@usequark/quark-create-app 1.25.13 → 1.25.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-create-app",
-  "version": "1.25.13",
+  "version": "1.25.15",
   "description": "CLI to scaffold new Quark projects with Next.js, Prisma, BullMQ, and Railway deployment",
   "keywords": [
     "quark",

package/templates/base-project/apps/web/src/app/api/files/[id]/route.js

@@ -59,17 +59,43 @@ export async function GET(_request, { params }) {
 		// max-age bounds that window instead.
 		headers.set("Cache-Control", "public, max-age=3600");
 
-		// Inline display for images; attachment download for everything else
-		const isImage = record.mimeType.startsWith("image/");
+		// Inline display is limited to raster formats. SVG is deliberately not
+		// among them: an SVG is an XML document that can carry <script>, this
+		// endpoint is public and same-origin, and CSP `default-src 'self'`
+		// permits those scripts to run — so a stored SVG served inline executes
+		// in the app's own origin (stored XSS; audit item 8). SVG therefore
+		// downloads as an attachment, and its response additionally carries a
+		// sandbox CSP so a browser that ignores the disposition still cannot
+		// run scripts, fetch, or embed the document.
+		const INLINE_SAFE_TYPES = new Set([
+			"image/jpeg",
+			"image/png",
+			"image/gif",
+			"image/webp",
+			"image/avif",
+		]);
+		const isInlineSafe = INLINE_SAFE_TYPES.has(record.mimeType);
+		const isSvg = record.mimeType === "image/svg+xml";
 		const safeName = record.originalName.replace(/[\\"\r\n]/g, "_");
 		const encodedName = encodeURIComponent(record.originalName);
 		headers.set(
 			"Content-Disposition",
-			isImage
+			isInlineSafe
 				? `inline; filename="${safeName}"; filename*=UTF-8''${encodedName}`
 				: `attachment; filename="${safeName}"; filename*=UTF-8''${encodedName}`,
 		);
 
+		if (isSvg) {
+			// `sandbox` with no allow-list: no scripts, no same-origin framing,
+			// no form submission. `style-src 'unsafe-inline'` keeps simple
+			// presentational SVGs viewable; nothing in this policy can execute
+			// code.
+			headers.set(
+				"Content-Security-Policy",
+				"default-src 'none'; style-src 'unsafe-inline'; sandbox",
+			);
+		}
+
 		return new Response(body, { status: 200, headers });
 	} catch (error) {
 		return handleError(error);

package/templates/base-project/apps/web/src/lib/auth.js

@@ -2,7 +2,7 @@ import { PrismaAdapter } from "@auth/prisma-adapter";
 import { createAuthConfig, verifyPassword } from "@usequark/quark-core/auth";
 import { createLogger } from "@usequark/quark-core/core";
 import { AppError } from "@usequark/quark-core/errors";
-import { Prisma, prisma, user } from "@usequark/quark-db";
+import { Prisma, prisma, user as userQueries } from "@usequark/quark-db";
 import NextAuth from "next-auth";
 import CredentialsProvider from "next-auth/providers/credentials";
 import GithubProvider from "next-auth/providers/github";
@@ -66,7 +66,7 @@ const providers = [
 			}
 
 			try {
-				const existingUser = await user.findByEmail(credentials.email);
+				const existingUser = await userQueries.findByEmail(credentials.email);
 
 				if (!existingUser?.password) {
 					return null;
@@ -156,6 +156,64 @@ if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
 	);
 }
 
+/**
+ * Re-validate the session against the database on every request.
+ *
+ * Web sessions are signed JWTs: a credentials provider forces the JWT
+ * strategy (Auth.js rejects `strategy: "database"` when every provider is
+ * credentials, and scaffolds always ship one), and the cookie would otherwise
+ * stay valid for its full 30 days no matter what happened to the account
+ * behind it. That was the review's "logins can't be revoked" finding — banning
+ * a user, demoting an admin, or changing a password did nothing until the
+ * token expired on its own.
+ *
+ * The revocation check is a single indexed primary-key read, which is the
+ * same cost Auth.js itself pays for database sessions — but it works for
+ * credentials apps too:
+ *
+ *   - user gone (deleted / banned by deletion)  → reject, cookie cleared
+ *   - `passwordChangedAt` after the token's iat → reject, cookie cleared
+ *   - role or profile changed                   → refreshed into the token,
+ *     so `requireRole` reads the current role, not the sign-in-time one
+ *
+ * Returning null from the `jwt` callback is Auth.js's documented "invalidate
+ * this session" signal: it clears the cookie and the request continues
+ * unauthenticated.
+ */
+async function validateSessionToken(token) {
+	if (typeof token.id !== "string" || token.id.length === 0) {
+		return null;
+	}
+
+	try {
+		const account = await userQueries.findById(token.id);
+
+		if (!account) {
+			return null;
+		}
+
+		if (
+			account.passwordChangedAt &&
+			typeof token.iat === "number" &&
+			account.passwordChangedAt.getTime() / 1000 > token.iat
+		) {
+			return null;
+		}
+
+		token.email = account.email;
+		token.name = account.name;
+		token.role = account.role;
+		return token;
+	} catch (err) {
+		// Fail closed: an unreachable database invalidates the session rather
+		// than letting an unverified cookie through. The next request retries.
+		logger.error("Session validation failed", {
+			message: err?.message ?? String(err),
+		});
+		return null;
+	}
+}
+
 export function getAuthOptions() {
 	return createAuthConfig({
 		adapter: PrismaAdapter(prisma),
@@ -172,7 +230,28 @@ export function getAuthOptions() {
 			},
 		},
 		session: {
+			// JWT is not a preference here, it is a constraint: Auth.js throws
+			// `UnsupportedStrategy` when strategy is "database" and every
+			// configured provider is credentials, and the scaffold always ships
+			// the credentials provider. Revocation is therefore enforced by
+			// `validateSessionToken` above, not by server-side session rows.
 			strategy: "jwt",
+			maxAge: 30 * 24 * 60 * 60, // 30 days
+		},
+		callbacks: {
+			async jwt({ token, user: signedInUser }) {
+				// Sign-in: stamp the identity once; the DB check below is for
+				// every subsequent request.
+				if (signedInUser) {
+					token.id = signedInUser.id;
+					token.email = signedInUser.email;
+					token.name = signedInUser.name;
+					token.role = signedInUser.role || "viewer";
+					return token;
+				}
+
+				return validateSessionToken(token);
+			},
 		},
 	});
 }

package/templates/base-project/apps/web/src/lib/proxy-auth.js

@@ -1,6 +1,3 @@
-import { getAuthSecret } from "@usequark/quark-core/auth";
-import { getToken } from "next-auth/jwt";
-
 const STRICT_AUTH_RATE_LIMIT_ROUTES = new Set([
 	// `callback/credentials` is where the next-auth client POSTs a credentials
 	// sign-in (next-auth/react posts to `callback/<provider>` for credentials

package/templates/base-project/apps/web/src/proxy.js

@@ -10,11 +10,14 @@
  */
 
 import { getAllowedOrigins } from "@usequark/quark-config/app-url";
+import { createLogger, createRateLimiter } from "@usequark/quark-core/core";
 import { NextResponse } from "next/server";
 
 import { buildContentSecurityPolicy } from "./lib/analytics/umami-csp.js";
 import { getRateLimitBucket, isRateLimitExempt } from "./lib/proxy-auth";
 
+const logger = createLogger("proxy");
+
 // ─── 1. Metrics guard ────────────────────────────────────────────────────────
 
 function metricsGuard(request) {
@@ -38,8 +41,57 @@ function metricsGuard(request) {
 	return null; // authorised - continue
 }
 
-// Simple in-memory rate limiter (use Redis for production)
-const rateLimit = new Map();
+// Rate limiter: Redis-backed when REDIS_URL is set (multi-instance), otherwise
+// in-memory (single instance). Fails CLOSED by default (see createRateLimiter).
+// The Redis client is created once and reused; ioredis reconnects on its own.
+let rateLimiterPromise = null;
+
+// Exported for tests: the Redis-vs-memory backend selection is otherwise only
+// observable through a live Redis connection, which the unit suite doesn't have.
+// The reset clears the memoised instance so a test can flip REDIS_URL and
+// re-select a backend; production code never calls it.
+export function __resetRateLimiterForTests() {
+	rateLimiterPromise = null;
+}
+
+export async function getRateLimiter() {
+	if (rateLimiterPromise) return rateLimiterPromise;
+
+	rateLimiterPromise = (async () => {
+		if (!process.env.REDIS_URL) {
+			return createRateLimiter({ type: "memory" });
+		}
+
+		try {
+			const { default: Redis } = await import("ioredis");
+			const redisClient = new Redis(process.env.REDIS_URL, {
+				maxRetriesPerRequest: 1,
+				enableReadyCheck: true,
+				retryStrategy(times) {
+					return Math.min(times * 50, 2000);
+				},
+			});
+			// ioredis emits an 'error' event on connection trouble; without a
+			// listener Node treats it as unhandled and kills the process.
+			redisClient.on("error", (err) => {
+				logger.error("Redis rate-limiter client error", {
+					message: err?.message ?? String(err),
+				});
+			});
+			return createRateLimiter({ type: "redis", redisClient });
+		} catch (error) {
+			logger.error("Redis rate limiter unavailable; using in-memory", {
+				message: error?.message ?? String(error),
+			});
+			// Losing Redis must not lose rate limiting entirely: a per-instance
+			// in-memory limiter is still a limiter. It just no longer spans
+			// instances, so a distributed attacker gets one budget per instance.
+			return createRateLimiter({ type: "memory" });
+		}
+	})();
+
+	return rateLimiterPromise;
+}
 
 /**
  * Resolve the client IP for rate-limit keying.
@@ -83,61 +135,25 @@ const RATE_LIMIT_CONFIG = {
 };
 
 /**
- * Rate limiting implementation
+ * Rate limiting implementation.
+ *
+ * Delegates to the core limiter (`createRateLimiter`): Redis-backed when
+ * REDIS_URL is set, in-memory otherwise. Its `checkLimit(key, max, window)`
+ * returns `{ limited, remaining, resetTime }` — the same shape this proxy
+ * already returned, so the response headers below are unchanged.
  */
-function checkRateLimit(ip, path, method) {
-	const now = Date.now();
-	const key = `${ip}:${path}`;
-
+async function checkRateLimit(ip, path, method) {
+	const limiter = await getRateLimiter();
 	const maxRequests =
 		RATE_LIMIT_CONFIG.maxRequests[getRateLimitBucket(path, method)];
 
-	// Get or create rate limit record
-	const record = rateLimit.get(key) || {
-		count: 0,
-		resetTime: now + RATE_LIMIT_CONFIG.windowMs,
-	};
-
-	// Reset if window has passed
-	if (now > record.resetTime) {
-		record.count = 0;
-		record.resetTime = now + RATE_LIMIT_CONFIG.windowMs;
-	}
-
-	// Check if limit exceeded
-	if (record.count >= maxRequests) {
-		return {
-			limited: true,
-			resetTime: record.resetTime,
-			remaining: 0,
-		};
-	}
-
-	// Increment counter
-	record.count++;
-	rateLimit.set(key, record);
-
-	return {
-		limited: false,
-		resetTime: record.resetTime,
-		remaining: maxRequests - record.count,
-	};
+	return limiter.checkLimit(
+		`${ip}:${path}`,
+		maxRequests,
+		RATE_LIMIT_CONFIG.windowMs,
+	);
 }
 
-/**
- * Clean up old rate limit records periodically.
- * `unref()` so the timer never holds the Node process open on shutdown.
- */
-const rateLimitCleanup = setInterval(() => {
-	const now = Date.now();
-	for (const [key, record] of rateLimit.entries()) {
-		if (now > record.resetTime) {
-			rateLimit.delete(key);
-		}
-	}
-}, 60 * 1000); // Clean up every minute
-if (typeof rateLimitCleanup.unref === "function") rateLimitCleanup.unref();
-
 /**
  * CORS configuration
  */
@@ -225,7 +241,7 @@ export async function proxy(request) {
 		const ip = getClientIp(request);
 		const rateLimitBucket = getRateLimitBucket(pathname, request.method);
 		const maxRequests = RATE_LIMIT_CONFIG.maxRequests[rateLimitBucket];
-		const rateLimitResult = checkRateLimit(ip, pathname, request.method);
+		const rateLimitResult = await checkRateLimit(ip, pathname, request.method);
 
 		if (rateLimitResult.limited) {
 			const retryAfter = Math.ceil(

package/templates/base-project/packages/db/prisma/migrations/20260202061128_initial/migration.sql

@@ -16,6 +16,7 @@ CREATE TABLE "User" (
     "password" TEXT,
     "image" TEXT,
     "role" "UserRole" NOT NULL DEFAULT 'viewer',
+    "passwordChangedAt" TIMESTAMP(3),
     "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
     "updatedAt" TIMESTAMP(3) NOT NULL,
 
@@ -117,9 +118,6 @@ CREATE TABLE "AuditLog" (
 -- CreateIndex
 CREATE UNIQUE INDEX "User_email_key" ON "User"("email");
 
--- CreateIndex
-CREATE INDEX "User_email_idx" ON "User"("email");
-
 -- CreateIndex
 CREATE INDEX "User_createdAt_idx" ON "User"("createdAt");
 
@@ -141,9 +139,6 @@ CREATE INDEX "Session_expires_idx" ON "Session"("expires");
 -- CreateIndex
 CREATE UNIQUE INDEX "VerificationToken_token_key" ON "VerificationToken"("token");
 
--- CreateIndex
-CREATE INDEX "VerificationToken_token_idx" ON "VerificationToken"("token");
-
 -- CreateIndex
 CREATE INDEX "VerificationToken_expires_idx" ON "VerificationToken"("expires");
 
@@ -153,12 +148,6 @@ CREATE UNIQUE INDEX "VerificationToken_identifier_token_key" ON "VerificationTok
 -- CreateIndex
 CREATE INDEX "Job_queue_idx" ON "Job"("queue");
 
--- CreateIndex
-CREATE INDEX "Job_status_idx" ON "Job"("status");
-
--- CreateIndex
-CREATE INDEX "Job_runAt_idx" ON "Job"("runAt");
-
 -- CreateIndex
 CREATE INDEX "Job_status_runAt_idx" ON "Job"("status", "runAt");
 

package/templates/base-project/packages/db/prisma/schema.prisma

@@ -29,6 +29,10 @@ model User {
   password      String?
   image         String?
   role          UserRole  @default(viewer)
+  // Bumped whenever the account's password changes. Session tokens (web JWTs
+  // and mobile refresh tokens) issued before this instant are rejected, so a
+  // stolen or pre-change session dies with the password it was born under.
+  passwordChangedAt DateTime?
   createdAt     DateTime  @default(now())
   updatedAt     DateTime  @updatedAt
 
@@ -37,7 +41,8 @@ model User {
   auditLogs     AuditLog[]
   files         File[]
 
-  @@index([email])
+  // `email` is already @unique (User_email_key); a second plain index on the
+  // same column only adds write cost.
   @@index([createdAt])
 }
 
@@ -85,8 +90,9 @@ model VerificationToken {
   createdAt  DateTime @default(now())
   updatedAt  DateTime @updatedAt
 
+  // `token` is already @unique (VerificationToken_token_key); a second plain
+  // index on the same column only adds write cost.
   @@unique([identifier, token])
-  @@index([token])
   @@index([expires])
 }
 
@@ -106,9 +112,9 @@ model Job {
   createdAt DateTime  @default(now())
   updatedAt DateTime  @updatedAt
 
+  // (status, runAt) serves status-only queries through its leftmost prefix;
+  // single-column [status] and [runAt] indexes were removed as redundant.
   @@index([queue])
-  @@index([status])
-  @@index([runAt])
   @@index([status, runAt])
   @@index([createdAt])
 }

package/templates/base-project/packages/db/src/queries.js

@@ -11,6 +11,7 @@ const USER_SAFE_SELECT = {
 	name: true,
 	image: true,
 	role: true,
+	passwordChangedAt: true,
 	createdAt: true,
 	updatedAt: true,
 };