@commonpub/layer 0.3.23 → 0.3.25

package/README.md

@@ -47,13 +47,13 @@ Create `server/utils/config.ts` to load the config on the server side. See `apps
 
 ## What's Included
 
-### Pages (20+ routes)
+### Pages (70+ routes)
 
 Content CRUD, hub feeds, learning paths, docs sites, admin panel, federation management, user profiles, messaging, notifications, search, and more.
 
-### Components (30+)
+### Components (100+)
 
-Content editor (`CpubEditor`), content cards, author rows, comment sections, engagement bars, federation UI, notification items, message threads, and more.
+Content editor (`CpubEditor`), content cards, author rows, comment sections, engagement bars, federation UI, notification items, message threads, block renderers, and more.
 
 ### Composables (19)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonpub/layer",
-  "version": "0.3.23",
+  "version": "0.3.25",
   "type": "module",
   "main": "./nuxt.config.ts",
   "files": [
@@ -44,15 +44,15 @@
     "vue": "^3.4.0",
     "vue-router": "^4.3.0",
     "zod": "^4.3.6",
-    "@commonpub/config": "0.7.1",
     "@commonpub/auth": "0.5.0",
+    "@commonpub/config": "0.7.1",
     "@commonpub/editor": "0.5.0",
-    "@commonpub/protocol": "0.9.5",
     "@commonpub/docs": "0.5.2",
-    "@commonpub/schema": "0.8.12",
-    "@commonpub/ui": "0.7.1",
+    "@commonpub/protocol": "0.9.5",
     "@commonpub/learning": "0.5.0",
-    "@commonpub/server": "2.15.0"
+    "@commonpub/server": "2.15.0",
+    "@commonpub/ui": "0.7.1",
+    "@commonpub/schema": "0.8.12"
   },
   "scripts": {}
 }

package/server/api/files/upload-from-url.post.ts

@@ -10,17 +10,24 @@ export default defineEventHandler(async (event) => {
   const user = requireAuth(event);
   const { url, purpose } = await parseBody(event, schema);
 
-  // SSRF protection — block private IPs
+  // SSRF protection — block private/internal IPs
   const parsed = new URL(url);
-  const hostname = parsed.hostname;
+  const hostname = parsed.hostname.toLowerCase();
+  const h = hostname.replace(/^\[|\]$/g, '');
   if (
-    hostname === 'localhost' ||
-    hostname === '127.0.0.1' ||
-    hostname === '::1' ||
-    hostname.startsWith('10.') ||
-    hostname.startsWith('192.168.') ||
-    hostname.match(/^172\.(1[6-9]|2\d|3[01])\./) ||
-    hostname === '169.254.169.254' // AWS metadata
+    h === 'localhost' ||
+    h === 'localhost.localdomain' ||
+    h === 'metadata.google.internal' ||
+    h.endsWith('.local') ||
+    /^127\./.test(h) ||
+    /^10\./.test(h) ||
+    /^172\.(1[6-9]|2\d|3[01])\./.test(h) ||
+    /^192\.168\./.test(h) ||
+    /^169\.254\./.test(h) ||
+    /^0\./.test(h) ||
+    h === '::1' ||
+    /^f[cd]/i.test(h) ||
+    /^fe80/i.test(h)
   ) {
     throw createError({ statusCode: 400, statusMessage: 'Cannot fetch from private/local addresses' });
   }

package/server/api/image-proxy.get.ts

@@ -29,15 +29,22 @@ export default defineEventHandler(async (event) => {
   }
 
   // Block localhost/private IPs (SSRF prevention)
-  const hostname = parsed.hostname;
+  const hostname = parsed.hostname.toLowerCase();
+  const h = hostname.replace(/^\[|\]$/g, ''); // strip IPv6 brackets
   if (
-    hostname === 'localhost' ||
-    hostname === '127.0.0.1' ||
-    hostname === '::1' ||
-    hostname.startsWith('10.') ||
-    hostname.startsWith('172.') ||
-    hostname.startsWith('192.168.') ||
-    hostname.endsWith('.local')
+    h === 'localhost' ||
+    h === 'localhost.localdomain' ||
+    h === 'metadata.google.internal' ||
+    h.endsWith('.local') ||
+    /^127\./.test(h) ||
+    /^10\./.test(h) ||
+    /^172\.(1[6-9]|2\d|3[01])\./.test(h) ||
+    /^192\.168\./.test(h) ||
+    /^169\.254\./.test(h) ||
+    /^0\./.test(h) ||
+    h === '::1' ||
+    /^f[cd]/i.test(h) ||
+    /^fe80/i.test(h)
   ) {
     throw createError({ statusCode: 403, statusMessage: 'Private addresses not allowed' });
   }

package/server/api/realtime/stream.get.ts

@@ -30,8 +30,12 @@ export default defineEventHandler(async (event) => {
         controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'counts', notifications, messages })}\n\n`));
       }
 
-      // Send initial counts
-      await sendCounts();
+      // Send initial counts — if DB is unavailable, send zeros and let polling retry
+      try {
+        await sendCounts();
+      } catch {
+        controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'counts', notifications: 0, messages: 0 })}\n\n`));
+      }
 
       // Poll every 10 seconds
       const interval = setInterval(async () => {

package/server/plugins/federation-hub-sync.ts

@@ -39,7 +39,11 @@ export default defineNitroPlugin((nitro) => {
       // Run first sync after a brief delay to avoid startup contention
       runSync(domain, intervalMs, backfillOnSync);
 
-      interval = setInterval(() => runSync(domain, intervalMs, backfillOnSync), intervalMs);
+      interval = setInterval(() => {
+        runSync(domain, intervalMs, backfillOnSync).catch((err) => {
+          console.error('[hub-sync] Sync worker unexpected error:', err instanceof Error ? err.message : err);
+        });
+      }, intervalMs);
     } catch (err) {
       console.error('[hub-sync] Failed to start:', err instanceof Error ? err.message : err);
     }

package/server/plugins/notification-email.ts

@@ -64,7 +64,11 @@ export default defineNitroPlugin((nitro) => {
 
       // Digest scheduler — runs every hour, sends digests for users whose digest window has elapsed
       const DIGEST_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
-      digestInterval = setInterval(() => runDigest(siteUrl, siteName), DIGEST_INTERVAL_MS);
+      digestInterval = setInterval(() => {
+        runDigest(siteUrl, siteName).catch((err) => {
+          console.error('[notification-email] Digest scheduler unexpected error:', err instanceof Error ? err.message : err);
+        });
+      }, DIGEST_INTERVAL_MS);
 
       console.log('[notification-email] Digest scheduler started (interval: 1h)');
     } catch (err) {

package/server/routes/.well-known/webfinger.ts

@@ -36,8 +36,8 @@ export default defineEventHandler(async (event) => {
   // CORS — WebFinger must be accessible from browser-based AP clients
   setResponseHeader(event, 'access-control-allow-origin', '*');
 
-  // Instance actor lookup: acct:domain@domain → /actor Service
-  if (parsed.username === instanceDomain || parsed.username === config.instance.domain) {
+  // Instance actor lookup: acct:domain@domain or acct:instance@domain → /actor Service
+  if (parsed.username === instanceDomain || parsed.username === config.instance.domain || parsed.username === 'instance') {
     const actorUri = `https://${instanceDomain}/actor`;
     setResponseHeader(event, 'content-type', 'application/jrd+json');
     return buildWebFingerResponse({