maxibase 1.1.1 → 1.2.0

package/layers/base/app/pages/signin.vue

@@ -56,7 +56,7 @@ async function signInAnonymously() {
         :src="config.public.logo"
         :alt="config.public.name"
         height="42"
-        class="fg"
+        style="display: block"
       />
       <span v-else>{{ config.public.name }}</span>
     </I18nLink>

package/layers/base/app/plugins/session.ts

@@ -5,18 +5,25 @@ export default defineNuxtPlugin(async () => {
   const { session, clear } = useUserSession()
   if (!session.value?.user) return
 
-  const lastRefreshed = parseInt(localStorage.getItem('rotate-token-at') || '0')
-  if (lastRefreshed) {
-    const refreshAfter = lastRefreshed + useRuntimeConfig().public.refreshToken.rotateAfter * 1000
-    const { expiresAt } = session.value
-    if ((expiresAt !== undefined && expiresAt < Date.now()) || refreshAfter > Date.now()) return
-    try {
-      await $fetch('/api/auth/refresh', { method: 'POST' })
-    } catch (error) {
-      if ((error as FetchError).response?.status !== 401) return
-      await clear()
-      return
+  const rotate = async () => {
+    const lastRefreshed = parseInt(localStorage.getItem('rotate-token-at') || '0')
+    if (lastRefreshed) {
+      const refreshAfter = lastRefreshed + useRuntimeConfig().public.refreshToken.rotateAfter * 1000
+      const { expiresAt } = session.value!
+      if ((expiresAt !== undefined && expiresAt < Date.now()) || refreshAfter > Date.now()) return
+      try {
+        await $fetch('/api/auth/refresh', { method: 'POST' })
+      } catch (error) {
+        if ((error as FetchError).response?.status !== 401) return
+        await clear()
+        return
+      }
     }
+    localStorage.setItem('rotate-token-at', Date.now().toString())
   }
-  localStorage.setItem('rotate-token-at', Date.now().toString())
+
+  // Tabs restored together would all send the same token: the first one rotates it and the
+  // 401 of the others deletes the cookie it just got. One tab rotates, the others share its cookie.
+  if (!navigator.locks) return rotate()
+  await navigator.locks.request('rotate-token', { ifAvailable: true }, (lock) => lock && rotate())
 })

package/layers/base/server/api/auth/email/get.post.ts

@@ -34,7 +34,7 @@ export default defineEventHandler(async (event) => {
   })
 
   try {
-    return await sendEmailTemplate('emailChange', locale, { otp }, email)
+    await sendEmailTemplate('emailChange', locale, { otp }, email)
   } catch (error) {
     await storage.removeItem(key)
     throw createError({

package/layers/base/server/api/auth/otp/get.post.ts

@@ -43,7 +43,7 @@ export default defineEventHandler(async (event) => {
   })
 
   try {
-    return await sendEmailTemplate(
+    await sendEmailTemplate(
       'otp',
       locale,
       {

package/layers/base/server/api/auth/otp/verify.post.ts

@@ -4,7 +4,7 @@ import type { OTP } from './get.post'
 
 const bodySchema = z.object({
   email: emailSchema,
-  otp: z.string().length(6).or(z.string().min(32)),
+  otp: otpSchema,
 })
 
 export default defineEventHandler(async (event) => {

package/layers/base/server/api/auth/totp/confirm.post.ts

@@ -4,7 +4,7 @@ import { z } from 'zod'
 import { verify } from 'otplib'
 
 const bodySchema = z.object({
-  secret: z.string().min(32),
+  secret: z.string().min(32).max(64), // generateSecret gives 32 base32 characters
   token: z.string().length(6),
 })
 

package/layers/base/server/api/auth/totp/verify.post.ts

@@ -8,7 +8,7 @@ export default defineEventHandler(async (event) => {
     z.object({
       email: emailSchema,
       password: passwordSchema().optional(),
-      otp: z.string().length(6).or(z.string().min(32)).optional(),
+      otp: otpSchema.optional(),
       token: z.string().length(6),
     }).parse,
   )

package/layers/base/server/tasks/clean.ts

@@ -6,35 +6,29 @@ export default defineTask({
   async run() {
     const config = useRuntimeConfig()
 
-    try {
-      await cleanOldBackups()
-      if (config.s3.privateBucket) {
-        const backups = await listFromS3('backups', true)
-        const retentionMs = daysToMilliseconds(config.backup.retentionDays)
-        const cutoffDate = new Date(Date.now() - retentionMs)
-        await Promise.all(
-          backups.map((b) => {
-            if (b.updatedAt && b.updatedAt < cutoffDate) {
-              return deleteFromS3(`backups/${b.name}`, true)
-            }
-          }),
-        )
-      }
-      await cleanLogs()
-      await cleanTempUploads()
+    const steps: [string, () => Promise<unknown>][] = [['backups', cleanOldBackups]]
+    if (config.s3.privateBucket) steps.push(['S3 backups', cleanOldS3Backups])
+    steps.push(['logs', cleanLogs], ['uploads', () => cleanTempUploads()])
 
-      return {
-        result: {
-          success: true,
-        },
-      }
-    } catch (error: any) {
-      await log(error.message, { stack: error.stack, cause: error.cause }, 'clean task', 'error')
-      return {
-        result: {
-          success: false,
-        },
-      }
+    const results = await Promise.allSettled(steps.map(([, step]) => step()))
+
+    let success = true
+    for (const [i, result] of results.entries()) {
+      if (result.status === 'fulfilled') continue
+      success = false
+      const error = result.reason
+      await log(
+        `Cleaning ${steps[i]![0]} failed: ${error?.message}`,
+        { stack: error?.stack, cause: error?.cause },
+        'clean task',
+        'error',
+      )
+    }
+
+    return {
+      result: {
+        success,
+      },
     }
   },
 })

package/layers/base/server/utils/backup.ts

@@ -96,3 +96,17 @@ export async function cleanOldBackups() {
     }),
   )
 }
+
+export async function cleanOldS3Backups() {
+  const config = useRuntimeConfig()
+  const backups = await listFromS3('backups', true)
+  const retentionMs = daysToMilliseconds(config.backup.retentionDays)
+  const cutoffDate = new Date(Date.now() - retentionMs)
+  await Promise.all(
+    backups.map((b) => {
+      if (b.updatedAt && b.updatedAt < cutoffDate) {
+        return deleteFromS3(`backups/${b.name}`, true)
+      }
+    }),
+  )
+}

package/layers/base/server/utils/email.ts

@@ -1,23 +1,33 @@
 import nodemailer from 'nodemailer'
 import type { Transporter } from 'nodemailer'
 
-let transporter: Transporter | null = null
+export type SmtpConfig = {
+  host: string
+  port: number | string
+  user: string
+  pass: string
+  from: string
+}
+
+const transporters = new Map<string, Transporter>()
 
-function useTransporter() {
-  const config = useRuntimeConfig()
+function useTransporter(smtp: SmtpConfig) {
+  const key = JSON.stringify([smtp.host, smtp.port, smtp.user, smtp.pass])
+  let transporter = transporters.get(key)
   if (!transporter) {
-    const port = Number(config.smtp.port)
+    const port = Number(smtp.port)
     transporter = nodemailer.createTransport({
-      host: config.smtp.host,
+      host: smtp.host,
       port,
       secure: port === 465,
       requireTLS: port !== 465,
       pool: true,
       auth: {
-        user: config.smtp.user,
-        pass: config.smtp.pass,
+        user: smtp.user,
+        pass: smtp.pass,
       },
     })
+    transporters.set(key, transporter)
   }
   return transporter
 }
@@ -39,12 +49,15 @@ export async function sendEmail(
   attachments?: any[],
   bcc?: string,
   params = {},
+  replyTo?: string,
+  smtp?: SmtpConfig,
 ) {
-  const config = useRuntimeConfig()
-  const mail = await useTransporter().sendMail({
-    from: config.smtp.from,
+  const config = smtp ?? (useRuntimeConfig().smtp as SmtpConfig)
+  const mail = await useTransporter(config).sendMail({
+    from: config.from,
     to,
     bcc,
+    replyTo,
     subject: fillTemplate(subject, params, false),
     html: await buildEmail(html, locale, params),
     attachments,
@@ -73,9 +86,11 @@ export async function sendEmailTemplate(
   to: string,
   attachments?: any[],
   bcc?: string,
+  replyTo?: string,
+  smtp?: SmtpConfig,
 ) {
   const { subject, html } = await buildEmailTemplate(templateId, locale)
-  return sendEmail(to, subject, html, locale, attachments, bcc, params)
+  return sendEmail(to, subject, html, locale, attachments, bcc, params, replyTo, smtp)
 }
 
 export async function buildEmailTemplate(templateId: string, locale: string = 'en') {
@@ -120,8 +135,8 @@ function inlineStyles(html: string): string {
 }
 
 function appPlaceholders() {
-  const config = useRuntimeConfig()
-  return { appName: config.public.name, url: config.public.url, logo: config.public.logo }
+  const { name, url, logo } = useRuntimeConfig().public
+  return { appName: name, url, logo: logo ? (URL.parse(logo, url)?.href ?? logo) : logo }
 }
 
 // {{value}} is escaped, {{{value}}} is inserted as raw html. Reach for the raw

package/layers/base/server/utils/schemas.ts

@@ -2,6 +2,9 @@ import { z } from 'zod'
 
 export const emailSchema = z.string().trim().toLowerCase().pipe(z.email())
 
+// The emailed 6-digit code, or the magic-link token (32 bytes in base64url, 43 characters)
+export const otpSchema = z.string().length(6).or(z.string().min(32).max(64))
+
 export const passwordSchema = () => {
   const { min, max } = useRuntimeConfig().public.password
   return z.string().trim().min(min).max(max)

package/nuxt.config.ts

@@ -13,7 +13,7 @@ export default defineNuxtConfig({
         lang: 'en',
       },
       title: process.env.NUXT_PUBLIC_NAME,
-      link: [],
+      link: [{ rel: 'icon', type: 'image/svg+xml', href: '/logo.svg' }],
       meta: [{ name: 'theme-color', content: '#000000' }],
     },
   },
@@ -21,7 +21,7 @@ export default defineNuxtConfig({
     public: {
       url: 'http://localhost:3000',
       name: 'Nuxt base',
-      logo: 'https://placehold.co/200x100?text=logo',
+      logo: '/logo.svg',
     },
     rateLimit: {
       routes: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxibase",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "Nuxt layer with auth, files, logs and backups",
   "keywords": [
     "nuxt",