afront 1.0.19 → 1.0.21

package/install.js

@@ -3,12 +3,13 @@ const fs = require('fs');
 const path = require('path');
 const { https } = require('follow-redirects');
 const { exec } = require('child_process');
+const os = require('os');
 const tmp = require('tmp');
 const AdmZip = require('adm-zip');
 const readline = require('readline');
 
 // Configuration
-const GITHUB_ZIP_URL = 'https://github.com/Asggen/afront/archive/refs/tags/v1.0.19.zip'; // Updated URL
+const GITHUB_ZIP_URL = 'https://github.com/Asggen/afront/archive/refs/tags/v1.0.21.zip'; // Updated URL
 
 // Define files to skip
 const SKIP_FILES = ['FUNDING.yml', 'CODE_OF_CONDUCT.md', 'SECURITY.md', 'install.js', '.npmrc'];
@@ -69,7 +70,8 @@ const downloadFile = (url, destination) => {
         });
       });
     }).on('error', (err) => {
-      fs.unlink(destination, () => reject(err));
+      // attempt to remove partial download only if it's inside allowed temp locations
+      safeUnlink(destination).finally(() => reject(err));
     });
   });
 };
@@ -101,7 +103,7 @@ const extractZip = (zipPath, extractTo) => {
 const runNpmInstall = (directory) => {
   return new Promise((resolve, reject) => {
     const stopSpinner = spinner('Running npm install');
-    exec('npm install', { cwd: directory }, (err, stdout, stderr) => {
+    exec('npm install --legacy-peer-deps --no-audit --no-fund', { cwd: directory }, (err, stdout, stderr) => {
       if (err) {
         stopSpinner();
         console.error('Error running npm install:', stderr);
@@ -127,6 +129,97 @@ const createDirIfNotExists = (dirPath) => {
   });
 };
 
+const isPathInside = (root, target) => {
+  const r = path.resolve(root);
+  const t = path.resolve(target);
+  return t === r || t.startsWith(r + path.sep);
+};
+
+
+// Security: path validated against SAFE_UNLINK_ROOT before unlink
+const SAFE_UNLINK_ROOT = path.resolve(process.cwd());
+
+const safeUnlink = async (targetPath) => {
+  const resolved = path.resolve(targetPath);
+
+  if (!resolved.startsWith(SAFE_UNLINK_ROOT + path.sep)) {
+    throw new Error(`Blocked unlink outside safe root: ${resolved}`);
+  }
+
+  const stats = await fs.promises.lstat(resolved);
+
+  if (!stats.isFile()) {
+    throw new Error(`Refusing to unlink non-file: ${resolved}`);
+  }
+
+  await fs.promises.unlink(resolved);
+};
+
+
+const safeRm = (dirPath, cb) => {
+  const resolved = path.resolve(dirPath);
+  if (!isPathInside(process.cwd(), resolved)) {
+    return cb(new Error(`Refusing to remove directory outside current working directory: ${resolved}`));
+  }
+  fs.rm(resolved, { recursive: true, force: true }, cb);
+};
+
+// Perform an atomic-safe move: open source with O_NOFOLLOW, stream to a temp file, fsync, then rename
+const safeMoveFile = async (resolvedSrc, resolvedDest) => {
+  const srcFlags = fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW;
+  let srcHandle;
+  let destHandle;
+  const tmpName = `${resolvedDest}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    srcHandle = await fs.promises.open(resolvedSrc, srcFlags);
+  } catch (err) {
+    throw err;
+  }
+
+  try {
+    const stats = await srcHandle.stat();
+    if (stats.isDirectory()) {
+      await srcHandle.close();
+      throw new Error('Source is a directory');
+    }
+
+    await createDirIfNotExists(path.dirname(resolvedDest));
+
+    destHandle = await fs.promises.open(tmpName, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC, stats.mode);
+
+    const bufferSize = 64 * 1024;
+    const buffer = Buffer.allocUnsafe(bufferSize);
+    let position = 0;
+    while (true) {
+      const { bytesRead } = await srcHandle.read(buffer, 0, bufferSize, position);
+      if (!bytesRead) break;
+      let written = 0;
+      while (written < bytesRead) {
+        const { bytesWritten } = await destHandle.write(buffer, written, bytesRead - written);
+        written += bytesWritten;
+      }
+      position += bytesRead;
+    }
+
+    await destHandle.sync();
+    await destHandle.close();
+    await srcHandle.close();
+
+    await fs.promises.rename(tmpName, resolvedDest);
+  } catch (err) {
+    try {
+      if (destHandle) await destHandle.close();
+    } catch (e) {}
+    try {
+      await safeUnlink(tmpName, [path.dirname(resolvedDest)]).catch(() => {});
+    } catch (e) {}
+    try {
+      if (srcHandle) await srcHandle.close();
+    } catch (e) {}
+    throw err;
+  }
+};
+
 const promptForFolderName = async () => {
   const answer = await askQuestion('AFront: Enter the name of the destination folder: ');
   return answer;
@@ -140,49 +233,94 @@ const promptForReplace = async (dirPath) => {
 const removeDir = (dirPath) => {
   return new Promise((resolve, reject) => {
     console.log(`Removing existing directory: ${dirPath}`);
-    fs.rm(dirPath, { recursive: true, force: true }, (err) => {
-      if (err) {
-        return reject(err);
-      }
+    safeRm(dirPath, (err) => {
+      if (err) return reject(err);
       resolve();
     });
   });
 };
 
+const SAFE_READDIR_ROOT = path.resolve(os.tmpdir());
+
+const safeReaddir = (dirPath, cb) => {
+  const resolved = path.resolve(dirPath);
+
+  if (!resolved.startsWith(SAFE_READDIR_ROOT + path.sep)) {
+    return cb(new Error(`Blocked readdir outside safe root: ${resolved}`));
+  }
+
+  fs.lstat(resolved, (err, stats) => {
+    if (err) return cb(err);
+    if (!stats.isDirectory()) {
+      return cb(new Error(`Not a directory: ${resolved}`));
+    }
+
+    fs.readdir(resolved, cb);
+  });
+};
+
+
 const moveFiles = (srcPath, destPath) => {
   return new Promise((resolve, reject) => {
-    fs.readdir(srcPath, (err, files) => {
+    safeReaddir(srcPath, (err, files) => {
       if (err) {
         return reject(err);
       }
       let pending = files.length;
       if (!pending) return resolve();
       files.forEach((file) => {
-        if (SKIP_FILES.includes(file)) {
+        // Normalize and validate file name to avoid path traversal
+        const fileName = path.basename(file);
+        if (SKIP_FILES.includes(fileName)) {
+          if (!--pending) resolve();
+          return;
+        }
+
+        const srcRoot = path.resolve(srcPath);
+        const destRoot = path.resolve(destPath);
+        const resolvedSrc = path.resolve(srcPath, file);
+        const resolvedDest = path.resolve(destPath, file);
+
+        // Ensure resolved paths are inside their respective roots
+        if (
+          !(resolvedSrc === srcRoot || resolvedSrc.startsWith(srcRoot + path.sep)) ||
+          !(resolvedDest === destRoot || resolvedDest.startsWith(destRoot + path.sep))
+        ) {
+          console.warn(`Skipping suspicious path: ${file}`);
           if (!--pending) resolve();
           return;
         }
 
-        const srcFile = path.join(srcPath, file);
-        const destFile = path.join(destPath, file);
-        fs.stat(srcFile, (err, stats) => {
+        // Use lstat to detect symlinks and refuse to follow them
+        fs.lstat(resolvedSrc, (err, stats) => {
           if (err) {
             return reject(err);
           }
+
+          if (stats.isSymbolicLink()) {
+            console.warn(`Skipping symbolic link for safety: ${resolvedSrc}`);
+            if (!--pending) resolve();
+            return;
+          }
+
           if (stats.isDirectory()) {
-            createDirIfNotExists(destFile)
-              .then(() => moveFiles(srcFile, destFile))
+            createDirIfNotExists(resolvedDest)
+              .then(() => moveFiles(resolvedSrc, resolvedDest))
               .then(() => {
                 if (!--pending) resolve();
               })
               .catch(reject);
           } else {
-            fs.rename(srcFile, destFile, (err) => {
-              if (err) {
-                return reject(err);
-              }
-              if (!--pending) resolve();
-            });
+                // Use atomic-safe move: copy from a non-following FD to temp file, then rename
+                createDirIfNotExists(path.dirname(resolvedDest))
+                  .then(() => {
+                    safeMoveFile(resolvedSrc, resolvedDest)
+                      .then(() => {
+                        if (!--pending) resolve();
+                      })
+                      .catch(reject);
+                  })
+                  .catch(reject);
           }
         });
       });
@@ -202,6 +340,29 @@ const main = async () => {
       folderName = await promptForFolderName();
     }
 
+    // Sanitize the provided folder name to prevent path traversal or absolute paths
+    const sanitizeFolderName = (name) => {
+      if (!name) return '';
+      // If user provided '.', use current dir basename
+      if (name === '.') return path.basename(process.cwd());
+      // Disallow absolute paths
+      if (path.isAbsolute(name)) {
+        console.warn('Absolute paths are not allowed for destination; using basename.');
+        name = path.basename(name);
+      }
+      // Disallow parent traversal and nested paths
+      if (name === '..' || name.includes(path.sep) || name.includes('..')) {
+        console.warn('Path traversal detected in destination name; using basename of input.');
+        name = path.basename(name);
+      }
+      // Finally, ensure it's a single path segment
+      name = path.basename(name);
+      if (!name) throw new Error('Invalid destination folder name');
+      return name;
+    };
+
+    folderName = sanitizeFolderName(folderName);
+
     const destDir = path.join(process.cwd(), folderName);
 
     if (fs.existsSync(destDir)) {
@@ -230,6 +391,15 @@ const main = async () => {
 
     await moveFiles(extractedFolderPath, destDir);
 
+    // Remove any bundled lockfiles from the extracted archive to avoid integrity
+    // checksum mismatches originating from the release zip's lockfile.
+    try {
+      await safeUnlink(path.join(destDir, 'package-lock.json')).catch(() => {});
+      await safeUnlink(path.join(destDir, 'npm-shrinkwrap.json')).catch(() => {});
+    } catch (e) {
+      // ignore
+    }
+
     await runNpmInstall(destDir);
 
     rl.close();

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "afront",
-  "version": "1.0.19",
+  "version": "1.0.21",
   "description": "AFront is a front-end JavaScript library designed to create seamless server-side rendered (SSSR) websites.",
   "main": "webpack.dev.js",
   "scripts": {
-    "build": "webpack --config webpack.prod.js",
+    "build": "webpack --config webpack.prod.js && webpack --config webpack.post-prod.js",
     "build:ssr": "webpack --config webpack.ssr.prod.js",
-    "build:alt": "webpack --config webpack.build-prod.js",
+    "build:alt": "webpack --config webpack.build-prod.js && webpack --config webpack.post-prod-static.js --stats-error-details",
     "prod:ssr": "node build-prod-ssr/ssr.prod.js",
     "start": "webpack serve --config webpack.dev.js",
     "static": "node server.js"
@@ -38,10 +38,11 @@
   "license": "MIT",
   "dependencies": {
     "adm-zip": "^0.5.16",
-    "afront": "^1.0.19",
+    "afront": "^1.0.15",
     "asggen-headtags": "^1.0.3",
     "babel-plugin-css-modules-transform": "^1.6.2",
     "babel-plugin-dynamic-import-node": "^2.3.3",
+    "banner-webpack-after-content": "^1.0.3",
     "copy-webpack-plugin": "^12.0.2",
     "dotenv": "^16.4.5",
     "express-rate-limit": "^7.4.1",

package/server.js

@@ -1,12 +1,21 @@
 const express = require("express");
 const path = require("path");
 const RateLimit = require("express-rate-limit");
+const helmet = require("helmet");
 require("dotenv").config();
 
 const app = express();
 const PORT = process.env.PORT;
 const HOST = process.env.HOST;
 
+app.set("trust proxy", 1);
+
+// Disable the X-Powered-By header to avoid exposing Express
+app.disable("x-powered-by");
+
+// Use Helmet to set various HTTP headers for better security
+app.use(helmet());
+
 // Set up rate limiter: maximum of 100 requests per 15 minutes
 const limiter = RateLimit({
   windowMs: 15 * 60 * 1000, // 15 minutes

package/src/ARoutes/AFRoutes.js

@@ -1,11 +1,28 @@
 import { lazy } from "react";
 
-
 const routes = [
-  { path: "/", element: lazy(() => import("../Pages/Home.js")) },
-  { path: "/support", element: lazy(() => import("../Pages/Support.js")) },
-  { path: "/*", element: lazy(() => import("../PageNotFound.js")) }, // Page Not Found route
+  {
+    path: "/",
+    element: lazy(() => import("../Pages/Home.js")),
+    withHeaderFooter: true,
+  },
+  {
+    path: "/signup",
+    element: lazy(() => import("../Pages/Signup.js")),
+    withHeaderFooter: false,
+  },
+  {
+    path: "/support/s",
+    element: lazy(() => import("../Pages/Support.js")),
+    protected: true,
+    withHeaderFooter: true,
+  },
+  {
+    path: "/*",
+    element: lazy(() => import("../PageNotFound.js")),
+    withHeaderFooter: true,
+  }, // Page Not Found route
   // Add More Pages
 ];
 
-export default routes;
+export default routes;

package/src/Api/api.config.js

@@ -0,0 +1,266 @@
+// Lightweight fetch-based API instance with interceptors and retry helper
+const apiBase =
+  (typeof process !== "undefined" &&
+    process.env &&
+    process.env.REACT_APP_API_BASE) ||
+  (typeof window !== "undefined" &&
+    window.__env &&
+    window.__env.REACT_APP_API_BASE) ||
+  "http://localhost:4000/api/v1";
+
+function isAbsoluteUrl(u) {
+  return /^https?:\/\//i.test(u);
+}
+
+function buildUrl(base, url, params) {
+  const full = isAbsoluteUrl(url) ? url : `${base}${url}`;
+  if (!params) return full;
+  const search = new URLSearchParams(params).toString();
+  return search ? `${full}${full.includes("?") ? "&" : "?"}${search}` : full;
+}
+
+function createInstance({
+  baseURL = apiBase,
+  timeout = 60000,
+  headers = { "Content-Type": "application/json" },
+  withCredentials = true,
+} = {}) {
+  const requestHandlers = [];
+  const responseHandlers = [];
+
+  const interceptors = {
+    request: {
+      use: (fn) => {
+        requestHandlers.push(fn);
+        return requestHandlers.length - 1;
+      },
+    },
+    response: {
+      use: (onFulfilled, onRejected) => {
+        responseHandlers.push({ onFulfilled, onRejected });
+        return responseHandlers.length - 1;
+      },
+    },
+  };
+
+  async function runRequestHandlers(cfg) {
+    let c = { ...cfg };
+    for (const h of requestHandlers) {
+      // handlers may be sync or async
+      // allow them to modify/return the config
+      // if they return undefined, assume they mutated in place
+      // otherwise use returned value
+      // eslint-disable-next-line no-await-in-loop
+      const out = await h(c);
+      if (typeof out !== "undefined") c = out;
+    }
+    return c;
+  }
+
+  async function runResponseHandlers(resOrErr, success = true) {
+    let acc = resOrErr;
+    for (const h of responseHandlers) {
+      try {
+        if (success && typeof h.onFulfilled === "function") {
+          // eslint-disable-next-line no-await-in-loop
+          const out = await h.onFulfilled(acc);
+          if (typeof out !== "undefined") acc = out;
+        } else if (!success && typeof h.onRejected === "function") {
+          // eslint-disable-next-line no-await-in-loop
+          const out = await h.onRejected(acc);
+          if (typeof out !== "undefined") acc = out;
+        }
+      } catch (e) {
+        // if a handler throws, treat as rejection
+        acc = e;
+        success = false;
+      }
+    }
+    if (success) return acc;
+    throw acc;
+  }
+
+  async function request(cfg) {
+    const finalCfg = await runRequestHandlers({
+      baseURL,
+      timeout,
+      headers: { ...headers },
+      withCredentials,
+      ...cfg,
+    });
+
+    const url = buildUrl(
+      finalCfg.baseURL || baseURL,
+      finalCfg.url || finalCfg.path || "/",
+      finalCfg.params
+    );
+
+    const controller = new AbortController();
+    const to = finalCfg.timeout || timeout;
+    const timer = setTimeout(() => controller.abort(), to);
+
+    const fetchOpts = {
+      method: (finalCfg.method || "GET").toUpperCase(),
+      headers: finalCfg.headers || {},
+      signal: controller.signal,
+    };
+    if (finalCfg.withCredentials || finalCfg.withCredentials === undefined)
+      fetchOpts.credentials = "include";
+    if (finalCfg.body !== undefined && finalCfg.body !== null) {
+      fetchOpts.body = finalCfg.body;
+    }
+
+    try {
+      // log request for convenience
+      // allow user interceptors to already log as requested
+      const raw = await fetch(url, fetchOpts);
+      clearTimeout(timer);
+
+      // try to parse JSON, fallback to text
+      let data = null;
+      const ct = raw.headers.get("content-type") || "";
+      if (ct.includes("application/json")) {
+        try {
+          data = await raw.json();
+        } catch (e) {
+          data = null;
+        }
+      } else {
+        try {
+          data = await raw.text();
+        } catch (e) {
+          data = null;
+        }
+      }
+
+      const response = { ok: raw.ok, status: raw.status, data, raw };
+      return await runResponseHandlers(response, true);
+    } catch (err) {
+      clearTimeout(timer);
+      // network or abort
+      return await runResponseHandlers(err, false);
+    }
+  }
+
+  // convenience methods
+  const instance = {
+    interceptors,
+    request,
+    get: (url, cfg = {}) => request({ method: "GET", url, ...cfg }),
+    post: (url, body, cfg = {}) =>
+      request({
+        method: "POST",
+        url,
+        body:
+          typeof body === "object" && !(body instanceof FormData)
+            ? JSON.stringify(body)
+            : body,
+        headers: {
+          ...(cfg.headers || {}),
+          "Content-Type":
+            body instanceof FormData ? undefined : "application/json",
+        },
+        ...cfg,
+      }),
+    put: (url, body, cfg = {}) =>
+      request({
+        method: "PUT",
+        url,
+        body:
+          typeof body === "object" && !(body instanceof FormData)
+            ? JSON.stringify(body)
+            : body,
+        headers: {
+          ...(cfg.headers || {}),
+          "Content-Type":
+            body instanceof FormData ? undefined : "application/json",
+        },
+        ...cfg,
+      }),
+    patch: (url, body, cfg = {}) =>
+      request({
+        method: "PATCH",
+        url,
+        body:
+          typeof body === "object" && !(body instanceof FormData)
+            ? JSON.stringify(body)
+            : body,
+        headers: {
+          ...(cfg.headers || {}),
+          "Content-Type":
+            body instanceof FormData ? undefined : "application/json",
+        },
+        ...cfg,
+      }),
+    delete: (url, cfg = {}) => request({ method: "DELETE", url, ...cfg }),
+  };
+
+  return instance;
+}
+
+export function requestWithRetry(
+  fn,
+  { retries = 3, retryDelay = 1000, retryOn = (err) => true } = {}
+) {
+  return new Promise(async (resolve, reject) => {
+    let attempt = 0;
+    while (attempt < retries) {
+      try {
+        // fn should be a function returning a promise
+        const res = await fn();
+        return resolve(res);
+      } catch (err) {
+        attempt += 1;
+        if (attempt >= retries || !retryOn(err)) return reject(err);
+        // exponential backoff
+        // eslint-disable-next-line no-await-in-loop
+        await new Promise((r) => setTimeout(r, retryDelay * attempt));
+      }
+    }
+    reject(new Error("Retries exhausted"));
+  });
+}
+
+export const instance = createInstance({
+  baseURL: apiBase,
+  timeout: 60000,
+  headers: { "Content-Type": "application/json" },
+  withCredentials: true,
+});
+
+// expose defaults for logging/compatibility
+instance.defaults = { baseURL: apiBase, timeout: 60000 };
+
+// request logging interceptor
+instance.interceptors.request.use((config) => {
+  try {
+    console.log(
+      `API Request -> ${(
+        (config.method || "").toString() || "GET"
+      ).toUpperCase()} ${config.url || config.path} (base: ${
+        instance.defaults.baseURL
+      }) (timeout: ${config.timeout || instance.defaults.timeout}ms)`
+    );
+  } catch (e) {
+    /* ignore */
+  }
+  return config;
+});
+
+// response / error logging interceptor
+instance.interceptors.response.use(
+  (response) => response,
+  (error) => {
+    if (!error || !error.status) {
+      console.error(
+        "Network or CORS error when calling API:",
+        error && error.message ? error.message : error
+      );
+    } else {
+      console.warn("API response error:", error.status, error.data);
+    }
+    return Promise.reject(error);
+  }
+);
+
+export default instance;

package/src/Api/login.service.js

@@ -0,0 +1,44 @@
+import api from "./api.config.js";
+
+const BASE = "/auth";
+
+export async function login({ email, password }) {
+  return api.post(
+    `${BASE}/login`,
+    { email, password },
+    { withCredentials: true }
+  );
+}
+
+export async function signup({
+  email,
+  password,
+  name,
+  accountType,
+  companyName,
+}) {
+  return api.post(
+    `${BASE}/signup`,
+    { email, password, name, accountType, companyName },
+    { withCredentials: true }
+  );
+}
+
+export async function checkSignup({ email }) {
+  return api.post(`${BASE}/check`, { email }, { withCredentials: true });
+}
+
+export async function logout() {
+  try {
+    await api.post(`${BASE}/logout`, null, { withCredentials: true });
+  } catch (e) {
+    /* ignore */
+  }
+  try {
+    localStorage.setItem("auth-event", String(Date.now()));
+  } catch (e) {}
+  window.dispatchEvent(new Event("auth-changed"));
+  return { ok: true };
+}
+
+export default { login, signup, logout, checkSignup };