notifkit 0.1.8 → 0.1.10

package/dist/{main-BAO4kKce.mjs → main-39DtKrX4.mjs}

@@ -1,5 +1,5 @@
-import { $ as metrics, A as RedisClient, Bt as NotifyRequestSchema, D as UserRepository, E as TemplateRepository, Ft as BatchAddContactsSchema, G as getPriorityBucket, Gt as TriggerWorkflowSchema, It as ContactChannelSchema, J as globalEmitter, K as normaliseTarget, Lt as CreateWorkflowSchema, O as WorkflowRepository, Pt as AddUserSchema, Q as getMetricsRegistry, S as ContactRepository, T as SegmentRepository, Ut as SyncTemplatesSchema, Vt as PreferencesSchema, Z as StreamProducer, Zt as buildStreamEvent, at as createDatabase, ct as messageLogs, dt as scheduledPayloads, ft as suppressions, gn as loadEnv, ht as workflowDefinitions, lt as projectApiKeys, mt as users, nn as PUBSUB_CHANNELS, p as verifyUnsubscribeToken, pt as userTopicPreferences, q as LRUCache, qt as UpdateUserSchema, rn as STREAMS, tt as createLogger, ut as projects, vn as readBaseConfig, w as ProjectRepository, x as AdminUserRepository } from "./src-DkvHYM3y.mjs";
-import { extname, join, resolve } from "node:path";
+import { $ as metrics, A as RedisClient, Bt as NotifyRequestSchema, D as UserRepository, E as TemplateRepository, Ft as BatchAddContactsSchema, G as getPriorityBucket, Gt as TriggerWorkflowSchema, It as ContactChannelSchema, J as globalEmitter, K as normaliseTarget, Lt as CreateWorkflowSchema, O as WorkflowRepository, Pt as AddUserSchema, Q as getMetricsRegistry, S as ContactRepository, T as SegmentRepository, Ut as SyncTemplatesSchema, Vt as PreferencesSchema, Z as StreamProducer, Zt as buildStreamEvent, at as createDatabase, ct as messageLogs, dt as scheduledPayloads, ft as suppressions, gn as loadEnv, ht as workflowDefinitions, lt as projectApiKeys, mt as users, nn as PUBSUB_CHANNELS, p as verifyUnsubscribeToken, pt as userTopicPreferences, q as LRUCache, qt as UpdateUserSchema, rn as STREAMS, st as deliveryOutbox, tt as createLogger, ut as projects, vn as readBaseConfig, w as ProjectRepository, x as AdminUserRepository } from "./src-QiTu5e_a.mjs";
+import { extname, isAbsolute, join, relative, resolve } from "node:path";
 import { z } from "zod";
 import { createHash, randomBytes, randomUUID, scrypt, timingSafeEqual } from "node:crypto";
 import { and, desc, eq, gte, inArray, isNotNull, like, lt, lte, or, sql } from "drizzle-orm";
@@ -107,7 +107,12 @@ var Router = class {
 			for (let i = 0; i < route.segments.length; i++) {
 				const seg = route.segments[i];
 				const part = parts[i];
-				if (seg.startsWith(":")) params[seg.slice(1)] = decodeURIComponent(part);
+				if (seg.startsWith(":")) try {
+					params[seg.slice(1)] = decodeURIComponent(part);
+				} catch {
+					ok = false;
+					break;
+				}
 				else if (seg !== part) {
 					ok = false;
 					break;
@@ -130,6 +135,12 @@ const scryptAsync = promisify(scrypt);
 const DEFAULT_SESSION_TTL_SECONDS = 604800;
 const SESSION_PREFIX = "notif:session:";
 /**
+* Pre-computed dummy hash conforming to salt(16 bytes hex):hash(64 bytes hex).
+* Used during authentication failure to equalize execution time and prevent
+* user enumeration via scrypt timing side-channels.
+*/
+const DUMMY_PASSWORD_HASH = "00000000000000000000000000000000:00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";
+/**
 * Hashes a plaintext password using crypto.scrypt with a random 16-byte salt.
 * Returns salt and hash separated by a colon.
 */
@@ -874,7 +885,7 @@ function createHandlers(deps) {
 			DEAD_LETTER: STREAMS.DEAD_LETTER
 		};
 		const streamDepths = {};
-		for (const [key, realRedisKey] of Object.entries(streamMap)) try {
+		if (ctx.isAdmin !== false) for (const [key, realRedisKey] of Object.entries(streamMap)) try {
 			streamDepths[key] = await deps.redis.native.xlen(realRedisKey);
 		} catch {
 			streamDepths[key] = 0;
@@ -892,7 +903,7 @@ function createHandlers(deps) {
 			total = Number(totalTasksRes[0]?.count ?? 0);
 			delivered = Number(deliveredTasksRes[0]?.count ?? 0);
 		}
-		const failed = streamDepths.DEAD_LETTER || 0;
+		const failed = ctx.projectId ? Math.max(0, total - delivered) : streamDepths.DEAD_LETTER || 0;
 		const successRate = total > 0 ? Number((delivered / total * 100).toFixed(2)) : 100;
 		sendJson(res, 200, {
 			streams: streamDepths,
@@ -904,24 +915,33 @@ function createHandlers(deps) {
 			}
 		});
 	}
-	async function getDLQMessages(_req, res, _ctx) {
+	async function getDLQMessages(_req, res, ctx) {
 		try {
-			sendJson(res, 200, { messages: (await deps.redis.native.xrevrange(STREAMS.DEAD_LETTER, "+", "-", "COUNT", "50") || []).map(([id, fields]) => {
+			const allMessages = (await deps.redis.native.xrevrange(STREAMS.DEAD_LETTER, "+", "-", "COUNT", "100") || []).map(([id, fields]) => {
 				const fieldMap = {};
 				for (let i = 0; i < fields.length; i += 2) fieldMap[fields[i]] = fields[i + 1];
+				let payload = fieldMap;
+				if (fieldMap.payload) try {
+					payload = JSON.parse(fieldMap.payload);
+				} catch {
+					payload = fieldMap.payload;
+				}
 				return {
 					id,
 					eventType: fieldMap.eventType || fieldMap.event_type || "unknown",
-					payload: fieldMap.payload ? JSON.parse(fieldMap.payload) : fieldMap,
+					payload,
 					error: fieldMap.error || fieldMap.reason || "Dead letter payload",
 					timestamp: fieldMap.timestamp || (/* @__PURE__ */ new Date()).toISOString()
 				};
-			}) });
+			});
+			sendJson(res, 200, { messages: (ctx.projectId ? allMessages.filter((m) => {
+				return (m.payload?.projectId ?? m.payload?.project_id ?? m.projectId) === ctx.projectId;
+			}) : allMessages).slice(0, 50) });
 		} catch {
 			sendJson(res, 200, { messages: [] });
 		}
 	}
-	async function replayDLQMessage(req, res, _ctx) {
+	async function replayDLQMessage(req, res, ctx) {
 		const messageId = (await readJsonBody(req).catch(() => ({})))?.id;
 		if (!messageId) {
 			sendJson(res, 400, { error: "missing_message_id" });
@@ -936,6 +956,16 @@ function createHandlers(deps) {
 			const fields = rawEntries[0][1];
 			const fieldMap = {};
 			for (let i = 0; i < fields.length; i += 2) fieldMap[fields[i]] = fields[i + 1];
+			let payload = null;
+			if (fieldMap.payload) try {
+				payload = JSON.parse(fieldMap.payload);
+			} catch {}
+			if (ctx.projectId) {
+				if ((payload?.projectId ?? payload?.project_id ?? fieldMap.projectId) !== ctx.projectId) {
+					sendJson(res, 404, { error: "dlq_message_not_found" });
+					return;
+				}
+			}
 			const priority = fieldMap.priority || "normal";
 			const p = getPriorityBucket(priority);
 			const targetStream = STREAMS[`INBOUND_${p.toUpperCase()}`] || STREAMS.INBOUND_NORMAL;
@@ -958,6 +988,24 @@ function createHandlers(deps) {
 		const messageId = ctx.params.id;
 		if (!messageId) return sendJson(res, 400, { error: "missing_id" });
 		try {
+			if (ctx.projectId) {
+				const rawEntries = await deps.redis.native.xrange(STREAMS.DEAD_LETTER, messageId, messageId);
+				if (!rawEntries || rawEntries.length === 0 || !rawEntries[0]) {
+					sendJson(res, 404, { error: "dlq_message_not_found" });
+					return;
+				}
+				const fields = rawEntries[0][1];
+				const fieldMap = {};
+				for (let i = 0; i < fields.length; i += 2) fieldMap[fields[i]] = fields[i + 1];
+				let payload = null;
+				if (fieldMap.payload) try {
+					payload = JSON.parse(fieldMap.payload);
+				} catch {}
+				if ((payload?.projectId ?? payload?.project_id ?? fieldMap.projectId) !== ctx.projectId) {
+					sendJson(res, 404, { error: "dlq_message_not_found" });
+					return;
+				}
+			}
 			await deps.redis.native.xdel(STREAMS.DEAD_LETTER, messageId);
 			sendJson(res, 200, { success: true });
 		} catch (err) {
@@ -991,7 +1039,13 @@ function createHandlers(deps) {
 			id: userId
 		});
 		const contacts = await deps.contactRepo.findByUserId(ctx.projectId, userId);
-		const logs = await deps.db.select().from(messageLogs).where(eq(messageLogs.projectId, ctx.projectId)).orderBy(desc(messageLogs.timestamp)).limit(50);
+		const contactTargets = contacts.map((c) => c.target);
+		let logs = [];
+		if (contactTargets.length > 0) {
+			const outboxRows = await deps.db.select({ taskId: deliveryOutbox.taskId }).from(deliveryOutbox).where(inArray(deliveryOutbox.destination, contactTargets));
+			const taskIds = Array.from(new Set(outboxRows.map((r) => r.taskId)));
+			if (taskIds.length > 0) logs = await deps.db.select().from(messageLogs).where(and(eq(messageLogs.projectId, ctx.projectId), inArray(messageLogs.taskId, taskIds))).orderBy(desc(messageLogs.timestamp)).limit(50);
+		}
 		sendJson(res, 200, {
 			...user,
 			contacts,
@@ -1229,7 +1283,7 @@ code{background:#f4f4f5;padding:.1rem .35rem;border-radius:4px}</style>
 	async function deleteSuppression(_req, res, ctx) {
 		const { channel, target } = ctx.params;
 		if (!channel || !target) return sendJson(res, 400, { error: "missing_channel_or_target" });
-		await deps.db.delete(suppressions).where(and(eq(suppressions.projectId, ctx.projectId), eq(suppressions.channel, channel), eq(suppressions.target, normaliseTarget(decodeURIComponent(target)))));
+		await deps.db.delete(suppressions).where(and(eq(suppressions.projectId, ctx.projectId), eq(suppressions.channel, channel), eq(suppressions.target, normaliseTarget(target))));
 		sendNoContent(res);
 	}
 	async function login(req, res) {
@@ -1251,14 +1305,8 @@ code{background:#f4f4f5;padding:.1rem .35rem;border-radius:4px}</style>
 		}
 		const { identifier, password } = parsed.data;
 		const user = await deps.adminUserRepo.findByEmailOrUsername(identifier);
-		if (!user) {
-			sendJson(res, 401, {
-				error: "unauthorized",
-				message: "Invalid credentials"
-			});
-			return;
-		}
-		if (!await verifyPassword(password, user.passwordHash)) {
+		const isValid = await verifyPassword(password, user ? user.passwordHash : DUMMY_PASSWORD_HASH);
+		if (!user || !isValid) {
 			sendJson(res, 401, {
 				error: "unauthorized",
 				message: "Invalid credentials"
@@ -1467,7 +1515,8 @@ async function handleAdminRequest(req, res, url) {
 	if (!subPath) subPath = "index.html";
 	const normalizedSubPath = subPath.replace(/\/$/, "");
 	let filePath = resolve(dashboardDir, subPath);
-	if (!filePath.startsWith(dashboardDir)) {
+	const rel = relative(dashboardDir, filePath);
+	if (rel.startsWith("..") || isAbsolute(rel)) {
 		res.writeHead(403, { "Content-Type": "text/plain" });
 		res.end("Forbidden");
 		return true;
@@ -1537,6 +1586,19 @@ function extractAuthToken(req) {
 	const apiKeyHeader = req.headers["x-api-key"];
 	if (typeof apiKeyHeader === "string") return apiKeyHeader.trim();
 }
+/**
+* Resolves client IP address, respecting reverse proxy headers only when TRUST_PROXY is enabled.
+*/
+function getClientIp(req, trustProxy) {
+	if (trustProxy) {
+		const forwarded = req.headers["x-forwarded-for"];
+		if (typeof forwarded === "string") {
+			const first = forwarded.split(",")[0]?.trim();
+			if (first) return first;
+		}
+	}
+	return req.socket.remoteAddress || "unknown";
+}
 async function handleCreateProject(req, res) {
 	const parsed = z.object({ name: z.string().min(1) }).safeParse(await readJsonBody(req));
 	if (!parsed.success) {
@@ -1614,7 +1676,28 @@ async function handleHealth(_req, res) {
 	};
 	sendJson(res, statusCode, response);
 }
-async function handleMetrics(_req, res) {
+async function handleMetrics(req, res) {
+	const remoteIp = req.socket.remoteAddress ?? "";
+	let authorized = remoteIp === "127.0.0.1" || remoteIp === "::1" || remoteIp === "::ffff:127.0.0.1" || remoteIp === "localhost";
+	if (!authorized) {
+		const token = extractAuthToken(req);
+		if (token) {
+			if (token.startsWith("nk_sess_") && redis?.native) {
+				if (await getAdminSession(redis.native, token)) authorized = true;
+			} else if (config.ADMIN_API_KEY) {
+				const expectedBuffer = Buffer.from(config.ADMIN_API_KEY);
+				const providedBuffer = Buffer.from(token);
+				if (expectedBuffer.length === providedBuffer.length && timingSafeEqual(expectedBuffer, providedBuffer)) authorized = true;
+			}
+		}
+	}
+	if (!authorized) {
+		sendJson(res, 401, {
+			error: "unauthorized",
+			message: "Metrics endpoint requires admin credentials"
+		});
+		return;
+	}
 	const registry = getMetricsRegistry();
 	res.writeHead(200, { "Content-Type": registry.contentType });
 	res.end(await registry.metrics());
@@ -1645,6 +1728,10 @@ async function startApiServer() {
 		name: "api",
 		level: config.LOG_LEVEL
 	});
+	if (config.NODE_ENV === "production" && !config.UNSUBSCRIBE_SECRET) {
+		logger.fatal("UNSUBSCRIBE_SECRET is required in production. Without it, all unsubscribe links return 400 and opt-outs are silently dropped. Set a random string of 32+ characters and restart.");
+		process.exit(1);
+	}
 	redis = new RedisClient({
 		url: config.REDIS_URL,
 		name: "api",
@@ -1722,7 +1809,15 @@ async function startApiServer() {
 	server.headersTimeout = 1e4;
 	server.keepAliveTimeout = 5e3;
 	async function handleRequest(req, res) {
-		res.setHeader("Access-Control-Allow-Origin", "*");
+		const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+		const origin = req.headers["origin"];
+		const allowedOrigins = (config.CORS_ORIGIN ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+		if (url.pathname.startsWith("/v1/auth/") || url.pathname === "/v1/projects" || url.pathname.startsWith("/v1/projects/") || url.pathname.startsWith("/v1/system/") || url.pathname.startsWith("/v1/dlq")) {
+			if (origin && allowedOrigins.includes(origin)) {
+				res.setHeader("Access-Control-Allow-Origin", origin);
+				res.setHeader("Vary", "Origin");
+			}
+		} else res.setHeader("Access-Control-Allow-Origin", "*");
 		res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
 		res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, x-api-key, x-project-id");
 		if (req.method === "OPTIONS") {
@@ -1730,13 +1825,13 @@ async function startApiServer() {
 			res.end();
 			return;
 		}
-		const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
 		if (url.pathname === "/admin" || url.pathname.startsWith("/admin/")) {
 			if (await handleAdminRequest(req, res, url)) return;
 		}
 		let projectId = void 0;
 		let projectRateLimitRpm = 600;
 		let keyRole = "admin";
+		let isAdminToken = false;
 		const isProjectManagement = url.pathname === "/v1/projects" || url.pathname.startsWith("/v1/projects/");
 		const isPublicUnsubscribe = url.pathname === "/v1/unsubscribe";
 		const isPublicAuth = url.pathname === "/v1/auth/login";
@@ -1750,7 +1845,6 @@ async function startApiServer() {
 				});
 				return;
 			}
-			let isAdminToken = false;
 			if (token.startsWith("nk_sess_")) {
 				const session = await getAdminSession(redis.native, token);
 				if (session) {
@@ -1862,9 +1956,10 @@ async function startApiServer() {
 				});
 				return;
 			}
+			isAdminToken = true;
 		}
 		if (isPublicUnsubscribe) {
-			const clientIp = req.headers["x-forwarded-for"]?.split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+			const clientIp = getClientIp(req, Boolean(config.TRUST_PROXY));
 			try {
 				const key = `rate-limit:api:unsub:${clientIp}`;
 				const count = await redis.native.incr(key);
@@ -1878,6 +1973,24 @@ async function startApiServer() {
 				logger.warn({ err }, "unsubscribe rate limit unavailable — allowing request");
 			}
 		}
+		if (isPublicAuth) {
+			const clientIp = getClientIp(req, Boolean(config.TRUST_PROXY));
+			try {
+				const key = `rate-limit:api:auth:${clientIp}`;
+				const count = await redis.native.incr(key);
+				if (count === 1) await redis.native.expire(key, 60);
+				if (count > 10) {
+					res.setHeader("Retry-After", "60");
+					sendJson(res, 429, {
+						error: "too_many_requests",
+						message: "Too many login attempts. Please try again later."
+					});
+					return;
+				}
+			} catch (err) {
+				logger.warn({ err }, "auth rate limit unavailable — allowing request");
+			}
+		}
 		const route = router.match(req.method ?? "GET", url.pathname);
 		if (!route) {
 			sendJson(res, 404, { error: "not_found" });
@@ -1887,7 +2000,8 @@ async function startApiServer() {
 			params: route.params,
 			query: url.searchParams,
 			projectId,
-			role: keyRole
+			role: keyRole,
+			isAdmin: isAdminToken
 		};
 		Promise.resolve(route.handler(req, res, ctx)).catch((err) => {
 			if (err instanceof HttpError) {
@@ -2069,4 +2183,4 @@ async function stopApiServer() {
 //#endregion
 export { startApiServer, stopApiServer };
 
-//# sourceMappingURL=main-BAO4kKce.mjs.map
+//# sourceMappingURL=main-39DtKrX4.mjs.map