fix: harden deploys and close top security holes after /events outage

Isolate next dev from production .next, add build-guard/atomic deploy/health watchdog, error boundaries, and fix JWT startup, meetup leaks, media path traversal, SVG/memory uploads, and JSON-LD escaping. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-18 19:14:57 +02:00
parent 495289232b
commit ede8817583
22 changed files with 700 additions and 86 deletions
@@ -6,13 +6,38 @@ export async function GET(req: NextRequest) {
  const upstream = new URL(apiUrl('/nip05'));
  if (name) upstream.searchParams.set('name', name);

-  const res = await fetch(upstream.toString(), { cache: 'no-store' });
-  const data = await res.json();
-
-  return NextResponse.json(data, {
-    headers: {
-      'Access-Control-Allow-Origin': '*',
-      'Cache-Control': 'no-store',
-    },
-  });
+  try {
+    const res = await fetch(upstream.toString(), { cache: 'no-store' });
+    if (!res.ok) {
+      return NextResponse.json(
+        {},
+        {
+          status: 502,
+          headers: {
+            'Access-Control-Allow-Origin': '*',
+            'Cache-Control': 'no-store',
+          },
+        }
+      );
+    }
+    const data = await res.json();
+    return NextResponse.json(data, {
+      headers: {
+        'Access-Control-Allow-Origin': '*',
+        'Cache-Control': 'no-store',
+      },
+    });
+  } catch (err) {
+    console.error('NIP-05 proxy error:', err);
+    return NextResponse.json(
+      {},
+      {
+        status: 502,
+        headers: {
+          'Access-Control-Allow-Origin': '*',
+          'Cache-Control': 'no-store',
+        },
+      }
+    );
+  }
 }
@@ -0,0 +1,53 @@
+"use client";
+
+import { useEffect } from "react";
+import Link from "next/link";
+
+// Route-segment error boundary. Catches runtime errors thrown while rendering any
+// page/segment (e.g. a request-time fetch or a bad build artifact) and shows a
+// recoverable UI with a retry, instead of a bare 500.
+export default function Error({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string };
+  reset: () => void;
+}) {
+  useEffect(() => {
+    console.error("Route error boundary caught:", error);
+  }, [error]);
+
+  return (
+    <div className="min-h-screen flex flex-col items-center justify-center px-8">
+      <span className="text-7xl md:text-9xl font-black tracking-tighter text-transparent bg-clip-text bg-gradient-to-r from-primary to-primary-container leading-none">
+        Oops
+      </span>
+      <h1 className="text-2xl md:text-3xl font-bold mt-6 mb-3">
+        Something went wrong
+      </h1>
+      <p className="text-on-surface-variant mb-10 text-center max-w-md">
+        This page hit an unexpected error. It&apos;s usually temporary — try again
+        in a moment.
+      </p>
+      <div className="flex flex-wrap gap-3 justify-center">
+        <button
+          onClick={() => reset()}
+          className="bg-gradient-to-r from-primary to-primary-container text-on-primary px-8 py-3 rounded-lg font-bold hover:scale-105 transition-transform"
+        >
+          Try again
+        </button>
+        <Link
+          href="/"
+          className="border border-zinc-700 px-8 py-3 rounded-lg font-bold hover:bg-zinc-800/50 transition-colors"
+        >
+          Back to Home
+        </Link>
+      </div>
+      {error?.digest && (
+        <p className="text-on-surface-variant/50 text-xs mt-8 font-mono">
+          ref: {error.digest}
+        </p>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,73 @@
+"use client";
+
+import { useEffect } from "react";
+
+// Last-resort boundary: catches errors thrown in the root layout itself. It
+// replaces the whole document, so it must render its own <html>/<body> and can't
+// rely on the app's global CSS — hence inline styles.
+export default function GlobalError({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string };
+  reset: () => void;
+}) {
+  useEffect(() => {
+    console.error("Global error boundary caught:", error);
+  }, [error]);
+
+  return (
+    <html lang="en">
+      <body
+        style={{
+          margin: 0,
+          minHeight: "100vh",
+          display: "flex",
+          flexDirection: "column",
+          alignItems: "center",
+          justifyContent: "center",
+          gap: "1rem",
+          padding: "2rem",
+          background: "#0a0a0a",
+          color: "#ededed",
+          fontFamily:
+            "ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, sans-serif",
+          textAlign: "center",
+        }}
+      >
+        <h1 style={{ fontSize: "1.75rem", fontWeight: 800, margin: 0 }}>
+          Something went wrong
+        </h1>
+        <p style={{ color: "#a1a1aa", maxWidth: "28rem", margin: 0 }}>
+          The site hit an unexpected error. Please try again in a moment.
+        </p>
+        <button
+          onClick={() => reset()}
+          style={{
+            marginTop: "0.5rem",
+            padding: "0.75rem 2rem",
+            borderRadius: "0.5rem",
+            border: "none",
+            fontWeight: 700,
+            cursor: "pointer",
+            background: "#f7931a",
+            color: "#0a0a0a",
+          }}
+        >
+          Try again
+        </button>
+        {error?.digest && (
+          <p
+            style={{
+              color: "#71717a",
+              fontSize: "0.75rem",
+              fontFamily: "ui-monospace, monospace",
+            }}
+          >
+            ref: {error.digest}
+          </p>
+        )}
+      </body>
+    </html>
+  );
+}
@@ -180,50 +180,72 @@ function handleVideoStream(
 export const dynamic = 'force-dynamic';
 export const runtime = 'nodejs';

+// Media blobs are stored as ULIDs (Crockford base32, 26 chars). Reject anything
+// else before joining into the storage path so `../` cannot escape the root.
+const MEDIA_ID_RE = /^[0-9A-HJKMNP-TV-Z]{26}$/;
+
+function resolveSafeMediaPath(root: string, id: string): string | null {
+  if (!MEDIA_ID_RE.test(id)) return null;
+  const resolvedRoot = path.resolve(root);
+  const filePath = path.resolve(resolvedRoot, id);
+  const rootPrefix = resolvedRoot.endsWith(path.sep)
+    ? resolvedRoot
+    : resolvedRoot + path.sep;
+  if (filePath !== resolvedRoot && !filePath.startsWith(rootPrefix)) {
+    return null;
+  }
+  return filePath;
+}
+
 export async function GET(
  request: NextRequest,
  context: { params: Promise<{ id: string }> | { id: string } }
 ) {
-  const params = await Promise.resolve(context.params);
-  const id = params.id;
-  if (!id) {
-    return NextResponse.json({ error: 'Not found' }, { status: 404 });
-  }
-
-  const root = getMediaStorageRoot();
-  const filePath = path.join(root, id);
-  if (!fileExists(filePath)) {
-    return NextResponse.json({ error: 'Not found' }, { status: 404 });
-  }
-
-  const meta = readMeta(root, id);
-  if (!meta) {
-    return NextResponse.json({ error: 'Metadata not found' }, { status: 404 });
-  }
-
-  const { searchParams } = new URL(request.url);
-  const widthParam = searchParams.get('w');
-
-  if (meta.type === 'image' && widthParam) {
-    const width = parseInt(widthParam, 10);
-    if (isNaN(width) || width < 1 || width > 4096) {
-      return NextResponse.json({ error: 'Invalid width' }, { status: 400 });
+  try {
+    const params = await Promise.resolve(context.params);
+    const id = params.id;
+    if (!id) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
    }
-    return handleImageResize(root, filePath, width, meta, id);
-  }

-  if (meta.type === 'video') {
-    const rangeHeader = request.headers.get('range');
-    return handleVideoStream(filePath, meta, rangeHeader);
-  }
+    const root = getMediaStorageRoot();
+    const filePath = resolveSafeMediaPath(root, id);
+    if (!filePath || !fileExists(filePath)) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }

-  const buffer = fs.readFileSync(filePath);
-  return new NextResponse(new Uint8Array(buffer), {
-    status: 200,
-    headers: {
-      'Content-Type': meta.mimeType,
-      'Content-Length': String(buffer.length),
-      ...CACHE_HEADERS,
-    },
-  });
+    const meta = readMeta(root, id);
+    if (!meta) {
+      return NextResponse.json({ error: 'Metadata not found' }, { status: 404 });
+    }
+
+    const { searchParams } = new URL(request.url);
+    const widthParam = searchParams.get('w');
+
+    if (meta.type === 'image' && widthParam) {
+      const width = parseInt(widthParam, 10);
+      if (isNaN(width) || width < 1 || width > 4096) {
+        return NextResponse.json({ error: 'Invalid width' }, { status: 400 });
+      }
+      return await handleImageResize(root, filePath, width, meta, id);
+    }
+
+    if (meta.type === 'video') {
+      const rangeHeader = request.headers.get('range');
+      return handleVideoStream(filePath, meta, rangeHeader);
+    }
+
+    const buffer = fs.readFileSync(filePath);
+    return new NextResponse(new Uint8Array(buffer), {
+      status: 200,
+      headers: {
+        'Content-Type': meta.mimeType,
+        'Content-Length': String(buffer.length),
+        ...CACHE_HEADERS,
+      },
+    });
+  } catch (err) {
+    console.error('Media serve error:', err);
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
 }