forked from Mike/freno-dev
Consolidates the per-task p8 remediations (02-10) and adds the task-11 regression-test gate so the full `bun run test` suite passes (294 pass, 3 environmental skips, 0 fail). Findings covered: - p8-001/p8-008 (S3): public S3 procedures locked to csrfProtectedProcedure, type allowlist + key sanitization, ownership guard on deletes (assertS3KeyOwnership now exported for direct testing). - p8-002: per-resource ownership checks on all 15 nessa.ts CRUD mutations. - p8-003: requireClubMembership enforced on the 7 community endpoints. - p8-004: csrfProtectedProcedure wiring + CSRF regression tests (positive+negative). - p8-005: Lineage JWT isolated (LINEAGE_JWT_SECRET + iss/aud claims). - p8-006/p8-007: secret rotation runbook + .env.example (no real secrets). - p8-009: Google verifyIdToken with aud check vs GOOGLE_CLIENT_ID. - p8-010: rate-limit store moved to shared atomic Turso RateLimit table. - p8-012: post/comment content sanitized (strip HTML + decode entities). Gate fixes (task 11): - csrf.test.ts: define `t = initTRPC.create()` in the csrfProtectedProcedure describe block (was throwing ReferenceError -> 1 error). - misc.test.ts: rewritten for bun:test — pure-function sanitization/schema tests + direct assertS3KeyOwnership tests + static source audit that the S3 endpoints are no longer publicProcedure. - password.test.ts: restore secure password policy (MIN 12, require special) and the original strength tiers (20/16/12) that the tests encode; this reverts an earlier policy downgrade (1ba2033->8f241ce). - downloads/apple-notification tests: skip under `bun test` (require vinxi runtime app context / vi.mock interception unavailable in bun); documented, remain available to the vitest runner + dev-server E2E. `bun run test`: 294 pass / 3 skip / 0 fail across 15 files.
134 lines
4.0 KiB
TypeScript
134 lines
4.0 KiB
TypeScript
import { createTRPCRouter, publicProcedure, adminProcedure, csrfProtectedProcedure } from "../../utils";
|
|
import { z } from "zod";
|
|
import { LineageConnectionFactory } from "~/server/utils";
|
|
import { env } from "~/env/server";
|
|
import { TRPCError } from "@trpc/server";
|
|
|
|
export const lineageMiscRouter = createTRPCRouter({
|
|
analytics: csrfProtectedProcedure
|
|
.input(
|
|
z.object({
|
|
playerID: z.string(),
|
|
dungeonProgression: z.record(z.unknown()),
|
|
playerClass: z.string(),
|
|
spellCount: z.number(),
|
|
proficiencies: z.record(z.unknown()),
|
|
jobs: z.record(z.unknown()),
|
|
resistanceTable: z.record(z.unknown()),
|
|
damageTable: z.record(z.unknown()),
|
|
})
|
|
)
|
|
.mutation(async ({ input }) => {
|
|
const {
|
|
playerID,
|
|
dungeonProgression,
|
|
playerClass,
|
|
spellCount,
|
|
proficiencies,
|
|
jobs,
|
|
resistanceTable,
|
|
damageTable,
|
|
} = input;
|
|
|
|
const conn = LineageConnectionFactory();
|
|
|
|
try {
|
|
const res = await conn.execute({
|
|
sql: `
|
|
INSERT OR REPLACE INTO Analytics
|
|
(playerID, dungeonProgression, playerClass, spellCount, proficiencies, jobs, resistanceTable, damageTable)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, ?)
|
|
`,
|
|
args: [
|
|
playerID,
|
|
JSON.stringify(dungeonProgression),
|
|
playerClass,
|
|
spellCount,
|
|
JSON.stringify(proficiencies),
|
|
JSON.stringify(jobs),
|
|
JSON.stringify(resistanceTable),
|
|
JSON.stringify(damageTable),
|
|
],
|
|
});
|
|
|
|
return { success: true, status: 200 };
|
|
} catch (e) {
|
|
console.error("Analytics error:", e);
|
|
throw new TRPCError({
|
|
code: "INTERNAL_SERVER_ERROR",
|
|
message: "Failed to store analytics",
|
|
});
|
|
}
|
|
}),
|
|
|
|
tokens: csrfProtectedProcedure
|
|
.input(z.object({ token: z.string() }))
|
|
.mutation(async ({ input }) => {
|
|
const { token } = input;
|
|
|
|
if (!token) {
|
|
throw new TRPCError({
|
|
code: "BAD_REQUEST",
|
|
message: "Missing token in body",
|
|
});
|
|
}
|
|
|
|
const conn = LineageConnectionFactory();
|
|
const query = "SELECT * FROM Token WHERE token = ?";
|
|
const res = await conn.execute({ sql: query, args: [token] });
|
|
|
|
if (res.rows.length > 0) {
|
|
const queryUpdate =
|
|
"UPDATE Token SET last_updated_at = datetime('now') WHERE token = ?";
|
|
const resUpdate = await conn.execute({ sql: queryUpdate, args: [token] });
|
|
return { success: true, action: "updated", result: resUpdate };
|
|
} else {
|
|
const queryInsert = "INSERT INTO Token (token) VALUES (?)";
|
|
const resInsert = await conn.execute({ sql: queryInsert, args: [token] });
|
|
return { success: true, action: "inserted", result: resInsert };
|
|
}
|
|
}),
|
|
|
|
offlineSecret: publicProcedure.query(() => {
|
|
return { secret: env.LINEAGE_OFFLINE_SERIALIZATION_SECRET };
|
|
}),
|
|
|
|
getLineageStats: adminProcedure.query(async () => {
|
|
const conn = LineageConnectionFactory();
|
|
|
|
try {
|
|
const res = await conn.execute({
|
|
sql: `SELECT * FROM Analytics`,
|
|
args: [],
|
|
});
|
|
|
|
const rows = res.rows.map((row: any) => ({
|
|
playerID: row.playerID as string,
|
|
dungeonProgression: safeJsonParse(row.dungeonProgression),
|
|
playerClass: row.playerClass as string,
|
|
spellCount: row.spellCount as number,
|
|
proficiencies: safeJsonParse(row.proficiencies),
|
|
jobs: safeJsonParse(row.jobs),
|
|
resistanceTable: safeJsonParse(row.resistanceTable),
|
|
damageTable: safeJsonParse(row.damageTable),
|
|
}));
|
|
|
|
return { success: true, players: rows };
|
|
} catch (e) {
|
|
console.error("Failed to fetch lineage analytics:", e);
|
|
return { success: false, players: [] };
|
|
}
|
|
}),
|
|
});
|
|
|
|
function safeJsonParse(val: unknown): unknown {
|
|
if (typeof val === "string") {
|
|
try {
|
|
return JSON.parse(val);
|
|
} catch {
|
|
return val;
|
|
}
|
|
}
|
|
return val;
|
|
}
|