, root, env = process.env } = {}) {
const email = emailOf(req.body.email),
password = req.body.password;
if (!/^\S+@\S+\.\S+$/.test(email) || !PASSWORD_OK(password))
return res
.status(400)
.json({
ok: false,
code: "invalid_credentials",
error:
"Use a valid email and a password of at least 12 characters.",
});
return res.status(400).json({
ok: false,
code: "invalid_credentials",
error:
"Use a valid email and a password of at least 12 characters.",
});
const setting = await db.query(
"SELECT value FROM app_settings WHERE key='signup_enabled'",
);
@@ -168,13 +177,11 @@ export function createApp({ db, root, env = process.env } = {}) {
).rows[0];
const s = await createSession(user);
setSessionCookie(res, s.raw, 14 * 864e5, s.csrfToken);
res
.status(201)
.json({
ok: true,
user: { email: user.email, role: user.role },
csrfToken: s.csrfToken,
});
res.status(201).json({
ok: true,
user: { email: user.email, role: user.role },
csrfToken: s.csrfToken,
});
} catch (e) {
if (e.code === "23505")
return res.status(409).json({ ok: false, code: "email_exists" });
@@ -196,7 +203,9 @@ export function createApp({ db, root, env = process.env } = {}) {
return res.status(409).json({ ok: false, code: "bootstrap_used" });
const bootstrap = String(req.body.setupToken || "");
if (!env.BOOTSTRAP_SETUP_TOKEN)
return res.status(503).json({ ok: false, code: "bootstrap_unavailable" });
return res
.status(503)
.json({ ok: false, code: "bootstrap_unavailable" });
if (
bootstrap.length !== env.BOOTSTRAP_SETUP_TOKEN.length ||
!crypto.timingSafeEqual(
@@ -222,13 +231,11 @@ export function createApp({ db, root, env = process.env } = {}) {
).rows[0];
const s = await createSession(user);
setSessionCookie(res, s.raw, 14 * 864e5, s.csrfToken);
res
.status(201)
.json({
ok: true,
user: { email: user.email, role: user.role },
csrfToken: s.csrfToken,
});
res.status(201).json({
ok: true,
user: { email: user.email, role: user.role },
csrfToken: s.csrfToken,
});
} catch (e) {
next(e);
}