maxibase 1.2.1 → 1.3.0

package/docker/compose.yaml

@@ -9,7 +9,7 @@ services:
       - ./volumes/files/private:/app/${NUXT_FILES_PRIVATE_FOLDER:-files/private}
       - ./volumes/backups:/app/backups
     ports:
-      - ${SERVER_PORT:-3000}:3000
+      - ${SERVER_HOST:-0.0.0.0}:${SERVER_PORT:-3000}:3000
     networks:
       - shared-network
 

package/layers/base/app/pages/admin/logs.vue

@@ -70,8 +70,8 @@ function formatDay(utcTimestamp: string) {
 }
 
 function originUrl(origin: string | null) {
-  const url = origin?.replace(/ .*/, '')
-  return url?.startsWith('/') || url?.startsWith('http') ? url : null
+  const url = origin?.replace(/^client /, '').replace(/ .*/, '')
+  return url && /^\/(?![/\\])/.test(url) ? url : null
 }
 
 function toggleExpanded(id: number, isOpen: boolean) {

package/layers/base/nuxt.config.ts

@@ -93,7 +93,9 @@ export default defineNuxtConfig({
     },
     storage: {
       auth: {
-        driver: 'memory',
+        driver: 'lru-cache',
+        max: 10_000,
+        ttl: 10 * 60 * 1000,
       },
     },
     serverAssets: [

package/layers/base/server/api/log.post.ts

@@ -16,5 +16,5 @@ const bodySchema = z.object({
 
 export default defineEventHandler(async (event) => {
   const { summary, data, origin, type } = await readValidatedBody(event, bodySchema.parse)
-  await log(summary, data, origin, type, event)
+  await log(summary, data, origin ? `client ${origin}` : 'client', type, event)
 })

package/layers/base/server/utils/rateLimit.ts

@@ -1,4 +1,5 @@
 import type { H3Event } from 'h3'
+import { isIPv6 } from 'node:net'
 
 export interface RateLimitRule {
   limit: number // max requests per window
@@ -24,7 +25,31 @@ setInterval(() => {
 async function getId(event: H3Event): Promise<string> {
   const { user } = await getUserSession(event)
   if (user) return user.id
-  return getClientIP(event)
+  return rateLimitIP(getClientIP(event))
+}
+
+// An IPv6 client usually holds a whole /64, so counting single addresses would let it rotate
+// through 2^64 of them. Count the /64 instead, and IPv4-mapped addresses as their IPv4.
+export function rateLimitIP(ip: string): string {
+  const address = ip.split('%')[0]!.toLowerCase() // drop the zone id
+  if (!isIPv6(address)) return ip
+
+  const mapped = address.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/)
+  if (mapped) return mapped[1]!
+
+  // an embedded IPv4 tail fills the last two groups
+  const toGroups = (part: string) =>
+    part ? part.split(':').flatMap((group) => (group.includes('.') ? ['0', '0'] : [group])) : []
+  const [head = '', tail] = address.split('::')
+  let groups = toGroups(head)
+  if (tail !== undefined) {
+    const tailGroups = toGroups(tail)
+    groups = [...groups, ...Array(8 - groups.length - tailGroups.length).fill('0'), ...tailGroups]
+  }
+  return `${groups
+    .slice(0, 4)
+    .map((group) => parseInt(group, 16).toString(16))
+    .join(':')}::/64`
 }
 
 export async function enforceRateLimit(

package/nuxt.config.ts

@@ -13,10 +13,7 @@ export default defineNuxtConfig({
         lang: 'en',
       },
       title: process.env.NUXT_PUBLIC_NAME,
-      link: [
-        { rel: 'icon', href: '/favicon.ico', sizes: '32x32' },
-        { rel: 'icon', type: 'image/svg+xml', href: '/logo.svg' },
-      ],
+      link: [{ rel: 'icon', href: '/favicon.ico', sizes: '32x32' }],
       meta: [{ name: 'theme-color', content: '#000000' }],
     },
   },
@@ -29,7 +26,7 @@ export default defineNuxtConfig({
     rateLimit: {
       routes: {
         // limit: max requests per IP, window: in seconds
-        '/api/log': { limit: 30, window: 60 },
+        '/api/log': { limit: 10, window: 3600 },
         '/api/auth/options': { limit: 10, window: 60 },
         '/api/auth/password': { limit: 5, window: 60 },
         '/api/auth/otp/get': { limit: 5, window: 900 },
@@ -38,6 +35,7 @@ export default defineNuxtConfig({
         '/api/auth/otp/verify': { limit: 10, window: 60 },
         '/api/auth/totp/verify': { limit: 10, window: 60 },
         '/api/auth/webauthn/authenticate': { limit: 10, window: 60 },
+        '/api/auth/webauthn/register': { limit: 10, window: 60 },
         '/api/auth/anonymous': { limit: 5, window: 3600 },
       },
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxibase",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Nuxt layer with auth, files, logs and backups",
   "keywords": [
     "nuxt",
@@ -58,12 +58,12 @@
     "prepublishOnly": "pnpm lint && pnpm fmt:check && pnpm typecheck && pnpm test"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1146.0",
-    "@aws-sdk/s3-request-presigner": "^3.1146.0",
-    "@iconify-json/lucide": "^1.2.140",
-    "@nuxt/hints": "^1.1.4",
+    "@aws-sdk/client-s3": "^3.1154.0",
+    "@aws-sdk/s3-request-presigner": "^3.1154.0",
+    "@iconify-json/lucide": "^1.2.147",
+    "@nuxt/hints": "^1.1.5",
     "@nuxt/icon": "^2.5.1",
-    "@pinia/nuxt": "^1.0.2",
+    "@pinia/nuxt": "^1.0.3",
     "@simplewebauthn/browser": "^11.0.0",
     "@simplewebauthn/server": "^11.0.0",
     "@types/nodemailer": "^8.0.2",
@@ -71,24 +71,24 @@
     "@types/qrcode": "^1.5.6",
     "drizzle-orm": "1.0.0-rc.3",
     "goku-css": "^9.0.8",
-    "nodemailer": "^9.1.1",
-    "nuxt-auth-utils": "^0.5.30",
-    "nuxt-i18n-micro": "^3.30.0",
+    "nodemailer": "^10.1.7",
+    "nuxt-auth-utils": "^0.5.32",
+    "nuxt-i18n-micro": "^3.30.1",
     "otplib": "^13.5.0",
     "pg": "^8.23.1",
-    "pinia": "^4.0.3",
+    "pinia": "^4.1.0",
     "qrcode": "^1.5.4",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "drizzle-kit": "1.0.0-rc.3",
     "drizzle-seed": "1.0.0-rc.3",
     "maxibase": "link:.",
-    "nuxt": "^4.6.0",
+    "nuxt": "^4.6.2",
     "oxfmt": "^0.72.0",
-    "oxlint": "^1.87.0",
+    "oxlint": "^1.89.0",
     "typescript": "^5.9.3",
-    "vitest": "^5.0.3",
-    "vue-tsc": "^3.3.12"
+    "vitest": "^5.0.5",
+    "vue-tsc": "^3.3.13"
   }
 }