@meith/web 0.33.4 → 0.35.0

package/src/server/backup-download.ts

@@ -0,0 +1,66 @@
+import 'server-only'
+
+import { createReadStream } from 'node:fs'
+import { stat } from 'node:fs/promises'
+import { Readable } from 'node:stream'
+
+import { isBundleName } from '@meith/backup'
+
+import { resolveAdmin } from './admin'
+import { currentBackupSettings, destinationFor, localBundlePath } from './backup-admin'
+
+export const BACKUPS_PATH = '/admin/system/backups'
+
+export const DOWNLOAD_LINK_SECONDS = 300
+
+function notFound(): Response {
+  return new Response('Not found', { status: 404 })
+}
+
+function seeOther(location: string): Response {
+  return new Response(null, { status: 303, headers: { Location: location } })
+}
+
+export async function serveBackupDownload(name: string): Promise<Response> {
+  if (!isBundleName(name)) return notFound()
+
+  const resolved = await resolveAdmin()
+  if ('denied' in resolved) return seeOther(BACKUPS_PATH)
+  if (resolved.context.needsReauth) return seeOther(`${BACKUPS_PATH}?notice=reauth`)
+
+  const local = await localBundlePath(name)
+  if (local !== null) {
+    const { size } = await stat(local)
+    const body = Readable.toWeb(createReadStream(local)) as unknown as BodyInit
+    return new Response(body, {
+      headers: {
+        'Content-Type': 'application/gzip',
+        'Content-Length': String(size),
+        'Content-Disposition': `attachment; filename="${name}"`,
+        'X-Content-Type-Options': 'nosniff',
+        'Cache-Control': 'private, no-store',
+      },
+    })
+  }
+
+  const destination = destinationFor(await currentBackupSettings())
+  if (destination === undefined) return notFound()
+  const listed = await destination.list()
+  if (!listed.some((bundle) => bundle.name === name)) return notFound()
+
+  if (destination.downloadUrl !== undefined) {
+    return seeOther(await destination.downloadUrl(name, DOWNLOAD_LINK_SECONDS))
+  }
+
+  const opened = await destination.open(name)
+  if (opened === null) return notFound()
+  return new Response(opened.body as unknown as BodyInit, {
+    headers: {
+      'Content-Type': 'application/gzip',
+      ...(opened.size === null ? {} : { 'Content-Length': String(opened.size) }),
+      'Content-Disposition': `attachment; filename="${name}"`,
+      'X-Content-Type-Options': 'nosniff',
+      'Cache-Control': 'private, no-store',
+    },
+  })
+}

package/src/server/content-actions.ts

@@ -2,7 +2,7 @@
 
 import { redirect } from 'next/navigation'
 
-import { ForbiddenError, ValidationError } from '@meith/core'
+import { ForbiddenError, logger, ValidationError } from '@meith/core'
 import { msg } from '@meith/i18n'
 import {
   authorRef,
@@ -82,11 +82,15 @@ export async function quotePostAction(threadId: number, postId: number): Promise
 
   const forumId = target.forum.id
   const matrix = await authorizer.forumMatrix(actor, forumId)
+  const scope = {
+    ...(await authorizer.moderatorTargetIn(actor, forumId, matrix)),
+    threadAuthorId: target.authorUserId,
+  }
+  if (!authorizer.can(actor, 'thread.view', scope)) return null
+
   if (
-    !authorizer.can(actor, 'thread.view', {
-      ...(await authorizer.moderatorTargetIn(actor, forumId, matrix)),
-      threadAuthorId: target.authorUserId,
-    })
+    (target.visibility === 'deleted' && !authorizer.can(actor, 'content.viewDeleted', scope)) ||
+    (target.visibility === 'unapproved' && !authorizer.can(actor, 'content.viewUnapproved', scope))
   )
     return null
 
@@ -151,6 +155,20 @@ function pollClosingTime(value: string): Date | null {
 
 const toFormState = formStateReporter('content-actions', 'unexpected error writing content')
 
+async function finaliseNewPost(
+  kind: 'thread' | 'reply',
+  finalise: () => Promise<void>,
+): Promise<void> {
+  try {
+    await finalise()
+  } catch (err) {
+    logger().error(
+      { err: String(err), kind },
+      'content saved but attaching uploads or clearing the draft failed',
+    )
+  }
+}
+
 export interface ComposerAutosaveInput {
   readonly forumId?: number
   readonly threadId?: number
@@ -244,9 +262,11 @@ export async function createThreadAction(_prev: FormState, form: FormData): Prom
 
   let created: Awaited<ReturnType<typeof submitThread>>
   let resolved: Awaited<ReturnType<typeof resolveThreadTarget>>
+  let staged: Awaited<ReturnType<typeof stageAttachments>>
+  let userId: number
   try {
     resolved = await resolveThreadTarget(actor, forumId)
-    const userId = actor.userId!
+    userId = actor.userId!
 
     if (intent === 'save_draft') {
       if (drafts === null) throw new ValidationError(msg('error.app.drafts-unavailable-board'))
@@ -256,7 +276,7 @@ export async function createThreadAction(_prev: FormState, form: FormData): Prom
 
     const pollClosesAt = pollClosingTime(poll.closesAt)
 
-    const staged = await stageAttachments(actor, resolved.scope, await submittedFiles(form))
+    staged = await stageAttachments(actor, resolved.scope, await submittedFiles(form))
 
     const subscribeMode = subscribe
       ? autoWatchCadence(await autoWatchPreference(userId, 'create'))
@@ -280,7 +300,11 @@ export async function createThreadAction(_prev: FormState, form: FormData): Prom
               publicVotes: poll.publicVotes,
             },
     })
+  } catch (err) {
+    return { ...(await toFormState(err, values)), poll }
+  }
 
+  await finaliseNewPost('thread', async () => {
     const attached = await attachStaged(staged, { postId: created.postId, forumId, userId })
     await claimAttachments(
       form,
@@ -289,9 +313,7 @@ export async function createThreadAction(_prev: FormState, form: FormData): Prom
       attached.length,
     )
     await drafts?.remove(userId, forumId, null)
-  } catch (err) {
-    return { ...(await toFormState(err, values)), poll }
-  }
+  })
 
   if (created.visibility === 'unapproved') {
     redirect(`/${resolved.forum.id}-${resolved.forum.slug}?posted=moderated`)
@@ -316,6 +338,7 @@ export async function createReplyAction(_prev: FormState, form: FormData): Promi
   const { drafts } = getContainer()
 
   let created: Awaited<ReturnType<typeof submitReply>>
+  let finalise: () => Promise<void>
   try {
     const resolved = await resolveReplyTarget(actor, threadId)
     const { forumId, scope } = resolved
@@ -341,18 +364,22 @@ export async function createReplyAction(_prev: FormState, form: FormData): Promi
       seenLastPostId,
     })
 
-    const attached = await attachStaged(staged, { postId: created.postId, forumId, userId })
-    await claimAttachments(
-      form,
-      { postId: created.postId, forumId, userId },
-      scope,
-      attached.length,
-    )
-    await drafts?.remove(userId, forumId, threadId)
+    finalise = async () => {
+      const attached = await attachStaged(staged, { postId: created.postId, forumId, userId })
+      await claimAttachments(
+        form,
+        { postId: created.postId, forumId, userId },
+        scope,
+        attached.length,
+      )
+      await drafts?.remove(userId, forumId, threadId)
+    }
   } catch (err) {
     return toFormState(err, values)
   }
 
+  await finaliseNewPost('reply', finalise)
+
   const thread = `/thread/${created.threadId}-${created.slug}`
   if (created.visibility === 'unapproved') {
     redirect(`${thread}?posted=moderated`)

package/src/server/credential-proof-actions.ts

@@ -4,6 +4,7 @@ import { redirect } from 'next/navigation'
 
 import { verifyPassword } from '@meith/accounts'
 
+import { limitMessage, refused, spendCredentialProofLimit } from './antispam'
 import type { FormState } from './auth-form-state'
 import { getContainer } from './container'
 import { getActor } from './context'
@@ -17,6 +18,9 @@ export async function proveCredentialAction(_prev: FormState, form: FormData): P
   const actor = await getActor()
   if (actor.userId === null) return { error: await tr('credentialProof.signIn') }
 
+  const limited = await spendCredentialProofLimit(actor.userId)
+  if (refused(limited)) return { error: limitMessage(limited) }
+
   const method = text(form, 'method')
   let proved = false
 

package/src/server/credential-proof.ts

@@ -1,5 +1,7 @@
 import 'server-only'
 
+import { redirect } from 'next/navigation'
+
 import { hasFreshCredentialProof, hashToken, type SessionRecord } from '@meith/accounts'
 
 import { getContainer } from './container'
@@ -19,6 +21,15 @@ export async function currentCredentialProof(
   return { session, provedAt: session.credentialProvedAt! }
 }
 
+export async function requireFreshCredentialProof(
+  userId: number,
+  next = '/usercp/security',
+): Promise<void> {
+  if ((await currentCredentialProof(userId)) === null) {
+    redirect(`/usercp/security/verify?next=${encodeURIComponent(next)}`)
+  }
+}
+
 export async function markCurrentSessionCredentialProved(
   userId: number,
   at = new Date(),

package/src/server/federation-actions.ts

@@ -9,6 +9,7 @@ import { recordAuthEvent } from './auth-events'
 import type { FormState } from './auth-form-state'
 import { getContainer } from './container'
 import { getActor } from './context'
+import { requireFreshCredentialProof } from './credential-proof'
 import { assertDemoAccountChangeable } from './demo'
 import {
   federationService,
@@ -61,6 +62,8 @@ async function requireOwnAccount(): Promise<{
 }
 
 export async function unlinkIdentityAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const actor = await getActor()
+  if (actor.userId !== null) await requireFreshCredentialProof(actor.userId)
   try {
     const { userId, hasPassword } = await requireOwnAccount()
     const identityId = Number(text(form, 'identityId'))
@@ -84,6 +87,8 @@ export async function unlinkIdentityAction(_prev: FormState, form: FormData): Pr
 }
 
 export async function removePasskeyAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const actor = await getActor()
+  if (actor.userId !== null) await requireFreshCredentialProof(actor.userId)
   try {
     const { userId, hasPassword } = await requireOwnAccount()
     const passkeyId = Number(text(form, 'passkeyId'))

package/src/server/fixture-thread-repo.ts

@@ -40,7 +40,9 @@ export class FixtureThreadRepository implements ThreadRepository {
 
   async locate(threadId: number): Promise<ThreadLocation | null> {
     const row = this.rows.find((entry) => entry.id === threadId)
-    return row === undefined ? null : { forumId: row.forumId, authorUserId: row.authorUserId }
+    return row === undefined
+      ? null
+      : { forumId: row.forumId, authorUserId: row.authorUserId, visibility: row.visibility }
   }
 
   async findById(

package/src/server/install-actions.ts

@@ -20,8 +20,28 @@ import { mailConfigFromEnvironment } from '@meith/settings'
 
 import { getTranslator } from './i18n'
 import { gatherPreflight, installerIsSealed, runInstall } from './install'
+import { grantInstallUnlock, installUnlocked, operatorSecretMatches } from './install-unlock'
 import { sendTestMail } from './mail-test'
 
+export interface InstallUnlockState {
+  readonly error?: string
+}
+
+export async function installUnlockAction(
+  _previous: InstallUnlockState,
+  form: FormData,
+): Promise<InstallUnlockState> {
+  if (await installerIsSealed()) redirect('/')
+
+  const secret = typeof form.get('secret') === 'string' ? String(form.get('secret')) : ''
+  if (!operatorSecretMatches(secret)) {
+    return { error: (await getTranslator()).t('installUnlock.incorrect') }
+  }
+
+  await grantInstallUnlock()
+  redirect('/install')
+}
+
 export interface InstallFormState {
   readonly errors?: Record<string, string>
   readonly failedStep?: {
@@ -50,8 +70,12 @@ export async function installAction(
     redirect('/')
   }
 
-  const parsed = parseInstallInput(submitted)
   const t = await getTranslator()
+  if (!(await installUnlocked())) {
+    return { errors: { form: t.t('installUnlock.required') }, values }
+  }
+
+  const parsed = parseInstallInput(submitted)
   if (!parsed.ok) return { errors: translatedErrors(parsed.errors, t), values }
 
   if (!canProceed(await gatherPreflight())) {

package/src/server/install-restore-actions.ts

@@ -0,0 +1,42 @@
+'use server'
+
+import { isAppError, logger } from '@meith/core'
+
+import { getTranslator } from './i18n'
+import { installerIsSealed } from './install'
+import { type InstallRestoreOutcome, runInstallRestore } from './install-restore'
+import { installUnlocked } from './install-unlock'
+
+export interface InstallRestoreState {
+  readonly error?: string
+  readonly outcome?: InstallRestoreOutcome
+}
+
+export async function installRestoreAction(
+  _previous: InstallRestoreState,
+  form: FormData,
+): Promise<InstallRestoreState> {
+  const t = await getTranslator()
+  if (await installerIsSealed()) return { error: t.t('installRestore.alreadyInstalled') }
+  if (!(await installUnlocked())) return { error: t.t('installUnlock.required') }
+
+  const raw = form.get('bundle')
+  const name = typeof raw === 'string' ? raw.trim() : ''
+  if (name === '') return { error: t.t('installRestore.pickOne') }
+  if (form.get('confirm') !== '1') return { error: t.t('installRestore.confirmFirst') }
+
+  try {
+    const run = await runInstallRestore(name)
+    if ('sealed' in run) return { error: t.t('installRestore.alreadyInstalled') }
+    if ('busy' in run) return { error: t.t('installRestore.busy') }
+    return { outcome: run.outcome }
+  } catch (error) {
+    if (isAppError(error)) return { error: error.message }
+    logger({ module: 'install-restore' }).error({ err: error }, 'restore from the installer failed')
+    return {
+      error: t.t('installRestore.failed', {
+        error: error instanceof Error ? error.message.slice(0, 300) : String(error),
+      }),
+    }
+  }
+}

package/src/server/install-restore.ts

@@ -0,0 +1,186 @@
+import 'server-only'
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+
+import {
+  type BackupDestination,
+  backupCapability,
+  backupDestinationFromEnv,
+  bundleTakenAt,
+  isBundleName,
+  localBundles,
+  openBackupDestination,
+  type RestoreUploadsPlan,
+  restoreBackup,
+  restoreLimits,
+} from '@meith/backup'
+import { env, GLOBAL_TAGS, logger, processEnvironment, ValidationError } from '@meith/core'
+import {
+  countUsers,
+  getDb,
+  isInstalled,
+  migrationUrl,
+  runMigrations,
+  withInstallLock,
+} from '@meith/db'
+import { drivers } from '@meith/drivers'
+import { msg } from '@meith/i18n'
+import { backupRingDirectory } from '@meith/runtime'
+
+import { CODE_VERSION } from './upgrade-notice'
+
+export interface RestoreCandidate {
+  readonly name: string
+  readonly takenAt: Date | null
+  readonly size: number
+  readonly location: 'server' | 'off-site'
+}
+
+export interface InstallRestoreView {
+  readonly possible: boolean
+  readonly candidates: readonly RestoreCandidate[]
+  readonly ring: string
+  readonly destination: string | null
+  readonly problem: string | null
+}
+
+function offSiteDestination(): { destination: BackupDestination | null; problem: string | null } {
+  try {
+    const config = backupDestinationFromEnv(env)
+    return {
+      destination: config === undefined ? null : openBackupDestination(config),
+      problem: null,
+    }
+  } catch (error) {
+    return { destination: null, problem: error instanceof Error ? error.message : String(error) }
+  }
+}
+
+export async function installRestoreView(): Promise<InstallRestoreView> {
+  const ring = backupRingDirectory(env)
+  if (backupCapability(env) !== 'available') {
+    return { possible: false, candidates: [], ring, destination: null, problem: null }
+  }
+
+  const { destination, problem } = offSiteDestination()
+  const candidates: RestoreCandidate[] = []
+  const seen = new Set<string>()
+
+  for (const bundle of await localBundles(ring).catch(() => [])) {
+    seen.add(bundle.name)
+    candidates.push({ ...bundle, takenAt: bundleTakenAt(bundle.name), location: 'server' })
+  }
+
+  let listProblem = problem
+  if (destination !== null) {
+    try {
+      for (const bundle of await destination.list()) {
+        if (seen.has(bundle.name)) continue
+        candidates.push({ ...bundle, takenAt: bundleTakenAt(bundle.name), location: 'off-site' })
+      }
+    } catch (error) {
+      listProblem = error instanceof Error ? error.message : String(error)
+      logger().warn({ err: listProblem }, 'the installer could not list the off-site backups')
+    }
+  }
+
+  return {
+    possible: true,
+    candidates: candidates.sort((a, b) => b.name.localeCompare(a.name)),
+    ring,
+    destination: destination?.description ?? null,
+    problem: listProblem,
+  }
+}
+
+function uploadsPlan(): RestoreUploadsPlan {
+  switch (env.FILESTORE_DRIVER) {
+    case 's3':
+      return { mode: 'store', store: drivers().files, description: `the ${env.S3_BUCKET} bucket` }
+    case 'blob':
+      return { mode: 'store', store: drivers().files, description: 'the Blob store' }
+    default:
+      return { mode: 'directory', dir: env.UPLOADS_DIR }
+  }
+}
+
+export interface InstallRestoreOutcome {
+  readonly bundle: string
+  readonly version: string
+  readonly posts: number
+  readonly migrationsApplied: number
+  readonly uploads: 'restored' | 'pushed' | 'skipped' | 'none'
+  readonly skippedKeys: number
+}
+
+export type InstallRestoreRun =
+  | { readonly sealed: true }
+  | { readonly outcome: InstallRestoreOutcome }
+  | { readonly busy: true }
+
+async function fetchCandidate(name: string, stage: string): Promise<string> {
+  const local = path.join(backupRingDirectory(env), name)
+  const known = await localBundles(backupRingDirectory(env)).catch(() => [])
+  if (known.some((bundle) => bundle.name === name)) return local
+
+  const { destination, problem } = offSiteDestination()
+  if (destination === null) {
+    throw new ValidationError(problem ?? msg('error.app.no-such-bundle').text)
+  }
+  const fetched = path.join(stage, name)
+  await destination.getToFile(name, fetched)
+  return fetched
+}
+
+export async function runInstallRestore(name: string): Promise<InstallRestoreRun> {
+  if (!isBundleName(name)) throw new ValidationError(msg('error.app.not-a-backup-bundle-name'))
+  if (backupCapability(env) !== 'available') {
+    throw new ValidationError(msg('error.app.backups-not-on-this-deployment'))
+  }
+
+  const url = migrationUrl(env)
+  const stage = await mkdtemp(path.join(tmpdir(), 'meith-install-restore-'))
+  try {
+    const run = await withInstallLock(url, async (): Promise<InstallRestoreRun> => {
+      const db = getDb()
+      if (await isInstalled(db)) return { sealed: true }
+      const members = await countUsers(db)
+      if (members !== null && members > 0) {
+        throw new ValidationError(msg('error.app.restore-needs-empty-board'))
+      }
+
+      const bundle = await fetchCandidate(name, stage)
+      const log = logger({ module: 'install-restore' })
+      const outcome = await restoreBackup({
+        bundle,
+        target: { url, variable: 'DATABASE_URL', mode: 'reset-schema' },
+        codeVersion: CODE_VERSION,
+        migrate: (target) => runMigrations({ url: target }),
+        uploads: uploadsPlan(),
+        limits: restoreLimits(processEnvironment()),
+        log: { info: (line) => log.info(line), warn: (line) => log.warn(line) },
+      })
+
+      return {
+        outcome: {
+          bundle: name,
+          version: outcome.manifest.version,
+          posts: outcome.posts,
+          migrationsApplied: outcome.migrationsApplied,
+          uploads: outcome.uploads,
+          skippedKeys: outcome.manifest.skippedKeys?.length ?? 0,
+        },
+      }
+    })
+    return run ?? { busy: true }
+  } finally {
+    await rm(stage, { recursive: true, force: true })
+    try {
+      await drivers().cache.invalidateTags(GLOBAL_TAGS)
+    } catch (error) {
+      logger().warn({ err: String(error) }, 'restore could not clear the cache; restart the server')
+    }
+  }
+}

package/src/server/install-unlock.ts

@@ -0,0 +1,55 @@
+import 'server-only'
+
+import { createHmac } from 'node:crypto'
+
+import { cookies } from 'next/headers'
+
+import { env, timingSafeEqualString } from '@meith/core'
+
+const UNLOCK_COOKIE = 'fs_install_unlock'
+
+const UNLOCK_TTL_MS = 30 * 60 * 1000
+
+function secure(): boolean {
+  return env.NODE_ENV !== 'development'
+}
+
+function sign(issuedAt: number): string {
+  return createHmac('sha256', env.AUTH_SECRET ?? '')
+    .update(`install-unlock:${issuedAt}`)
+    .digest('base64url')
+}
+
+export function operatorSecretMatches(candidate: string): boolean {
+  const secret = env.AUTH_SECRET ?? ''
+  return secret !== '' && candidate !== '' && timingSafeEqualString(candidate, secret)
+}
+
+export async function grantInstallUnlock(now = Date.now()): Promise<void> {
+  const jar = await cookies()
+  jar.set(UNLOCK_COOKIE, `${now}.${sign(now)}`, {
+    httpOnly: true,
+    secure: secure(),
+    sameSite: 'strict',
+    path: '/install',
+    maxAge: UNLOCK_TTL_MS / 1000,
+  })
+}
+
+export async function installUnlocked(now = Date.now()): Promise<boolean> {
+  if ((env.AUTH_SECRET ?? '') === '') return false
+
+  const jar = await cookies()
+  const raw = jar.get(UNLOCK_COOKIE)?.value
+  if (raw === undefined) return false
+
+  const dot = raw.indexOf('.')
+  if (dot < 0) return false
+
+  const issuedAt = Number(raw.slice(0, dot))
+  if (!Number.isInteger(issuedAt) || now - issuedAt > UNLOCK_TTL_MS || issuedAt - now > 60_000) {
+    return false
+  }
+
+  return timingSafeEqualString(raw.slice(dot + 1), sign(issuedAt))
+}

package/src/server/message-actions.ts

@@ -91,7 +91,7 @@ export async function messageBulkAction(_prev: FormState, form: FormData): Promi
           query = `moved=${await service.move(userId, copyIds, 'trash')}`
           break
         case 'restore':
-          query = `moved=${await service.move(userId, copyIds, 'inbox')}`
+          query = `moved=${await service.restore(userId, copyIds)}`
           break
         case 'delete':
           query = `deleted=${await service.remove(userId, copyIds)}`