feedkeeper 0.23.0 → 0.23.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "feedkeeper",
-  "version": "0.23.0",
+  "version": "0.23.1",
   "description": "A lightweight, self-hosted RSS reader and remote MCP server for your news, blogs, and AI workflows.",
   "keywords": [
     "rss",

package/server/dist/api/auth.js

@@ -5,9 +5,9 @@ import { config } from "../config.js";
 import { requireSession, requireAdmin } from "../auth/middleware.js";
 import { createUser, deleteUserAvatar, findUserByEmail, findUserById, getUserAvatar, listUsers, setUserAvatar, toPublicUser, updateDisplayName, dismissIntro, updateUserPassword, } from "../auth/users.js";
 import { AVATAR_MAX_BYTES, detectAvatarType } from "../auth/avatar.js";
-import { verifyPassword } from "../auth/password.js";
+import { verifyPassword, verifyPasswordOrDummy } from "../auth/password.js";
 import { getUserCapabilities } from "../auth/capabilities.js";
-import { beginMfa, securityVersion } from "../auth/security.js";
+import { beginMfa, revokeBrowserSessions, securityVersion } from "../auth/security.js";
 import { createSecurityRouter } from "../auth/securityRoutes.js";
 export const authRouter = Router();
 authRouter.use("/security", createSecurityRouter({ completeLogin: (req, res, userId) => {
@@ -31,7 +31,9 @@ authRouter.post("/login", loginLimiter, (req, res) => {
         return;
     }
     const user = findUserByEmail(parsed.data.email);
-    if (!user || !verifyPassword(parsed.data.password, user.password_hash)) {
+    // Always check a password, so an unknown address answers as slowly as a wrong password.
+    const passwordMatches = verifyPasswordOrDummy(parsed.data.password, user?.password_hash);
+    if (!user || !passwordMatches) {
         res.status(401).json({ error: "invalid_credentials" });
         return;
     }
@@ -110,6 +112,9 @@ authRouter.post("/change-password", requireSession, loginLimiter, (req, res) =>
         return;
     }
     updateUserPassword(user.id, parsed.data.newPassword);
+    // Other browsers that were signed in with the old password are signed out; this one stays.
+    revokeBrowserSessions(user.id);
+    req.session = { userId: user.id, securityVersion: securityVersion(user.id) };
     res.status(204).end();
 });
 const createUserSchema = z.object({

package/server/dist/auth/password.js

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import bcrypt from "bcryptjs";
 const SALT_ROUNDS = process.env.NODE_ENV === "test" ? 4 : 12;
 export function hashPassword(plain) {
@@ -6,4 +7,15 @@ export function hashPassword(plain) {
 export function verifyPassword(plain, hash) {
     return bcrypt.compareSync(plain, hash);
 }
+// A hash nobody knows the password for. Checking it costs what checking a real one costs.
+let unknownAccountHash;
+/**
+ * Like verifyPassword for a sign-in, where the account may not exist: an unknown address takes as long as a known
+ * one, so the response time does not tell whether an account is registered.
+ */
+export function verifyPasswordOrDummy(plain, hash) {
+    unknownAccountHash ??= bcrypt.hashSync(randomBytes(16).toString("hex"), SALT_ROUNDS);
+    const matches = bcrypt.compareSync(plain, hash ?? unknownAccountHash);
+    return hash !== undefined && matches;
+}
 //# sourceMappingURL=password.js.map

package/server/dist/auth/security.js

@@ -96,6 +96,15 @@ export function newRecoveryCodes(userId) {
         db.prepare("INSERT INTO recovery_codes (user_id, code_hash) VALUES (?, ?)").run(userId, hash(code));
     return codes.map(code => code.match(/.{6}/g).join("-"));
 }
+/**
+ * A new password ends every browser session and pending sign-in that knew the old one. Access tokens, paired
+ * devices and connected apps are the person's own and keep working; they can be removed one by one.
+ */
+export function revokeBrowserSessions(userId) {
+    securityAccount(userId);
+    db.prepare("UPDATE account_security SET version = version + 1 WHERE user_id = ?").run(userId);
+    db.prepare("DELETE FROM security_challenges WHERE user_id = ?").run(userId);
+}
 /** Enabling MFA invalidates older password-only sessions, tokens, pairing codes and pending logins. */
 export function revokeSecuritySessions(userId) {
     db.prepare("UPDATE account_security SET version = version + 1 WHERE user_id = ?").run(userId);

package/server/dist/db/migrations/0032_normalize_published_at.sql

@@ -0,0 +1,12 @@
+-- Migration 0032: publish dates that are not dates.
+--
+-- Entries whose feed gave a date that could not be read ("gestern", localised weekday names, an empty string) had
+-- the raw text stored. Compared as text it sorted above every real date and never aged. Dates before 1991 and
+-- dates more than a day ahead are placeholders (1970-01-01, year 9999). All of them become NULL, which makes the
+-- app use the time it stored the article.
+UPDATE items SET published_at = NULL
+WHERE published_at IS NOT NULL AND julianday(published_at) IS NULL;
+
+UPDATE items SET published_at = NULL
+WHERE published_at IS NOT NULL
+  AND (julianday(published_at) < julianday('1991-01-01') OR julianday(published_at) > julianday('now', '+1 day'));

package/server/dist/feeds/cleanup.js

@@ -99,7 +99,7 @@ export function runCleanup(custom) {
              WHERE s.feed_id = i.feed_id
                AND NOT EXISTS (SELECT 1 FROM item_reads r WHERE r.item_id = i.id AND r.user_id = s.user_id)
            )
-           AND COALESCE(i.published_at, i.created_at) <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-' || ? || ' days')
+           AND COALESCE(julianday(i.published_at), julianday(i.created_at)) <= julianday('now', '-' || ? || ' days')
        )`).run(settings.retentionReadDays);
         deletedReadItems = res.changes;
     }
@@ -111,7 +111,7 @@ export function runCleanup(custom) {
          AND feed_id NOT IN (SELECT id FROM feeds WHERE is_system_inbox = 1)
          AND NOT EXISTS (SELECT 1 FROM editions e, json_each(e.item_ids) selected
            WHERE selected.value = items.id AND e.status = 'active' AND julianday(e.expires_at) > julianday('now'))
-         AND COALESCE(published_at, created_at) <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-' || ? || ' days')`).run(settings.retentionMaxDays);
+         AND COALESCE(julianday(published_at), julianday(created_at)) <= julianday('now', '-' || ? || ' days')`).run(settings.retentionMaxDays);
         deletedOldItems = res.changes;
     }
     // 3. Delete items exceeding retentionMaxItemsPerFeed (excluding bookmarked items and items with notes)
@@ -126,7 +126,7 @@ export function runCleanup(custom) {
            SELECT id FROM (
              SELECT id, ROW_NUMBER() OVER (
                PARTITION BY feed_id
-               ORDER BY COALESCE(published_at, created_at) DESC, id DESC
+               ORDER BY COALESCE(julianday(published_at), julianday(created_at)) DESC, id DESC
              ) as rn
              FROM items
            )

package/server/dist/feeds/dates.js

@@ -0,0 +1,21 @@
+// Nothing on the web is older than this, so an earlier date is a placeholder such as 1970-01-01.
+const EARLIEST_PLAUSIBLE = Date.UTC(1991, 0, 1);
+// Feeds may announce an article a little ahead of time or in another zone, but not by years.
+const MAX_AHEAD_MS = 24 * 60 * 60 * 1000;
+/**
+ * The publish date of a feed entry as an ISO timestamp, or null when the feed gives none we can trust: missing,
+ * not a date ("gestern", localised weekday names), a placeholder in the past or a date far in the future. Null makes
+ * the app use the time it stored the article, so the article lists, ages and is cleaned up like any other.
+ */
+export function normalizePublishedAt(value, now = Date.now()) {
+    if (typeof value !== "string")
+        return null;
+    const text = value.trim();
+    if (!text)
+        return null;
+    const time = Date.parse(text);
+    if (!Number.isFinite(time) || time < EARLIEST_PLAUSIBLE || time > now + MAX_AHEAD_MS)
+        return null;
+    return new Date(time).toISOString();
+}
+//# sourceMappingURL=dates.js.map

package/server/dist/feeds/poller.js

@@ -9,6 +9,7 @@ import { findFeedById, listSubscriberIds, updateFeedAfterPoll, updateFeedIcon, u
 import { db } from "../db/index.js";
 import { configurePollHostCooldowns, PollQueue } from "./pollQueue.js";
 import { feedRequests, PollDeferredError, sourceHost } from "./requestGate.js";
+import { normalizePublishedAt } from "./dates.js";
 configurePollHostCooldowns();
 function mediaAttribute(value, key) {
     if (typeof value !== "object" || value === null)
@@ -103,7 +104,7 @@ async function pollAttempt(feed, signal) {
         title: plainTitle(item.title), link: item.link,
         contentSnippet: decodeEntities(item.contentSnippet ?? item.content) ?? undefined,
         contentHtml: item.contentEncoded ?? item["content:encoded"] ?? item.content ?? null,
-        publishedAt: item.isoDate ?? item.pubDate, imageUrl: extractImageUrl(item),
+        publishedAt: normalizePublishedAt(item.isoDate ?? item.pubDate) ?? undefined, imageUrl: extractImageUrl(item),
     }));
     // No await in this transaction. Items, health/validators and job completion become visible together.
     const newItems = db.transaction(() => {

package/server/dist/feeds/repository.js

@@ -234,7 +234,7 @@ export function listItemsForUser(userId, opts = {}) {
     const limit = Math.min(opts.limit ?? 50, 200);
     const offset = Math.max(opts.offset ?? 0, 0);
     params.push(limit, offset);
-    const orderBy = opts.sortByAdded ? "i.created_at DESC, i.id DESC" : opts.bookmarkedOnly ? "b.created_at DESC, i.id DESC" : "i.published_at DESC, i.created_at DESC, i.id DESC";
+    const orderBy = opts.sortByAdded ? "i.created_at DESC, i.id DESC" : opts.bookmarkedOnly ? "b.created_at DESC, i.id DESC" : "COALESCE(julianday(i.published_at), julianday(i.created_at)) DESC, i.created_at DESC, i.id DESC";
     // Page IDs before loading HTML. User/feed and user/item keys make these joins unique.
     // Keep selection and loading in one statement so they share the same read snapshot.
     return db
@@ -583,8 +583,17 @@ export function formatFtsQuery(raw) {
         return "";
     return sanitized.join(" ");
 }
+/**
+ * True when the query has letters or digits that the full-text index cannot be asked for as typed (Japanese,
+ * Cyrillic, Greek, ...). `formatFtsQuery` drops them, so a query such as "RSS 新聞" would silently search for "RSS"
+ * alone; such queries are matched word by word as substrings instead. Quoted phrases are passed through as typed.
+ */
+export function needsSubstringSearch(raw) {
+    const outsideQuotes = raw.replace(/"[^"]*"/g, " ");
+    return /(?![a-zA-Z0-9_\u00C0-\u024F\u1E00-\u1EFF])[\p{L}\p{N}]/u.test(outsideQuotes);
+}
 export function searchItemsForUser(userId, opts) {
-    const fts = formatFtsQuery(opts.query);
+    const fts = needsSubstringSearch(opts.query) ? "" : formatFtsQuery(opts.query);
     const conditions = ["(s.id IS NOT NULL OR b.item_id IS NOT NULL OR n.user_id IS NOT NULL)"];
     const params = [];
     if (opts.feedId) {
@@ -610,14 +619,18 @@ export function searchItemsForUser(userId, opts) {
         params.push(fts, userId, opts.query);
     }
     else {
-        conditions.push(`(
-      INSTR(LOWER(COALESCE(i.title, '')), LOWER(?)) > 0
-      OR INSTR(LOWER(COALESCE(i.content_snippet, '')), LOWER(?)) > 0
-      OR INSTR(LOWER(COALESCE(i.content_html, '')), LOWER(?)) > 0
-      OR INSTR(LOWER(COALESCE(i.full_content_html, '')), LOWER(?)) > 0
-      OR i.id IN (SELECT item_id FROM item_notes WHERE user_id = ? AND INSTR(LOWER(content), LOWER(?)) > 0)
-    )`);
-        params.push(opts.query, opts.query, opts.query, opts.query, userId, opts.query);
+        // Every word has to occur somewhere in the article or in the person's note.
+        const words = opts.query.trim().split(/\s+/).filter(Boolean).slice(0, 8);
+        for (const word of words) {
+            conditions.push(`(
+        INSTR(LOWER(COALESCE(i.title, '')), LOWER(?)) > 0
+        OR INSTR(LOWER(COALESCE(i.content_snippet, '')), LOWER(?)) > 0
+        OR INSTR(LOWER(COALESCE(i.content_html, '')), LOWER(?)) > 0
+        OR INSTR(LOWER(COALESCE(i.full_content_html, '')), LOWER(?)) > 0
+        OR i.id IN (SELECT item_id FROM item_notes WHERE user_id = ? AND INSTR(LOWER(content), LOWER(?)) > 0)
+      )`);
+            params.push(word, word, word, word, userId, word);
+        }
     }
     // Count total matches
     const totalRow = db.prepare(`
@@ -633,9 +646,9 @@ export function searchItemsForUser(userId, opts) {
     const total = totalRow?.count ?? 0;
     const limit = Math.min(opts.limit ?? 30, 100);
     const offset = Math.max(opts.offset ?? 0, 0);
-    let orderBy = "i.published_at DESC, i.created_at DESC, i.id DESC";
+    let orderBy = "COALESCE(julianday(i.published_at), julianday(i.created_at)) DESC, i.created_at DESC, i.id DESC";
     if (opts.sort !== "date" && fts) {
-        orderBy = "COALESCE(fts.rank, 0) ASC, i.published_at DESC";
+        orderBy = "COALESCE(fts.rank, 0) ASC, COALESCE(julianday(i.published_at), julianday(i.created_at)) DESC";
     }
     const querySql = `
     SELECT DISTINCT i.*,

package/server/dist/oauth/routes.js

@@ -6,7 +6,7 @@ import { z } from "zod";
 import { config } from "../config.js";
 import { getUserCapabilities, hasUserCapability } from "../auth/capabilities.js";
 import { hasTotp, securityVersion, sessionIsSecure } from "../auth/security.js";
-import { verifyPassword } from "../auth/password.js";
+import { verifyPasswordOrDummy } from "../auth/password.js";
 import { findUserByEmail, findUserById } from "../auth/users.js";
 import { ISSUER, MCP_RESOURCE } from "./constants.js";
 import { getOAuthHost } from "./host.js";
@@ -115,7 +115,15 @@ function basicClientId(req) {
     if (!header?.startsWith("Basic "))
         return null;
     const [id] = Buffer.from(header.slice(6), "base64").toString("utf8").split(":");
-    return id ? decodeURIComponent(id) : null;
+    if (!id)
+        return null;
+    try {
+        return decodeURIComponent(id);
+    }
+    catch {
+        // A malformed escape is a client that does not exist, not a server error.
+        return null;
+    }
 }
 const str = (value) => (typeof value === "string" ? value : "");
 function tokenResponse(res, tokens, scope) {
@@ -312,7 +320,8 @@ oauthAuthorizeRouter.post("/oauth/authorize/login", sameOriginOnly, loginLimiter
         return;
     }
     const user = findUserByEmail(parsed.data.email);
-    if (!user || !verifyPassword(parsed.data.password, user.password_hash)) {
+    const passwordMatches = verifyPasswordOrDummy(parsed.data.password, user?.password_hash);
+    if (!user || !passwordMatches) {
         page(res, 401, renderLogin(req, { clientName: client.client_name, returnTo, failed: true }));
         return;
     }

package/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feedkeeper/server",
-  "version": "0.23.0",
+  "version": "0.23.1",
   "private": true,
   "type": "module"
 }

package/server/dist/app.js

@@ -1,100 +0,0 @@
-import { dirname, join, sep } from "node:path";
-import { fileURLToPath } from "node:url";
-import { existsSync } from "node:fs";
-import express from "express";
-import helmet from "helmet";
-import cors from "cors";
-import cookieSession from "cookie-session";
-import rateLimit from "express-rate-limit";
-import { config } from "./config.js";
-import { runMigrations } from "./db/index.js";
-import { apiRouter } from "./api/index.js";
-import { mcpRouter } from "./mcp/http.js";
-import { startPollingScheduler } from "./feeds/poller.js";
-import { startCleanupScheduler } from "./feeds/cleanup.js";
-import { repairEncodedText } from "./feeds/repository.js";
-import { pruneArchive, scheduleMissingArchives } from "./feeds/archive.js";
-import { startEditionScheduler } from "./native/editions.js";
-const __dirname = dirname(fileURLToPath(import.meta.url));
-export const DEFAULT_WEB_DIST = join(__dirname, "../../web/dist");
-export function startCoreSchedulers() {
-    runMigrations();
-    const repairedItems = repairEncodedText();
-    if (repairedItems > 0)
-        console.log(`[db] decoded HTML entities in ${repairedItems} stored items`);
-    pruneArchive();
-    const pendingArchives = scheduleMissingArchives();
-    if (pendingArchives > 0)
-        console.log(`[archive] archiving ${pendingArchives} saved articles in the background`);
-    startPollingScheduler();
-    startCleanupScheduler();
-    startEditionScheduler();
-}
-export function createApp(options = {}) {
-    const app = express();
-    if (config.trustProxy) {
-        app.set("trust proxy", 1);
-    }
-    app.use(helmet({
-        contentSecurityPolicy: {
-            directives: {
-                ...helmet.contentSecurityPolicy.getDefaultDirectives(),
-                "script-src": ["'self'"],
-                "img-src": ["'self'", "data:", "https:", "http:"],
-            },
-        },
-    }));
-    // Send X-Robots-Tag to ensure all HTTP endpoints disallow indexing even outside HTML
-    app.use((_req, res, next) => {
-        res.setHeader("X-Robots-Tag", "noindex, nofollow");
-        next();
-    });
-    app.use(cors({
-        origin: config.publicUrl,
-        credentials: true,
-    }));
-    app.use(express.json({ limit: "1mb" }));
-    app.use(express.text({ type: ["application/xml", "text/xml", "text/plain"], limit: "5mb" }));
-    app.use(cookieSession({
-        name: "feedkeeper.sid",
-        secret: config.sessionSecret,
-        maxAge: 30 * 24 * 60 * 60 * 1000,
-        httpOnly: true,
-        sameSite: "lax",
-        secure: config.publicUrl.startsWith("https://"),
-    }));
-    // Generic API rate limit as defense in depth on top of the stricter
-    // per-route limiter on /api/auth/login.
-    app.use("/api", rateLimit({
-        windowMs: 60 * 1000,
-        limit: 120,
-        standardHeaders: true,
-        legacyHeaders: false,
-        // Lists load many article images and feed icons at once; those routes have their own, higher limit.
-        skip: (req) => /^\/(v1\/)?(items\/\d+\/image|feeds\/\d+\/icon|subscriptions\/\d+\/icon|archive\/images\/\d+)$/.test(req.path),
-    }));
-    app.use("/api", apiRouter);
-    app.use("/mcp", mcpRouter);
-    if (options.configure) {
-        options.configure(app);
-    }
-    const webDist = options.webDist === undefined ? DEFAULT_WEB_DIST : options.webDist;
-    if (webDist && existsSync(webDist)) {
-        app.use(express.static(webDist, {
-            setHeaders(res, filePath) {
-                // Hashed build files never change; the service worker must always be re-checked.
-                if (filePath.includes(`${sep}assets${sep}`))
-                    res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
-                if (filePath.endsWith(`${sep}sw.js`))
-                    res.setHeader("Cache-Control", "no-cache");
-            },
-        }));
-        app.get(/(.*)/, (req, res, next) => {
-            if (req.path.startsWith("/api") || req.path.startsWith("/mcp") || req.path.startsWith("/cloud"))
-                return next();
-            res.sendFile(join(webDist, "index.html"));
-        });
-    }
-    return app;
-}
-//# sourceMappingURL=app.js.map

package/server/dist/auth/plan.js

@@ -1,58 +0,0 @@
-const DEFAULT_SELFHOSTED_FEATURES = [
-    "sync",
-    "notes",
-    "edition",
-    "edition.automatic",
-    "edition.revisions",
-    "native-preferences",
-    "search.fts",
-    "mcp.remote",
-    "feed-icons",
-    "folder-icons",
-    "fulltext",
-];
-class DefaultPlanProvider {
-    getPlanForUser(_userId) {
-        return {
-            tier: "selfhosted",
-            status: "active",
-            features: DEFAULT_SELFHOSTED_FEATURES,
-            manageUrl: null,
-        };
-    }
-    hasFeature(_userId, _feature) {
-        // In self-hosted mode, all features are permitted
-        return true;
-    }
-}
-let activePlanProvider = new DefaultPlanProvider();
-export function setPlanProvider(provider) {
-    activePlanProvider = provider;
-}
-export function getPlanProvider() {
-    return activePlanProvider;
-}
-export function getUserPlan(userId) {
-    return activePlanProvider.getPlanForUser(userId);
-}
-export function requirePlanFeature(feature) {
-    return (req, res, next) => {
-        const userId = req.user?.id;
-        if (!userId) {
-            res.status(401).json({ error: "not_authenticated" });
-            return;
-        }
-        if (!activePlanProvider.hasFeature(userId, feature)) {
-            const plan = activePlanProvider.getPlanForUser(userId);
-            res.status(403).json({
-                error: "feature_not_included",
-                feature,
-                tier: plan.tier,
-                manageUrl: plan.manageUrl ?? null,
-            });
-            return;
-        }
-        next();
-    };
-}
-//# sourceMappingURL=plan.js.map

package/server/dist/index.js

@@ -1,15 +0,0 @@
-export { createApp, startCoreSchedulers, DEFAULT_WEB_DIST } from "./app.js";
-export * from "./auth/capabilities.js";
-export * from "./auth/tokens.js";
-export * from "./auth/middleware.js";
-export * from "./auth/users.js";
-export * from "./config.js";
-export * from "./db/index.js";
-export { apiRouter } from "./api/index.js";
-export { mcpRouter } from "./mcp/http.js";
-export { startPollingScheduler } from "./feeds/poller.js";
-export { startCleanupScheduler } from "./feeds/cleanup.js";
-export { repairEncodedText } from "./feeds/repository.js";
-export { pruneArchive, scheduleMissingArchives } from "./feeds/archive.js";
-export { startEditionScheduler } from "./native/editions.js";
-//# sourceMappingURL=index.js.map