ework-web 0.10.35 → 0.10.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.35",
+  "version": "0.10.36",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/config.ts

@@ -93,6 +93,13 @@ export const configSchema = z.object({
     if (!Number.isFinite(n) || n < 1 || n > 64) return 6;
     return Math.floor(n);
   }, z.number().int().min(1).max(64)),
+  // Space-separated list of origins (e.g. "https://ework-web.taobao.net http://ework-web.taobao.net")
+  // injected into CSP form-action + connect-src. For reverse-proxy/gateway deployments
+  // where the browser sees a different scheme/host than the app's 'self'.
+  publicOrigins: z
+    .string()
+    .default("")
+    .transform((s) => s.split(/\s+/).filter(Boolean)),
 });
 
 export type Config = z.infer<typeof configSchema>;
@@ -188,6 +195,7 @@ export async function loadConfig(): Promise<Config> {
     defaultModel: db.defaultModel ?? process.env.WORK_DEFAULT_MODEL,
     autowireActive: process.env.WORK_AUTOWIRE_ACTIVE !== "false",
     webhookMaxConcurrent: Number(process.env.WORK_WEBHOOK_MAX_CONCURRENT ?? "6"),
+    publicOrigins: process.env.WORK_PUBLIC_ORIGINS ?? "",
   });
 }
 

package/src/db.ts

@@ -301,7 +301,8 @@ function translateForMysql(sql: string): string {
   return sql
     .replace(/INSERT OR IGNORE INTO/g, "INSERT IGNORE INTO")
     .replace(/ON CONFLICT\((\w+)\) DO UPDATE SET/g, "ON DUPLICATE KEY UPDATE")
-    .replace(/excluded\.(\w+)/g, "VALUES($1)");
+    .replace(/excluded\.(\w+)/g, "VALUES($1)")
+    .replace(/LIKE \? ESCAPE '\\'/g, "LIKE ?");
 }
 
 async function migrateMysqlSurrogateId(pool: Pool): Promise<void> {

package/src/index.ts

@@ -27,7 +27,7 @@ import { buildAdminTokensPage } from "./views/adminTokens";
 import { buildSessionList, buildSessionView, renderNewMessages, renderBatchHTML } from "./views/sessionLog";
 import { buildFileView, FileViewError, readFileSince, serveRawFile } from "./fileview";
 import { translateText, translateTextStream, TranslateError } from "./translate";
-import { rateLimit } from "./ratelimit";
+import { rateLimit, clearRateLimit } from "./ratelimit";
 import {
   StoreError,
   getProject,
@@ -185,13 +185,20 @@ async function autoWireAllProjects(origin: string): Promise<void> {
 void autoWireAllProjects(`http://${cfg.host}:${cfg.port}`);
 
 const SEC_HEADERS: Record<string, string> = {
-  "content-security-policy": `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'`,
+  "content-security-policy": buildCsp(cfg),
   "x-content-type-options": "nosniff",
   "x-frame-options": "DENY",
   "referrer-policy": "same-origin",
   "permissions-policy": "()",
 };
 
+function buildCsp(cfg: Config): string {
+  const origins = cfg.publicOrigins.join(" ");
+  const formAction = origins ? `'self' ${origins}` : "'self'";
+  const connectSrc = origins ? `'self' ${origins}` : "'self'";
+  return `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src ${connectSrc}; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action ${formAction}`;
+}
+
 const hlCss = loadHighlightCss();
 
 function loadHighlightCss(): string {
@@ -483,14 +490,18 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     if (req.method === "POST") {
       const form = await req.formData().catch(() => new FormData());
       const next = sanitizeNext(String(form.get("next") ?? "/"));
-      if (!rateLimit(`login:${ip}`, 5, 5 / (15 * 60))) {
-        return html(loginHTML(next, "尝试过多，15 分钟后再试", cfg), 429);
-      }
       const login = String(form.get("login") ?? "").trim();
       const password = String(form.get("password") ?? "");
       const token = String(form.get("token") ?? "").trim();
 
-      // Token wins over login/password if both supplied (migration path).
+      const rlKey = `login:${ip}:${login || token || "?"}`;
+      if (!rateLimit(rlKey, 5, 5 / (15 * 60))) {
+        return new Response(loginHTML(next, "尝试过多，15 分钟后再试", cfg), {
+          status: 429,
+          headers: { "content-type": "text/html; charset=utf-8", "retry-after": "900" },
+        });
+      }
+
       let resolvedLogin: string | null = null;
       if (token && token === cfg.authToken) {
         resolvedLogin = cfg.operatorLogin;
@@ -508,6 +519,7 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
       }
 
       if (resolvedLogin) {
+        clearRateLimit(rlKey);
         const setCookie = await makeAuthCookieHeader(cfg, resolvedLogin);
         return new Response(null, {
           status: 302,

package/src/ratelimit.ts

@@ -33,3 +33,7 @@ export function clientIp(req: Request): string {
   if (xff) return (xff.split(",")[0] ?? "").trim();
   return req.headers.get("x-real-ip") ?? "unknown";
 }
+
+export function clearRateLimit(id: string): void {
+  buckets.delete(id);
+}