mbkauthe 3.0.0 → 3.2.0

package/lib/routes/misc.js

@@ -1,19 +1,20 @@
 import express from "express";
 import fetch from 'node-fetch';
 import rateLimit from 'express-rate-limit';
-import { fileURLToPath } from "url";
-import fs from "fs";
-import path from "path";
 import { mbkautheVar, packageJson, appVersion } from "../config/index.js";
 import { renderError } from "../utils/response.js";
 import { authenticate, validateSession } from "../middleware/auth.js";
 import { ErrorCodes, ErrorMessages } from "../utils/errors.js";
 import { dblogin } from "../database/pool.js";
 import { clearSessionCookies } from "../config/cookies.js";
+import { fileURLToPath } from "url";
+import path from "path";
+import fs from "fs";
 
-const router = express.Router();
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
+
+const router = express.Router();
 // Rate limiter for info/test routes
 const LoginLimit = rateLimit({
   windowMs: 1 * 60 * 1000,
@@ -21,6 +22,21 @@ const LoginLimit = rateLimit({
   message: { success: false, message: "Too many attempts, please try again later" },
   skip: (req) => {
     return !!req.session.user;
+  },
+  validate: {
+    trustProxy: false,
+    xForwardedForHeader: false
+  }
+});
+
+// Rate limiter for admin operations
+const AdminOperationLimit = rateLimit({
+  windowMs: 5 * 60 * 1000,
+  max: 3,
+  message: { success: false, message: "Too many admin operations, please try again later" },
+  validate: {
+    trustProxy: false,
+    xForwardedForHeader: false
   }
 });
 
@@ -30,16 +46,6 @@ router.get('/main.js', (req, res) => {
   res.sendFile(path.join(__dirname, '..', '..', 'public', 'main.js'));
 });
 
-router.get('/icon.svg', (req, res) => {
-  res.setHeader('Cache-Control', 'public, max-age=31536000');
-  res.sendFile(path.join(__dirname, '..', '..', 'public', 'icon.svg'));
-});
-
-router.get(['/favicon.ico', '/icon.ico'], (req, res) => {
-  res.setHeader('Cache-Control', 'public, max-age=31536000');
-  res.sendFile(path.join(__dirname, '..', '..', 'public', 'icon.ico'));
-});
-
 router.get("/bg.webp", (req, res) => {
   const imgPath = path.join(__dirname, "..", "..", "public", "bg.webp");
   res.setHeader('Content-Type', 'image/webp');
@@ -241,12 +247,18 @@ router.get(["/info", "/i"], LoginLimit, async (req, res) => {
 });
 
 // Terminate all sessions (admin endpoint)
-router.post("/api/terminateAllSessions", authenticate(mbkautheVar.Main_SECRET_TOKEN), async (req, res) => {
+router.post("/api/terminateAllSessions", AdminOperationLimit, authenticate(mbkautheVar.Main_SECRET_TOKEN), async (req, res) => {
   try {
     // Run both operations in parallel for better performance
     await Promise.all([
-      dblogin.query({ name: 'terminate-all-user-sessions', text: `UPDATE "Users" SET "SessionId" = NULL` }),
-      dblogin.query({ name: 'terminate-all-db-sessions', text: 'DELETE FROM "session"' })
+      dblogin.query({ 
+        name: 'terminate-all-user-sessions', 
+        text: 'UPDATE "Users" SET "SessionId" = NULL WHERE "SessionId" IS NOT NULL'
+      }),
+      dblogin.query({ 
+        name: 'terminate-all-db-sessions', 
+        text: 'DELETE FROM "session" WHERE expire > NOW()'
+      })
     ]);
 
     req.session.destroy((err) => {