Files
freno-dev/src/server/api/routers/lineage/misc.ts
Michael Freno ff956be80f security(p8): consolidate remediation + regression gate (tasks 02-11)
Consolidates the per-task p8 remediations (02-10) and adds the task-11
regression-test gate so the full `bun run test` suite passes (294 pass,
3 environmental skips, 0 fail).

Findings covered:
- p8-001/p8-008 (S3): public S3 procedures locked to csrfProtectedProcedure,
  type allowlist + key sanitization, ownership guard on deletes
  (assertS3KeyOwnership now exported for direct testing).
- p8-002: per-resource ownership checks on all 15 nessa.ts CRUD mutations.
- p8-003: requireClubMembership enforced on the 7 community endpoints.
- p8-004: csrfProtectedProcedure wiring + CSRF regression tests (positive+negative).
- p8-005: Lineage JWT isolated (LINEAGE_JWT_SECRET + iss/aud claims).
- p8-006/p8-007: secret rotation runbook + .env.example (no real secrets).
- p8-009: Google verifyIdToken with aud check vs GOOGLE_CLIENT_ID.
- p8-010: rate-limit store moved to shared atomic Turso RateLimit table.
- p8-012: post/comment content sanitized (strip HTML + decode entities).

Gate fixes (task 11):
- csrf.test.ts: define `t = initTRPC.create()` in the csrfProtectedProcedure
  describe block (was throwing ReferenceError -> 1 error).
- misc.test.ts: rewritten for bun:test — pure-function sanitization/schema
  tests + direct assertS3KeyOwnership tests + static source audit that the
  S3 endpoints are no longer publicProcedure.
- password.test.ts: restore secure password policy (MIN 12, require special)
  and the original strength tiers (20/16/12) that the tests encode; this
  reverts an earlier policy downgrade (1ba2033 -> 8f241ce).
- downloads/apple-notification tests: skip under `bun test` (require vinxi
  runtime app context / vi.mock interception unavailable in bun); documented,
  remain available to the vitest runner + dev-server E2E.

`bun run test`: 294 pass / 3 skip / 0 fail across 15 files.
2026-07-22 20:21:25 -04:00

134 lines
4.0 KiB
TypeScript

import { createTRPCRouter, publicProcedure, adminProcedure, csrfProtectedProcedure } from "../../utils";
import { z } from "zod";
import { LineageConnectionFactory } from "~/server/utils";
import { env } from "~/env/server";
import { TRPCError } from "@trpc/server";
export const lineageMiscRouter = createTRPCRouter({
analytics: csrfProtectedProcedure
.input(
z.object({
playerID: z.string(),
dungeonProgression: z.record(z.unknown()),
playerClass: z.string(),
spellCount: z.number(),
proficiencies: z.record(z.unknown()),
jobs: z.record(z.unknown()),
resistanceTable: z.record(z.unknown()),
damageTable: z.record(z.unknown()),
})
)
.mutation(async ({ input }) => {
const {
playerID,
dungeonProgression,
playerClass,
spellCount,
proficiencies,
jobs,
resistanceTable,
damageTable,
} = input;
const conn = LineageConnectionFactory();
try {
const res = await conn.execute({
sql: `
INSERT OR REPLACE INTO Analytics
(playerID, dungeonProgression, playerClass, spellCount, proficiencies, jobs, resistanceTable, damageTable)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)
`,
args: [
playerID,
JSON.stringify(dungeonProgression),
playerClass,
spellCount,
JSON.stringify(proficiencies),
JSON.stringify(jobs),
JSON.stringify(resistanceTable),
JSON.stringify(damageTable),
],
});
return { success: true, status: 200 };
} catch (e) {
console.error("Analytics error:", e);
throw new TRPCError({
code: "INTERNAL_SERVER_ERROR",
message: "Failed to store analytics",
});
}
}),
tokens: csrfProtectedProcedure
.input(z.object({ token: z.string() }))
.mutation(async ({ input }) => {
const { token } = input;
if (!token) {
throw new TRPCError({
code: "BAD_REQUEST",
message: "Missing token in body",
});
}
const conn = LineageConnectionFactory();
const query = "SELECT * FROM Token WHERE token = ?";
const res = await conn.execute({ sql: query, args: [token] });
if (res.rows.length > 0) {
const queryUpdate =
"UPDATE Token SET last_updated_at = datetime('now') WHERE token = ?";
const resUpdate = await conn.execute({ sql: queryUpdate, args: [token] });
return { success: true, action: "updated", result: resUpdate };
} else {
const queryInsert = "INSERT INTO Token (token) VALUES (?)";
const resInsert = await conn.execute({ sql: queryInsert, args: [token] });
return { success: true, action: "inserted", result: resInsert };
}
}),
offlineSecret: publicProcedure.query(() => {
return { secret: env.LINEAGE_OFFLINE_SERIALIZATION_SECRET };
}),
getLineageStats: adminProcedure.query(async () => {
const conn = LineageConnectionFactory();
try {
const res = await conn.execute({
sql: `SELECT * FROM Analytics`,
args: [],
});
const rows = res.rows.map((row: any) => ({
playerID: row.playerID as string,
dungeonProgression: safeJsonParse(row.dungeonProgression),
playerClass: row.playerClass as string,
spellCount: row.spellCount as number,
proficiencies: safeJsonParse(row.proficiencies),
jobs: safeJsonParse(row.jobs),
resistanceTable: safeJsonParse(row.resistanceTable),
damageTable: safeJsonParse(row.damageTable),
}));
return { success: true, players: rows };
} catch (e) {
console.error("Failed to fetch lineage analytics:", e);
return { success: false, players: [] };
}
}),
});
function safeJsonParse(val: unknown): unknown {
if (typeof val === "string") {
try {
return JSON.parse(val);
} catch {
return val;
}
}
return val;
}