mirror of
https://github.com/saltbo/zpan.git
synced 2026-10-31 02:41:33 +08:00
* fix(downloads): block SSRF targets in remote-download source URL The remote-download source URI was only length-validated, so an authenticated editor could point a task at the cloud metadata endpoint, loopback, or RFC 1918 hosts and have the response exfiltrated to their own drive. Add a shared isSafeHttpUrl/isBlockedUrlHost guard (scheme allowlist + private/loopback/link-local/metadata/IPv6 blocking) and cross-check source type vs uri in createDownloadTaskSchema. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(api): cover 9 untested src/lib/api.ts wrappers Adds api.test.ts coverage (RPC path, method, payload, success + ApiError paths) for listObjectsByPath, isNameConflictError, listAdminAuthProviders, upsertAuthProvider, deleteAuthProvider, listInviteCodes, generateInviteCodes, deleteInviteCode, and listTeamActivities — satisfying the CLAUDE.md coverage gate that otherwise blocks PRs touching api.ts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(spaces): release source quota on cross-space move A cross-space "move" copied bytes into the target (reserving quota there) but only trashed the source. Trashed files still count toward usage, so the moved bytes were billed in both spaces and the source never freed — contrary to the design doc ("copy + delete source, quota effectively transfers"). Purge the source subtree (independent S3 copy already exists in the target) instead of trashing it, which deletes the objects, cascades share cleanup, and reconciles usage. Rename the response field sourceTrashed -> sourceDeleted and update the move hint copy accordingly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(upload): wire S3 multipart for large files The upload UI only ever did a single presigned PUT, which caps at S3's 5 GiB limit and fails the whole transfer on any network blip — despite a complete multipart backend (object-upload-sessions) sitting unused. Add uploadPartToS3 (PUTs a part, returns its ETag) and a multipart-upload orchestrator: open session -> presign parts in batches of 100 -> PUT parts with bounded concurrency and per-part retry -> complete. Files over 100 MiB take this path; smaller files keep the single-PUT flow. Cancellation aborts the multipart and the draft. Also fixes the presignObjectUploadParts wrapper type to match the server's actual `url` field. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(auth): add password-reset flow There was no self-service password recovery — a forgotten password needed admin intervention. SMTP/email sending was already built; this wires the last mile: better-auth sendResetPassword (reset email), a "Forgot password?" link on sign-in, and /forgot-password + /reset-password pages. The forgot-password page never reveals whether an account exists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(trash): auto-purge trashed items past a retention window Trashed files counted toward quota forever — trash never auto-emptied, so storage was never reclaimed without a manual "empty trash". Add a daily cron (CF Workers 0 4 * * * + Node setInterval) that purges trashed items older than ZPAN_TRASH_RETENTION_DAYS (default 30, 0 disables) across all orgs, reusing the existing purge path so S3 objects, share references, and quota are all cleaned. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(notifications): typed NotificationType, i18n rendering, team-join Notifications were a bare-string type with only 3 producers, and server copy was stored as hardcoded English (zh users saw English). - Add a NotificationType union in shared/ and type the notification service. - Render notification title/body client-side from type + metadata via i18n, falling back to stored strings for older rows (fixes the hardcoded-English gap). - Notify users when they join a team (team_join). (Login auditing was intentionally dropped: reusing the activity-events feed for sign_in events would spam every user's per-org activity timeline. Proper auth auditing belongs in a dedicated log and can be added separately.) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: cover SSRF guard and multipart upload branches Raise patch coverage on the new code: uploadPartToS3 pre-aborted-signal and network-error paths, the url-safety octet-overflow and public-IPv6 branches, and the invalid-magnet rejection in the download-task schema. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
156 lines
6.2 KiB
TypeScript
156 lines
6.2 KiB
TypeScript
import { existsSync } from 'node:fs'
|
|
import { release as osRelease } from 'node:os'
|
|
import { serve } from '@hono/node-server'
|
|
import { serveStatic } from '@hono/node-server/serve-static'
|
|
import { Hono } from 'hono'
|
|
import { resolveAppCommit, resolveAppVersion } from '../scripts/app-version.mjs'
|
|
import { ZPAN_CLOUD_URL_DEFAULT } from '../shared/constants'
|
|
import { createBootstrap } from './bootstrap'
|
|
import { buildCloudInstanceInfo, runtimeInfo } from './licensing/instance-info'
|
|
import { createLibsqlPlatform } from './platform/libsql'
|
|
import { createNodePlatform } from './platform/node'
|
|
import { type DeployPlatform, setDeployPlatform } from './runtime-platform'
|
|
import { syncPendingCloudTrafficReports } from './services/cloud-traffic-metering'
|
|
import { resetExpiredTrafficQuotas } from './services/effective-quota'
|
|
import { INSTANCE_TELEMETRY_CRON, reportInstanceTelemetry } from './services/instance-telemetry'
|
|
import { runLicensingRefresh } from './services/licensing-refresh-runner'
|
|
import { syncPendingRemoteDownloadUsageReports } from './services/remote-download-usage'
|
|
import { getSitePublicOrigin } from './services/site-public-origin'
|
|
import { purgeExpiredTrash, resolveTrashRetentionDays } from './services/trash-retention'
|
|
|
|
const REFRESH_INTERVAL_MS = 6 * 60 * 60 * 1000 // 6 hours
|
|
const TRAFFIC_SYNC_INTERVAL_MS = 10 * 60 * 1000 // 10 minutes
|
|
const INSTANCE_TELEMETRY_INTERVAL_MS = 12 * 60 * 60 * 1000 // 12 hours
|
|
const QUOTA_RESET_INTERVAL_MS = 24 * 60 * 60 * 1000 // daily; idempotent, resets only stale periods
|
|
const TRASH_PURGE_INTERVAL_MS = 24 * 60 * 60 * 1000 // daily; purges trash past the retention window
|
|
const appVersionGlobalKey = '__ZPAN_APP_VERSION__'
|
|
const appCommitGlobalKey = '__ZPAN_APP_COMMIT__'
|
|
|
|
// tsx runs this entry directly (dev + E2E) without the tsup build-time define,
|
|
// so resolve the version at runtime. In the built output the define inlines the
|
|
// constant, turning this condition into `if (false)`, so resolveAppVersion is
|
|
// never reached and git is never invoked in production. The assignment uses
|
|
// bracket access so the define does not rewrite it into an invalid literal LHS.
|
|
if (!globalThis.__ZPAN_APP_VERSION__) {
|
|
globalThis[appVersionGlobalKey] = resolveAppVersion()
|
|
}
|
|
if (globalThis.__ZPAN_APP_COMMIT__ === undefined) {
|
|
globalThis[appCommitGlobalKey] = resolveAppCommit()
|
|
}
|
|
|
|
// The Node entry serves Cloud Run, Docker, and bare Node. Cloud Run sets
|
|
// K_SERVICE; the Docker image sets ZPAN_RUNTIME=docker (falling back to the
|
|
// /.dockerenv marker); otherwise it is plain Node.
|
|
function detectNodePlatform(): DeployPlatform {
|
|
if (process.env.K_SERVICE) return 'cloud-run'
|
|
if (process.env.ZPAN_RUNTIME === 'docker' || existsSync('/.dockerenv')) return 'docker'
|
|
return 'node'
|
|
}
|
|
setDeployPlatform(detectNodePlatform())
|
|
|
|
const platform = process.env.TURSO_DATABASE_URL
|
|
? await createLibsqlPlatform({
|
|
TURSO_DATABASE_URL: process.env.TURSO_DATABASE_URL,
|
|
TURSO_AUTH_TOKEN: process.env.TURSO_AUTH_TOKEN,
|
|
})
|
|
: createNodePlatform()
|
|
|
|
const app = await createBootstrap(platform)
|
|
|
|
const server = new Hono()
|
|
server.route('/', app)
|
|
server.use('/*', serveStatic({ root: './dist' }))
|
|
server.get('/*', serveStatic({ root: './dist', path: 'index.html' }))
|
|
|
|
const port = Number(process.env.PORT) || 8222
|
|
console.log(`ZPan server running on http://localhost:${port}`)
|
|
serve({ fetch: server.fetch, port })
|
|
|
|
// Start licensing refresh background scheduler
|
|
const cloudBaseUrl = process.env.ZPAN_CLOUD_URL ?? ZPAN_CLOUD_URL_DEFAULT
|
|
|
|
function envAllowsIp(value: string | undefined): boolean {
|
|
return !['0', 'false', 'no', 'off'].includes(value?.trim().toLowerCase() ?? '')
|
|
}
|
|
|
|
function isGitHubActionsE2E(): boolean {
|
|
return process.env.GITHUB_ACTIONS === 'true' && process.env.BETTER_AUTH_URL === 'http://localhost:5185'
|
|
}
|
|
|
|
console.log('licensing.refresh.scheduler.started interval=6h')
|
|
setInterval(() => {
|
|
// runLicensingRefresh handles all errors internally and never rejects.
|
|
void (async () => {
|
|
const instanceUrl = await getSitePublicOrigin(platform.db)
|
|
const instance = instanceUrl
|
|
? await buildCloudInstanceInfo(platform.db, {
|
|
url: instanceUrl,
|
|
runtime: runtimeInfo(platform),
|
|
})
|
|
: undefined
|
|
await runLicensingRefresh(platform.db, cloudBaseUrl, instance)
|
|
})()
|
|
}, REFRESH_INTERVAL_MS)
|
|
|
|
console.log('traffic.sync.scheduler.started interval=10m')
|
|
setInterval(() => {
|
|
void syncPendingCloudTrafficReports({ db: platform.db, cloudBaseUrl })
|
|
void syncPendingRemoteDownloadUsageReports({ db: platform.db, cloudBaseUrl })
|
|
}, TRAFFIC_SYNC_INTERVAL_MS)
|
|
|
|
function reportNodeInstanceTelemetry(): void {
|
|
if (isGitHubActionsE2E()) return
|
|
|
|
void (async () => {
|
|
try {
|
|
await reportInstanceTelemetry({
|
|
db: platform.db,
|
|
config: {
|
|
allowIp: envAllowsIp(process.env.ZPAN_TELEMETRY_ALLOW_IP),
|
|
},
|
|
cron: INSTANCE_TELEMETRY_CRON,
|
|
trigger: 'runtime',
|
|
runtime: {
|
|
runtime: 'node',
|
|
platform: detectNodePlatform(),
|
|
osPlatform: process.platform,
|
|
osArch: process.arch,
|
|
osRelease: osRelease(),
|
|
nodeVersion: process.version,
|
|
},
|
|
})
|
|
} catch (err) {
|
|
const code = err instanceof Error ? err.message : String(err)
|
|
console.error(`instance.telemetry.error code=${code}`)
|
|
}
|
|
})()
|
|
}
|
|
|
|
console.log('instance.telemetry.scheduler.started interval=12h')
|
|
reportNodeInstanceTelemetry()
|
|
setInterval(reportNodeInstanceTelemetry, INSTANCE_TELEMETRY_INTERVAL_MS)
|
|
|
|
console.log('quota.reset.scheduler.started interval=24h')
|
|
// Run once at boot to catch a month boundary crossed while the server was down.
|
|
void resetExpiredTrafficQuotas(platform.db)
|
|
setInterval(() => {
|
|
void resetExpiredTrafficQuotas(platform.db)
|
|
}, QUOTA_RESET_INTERVAL_MS)
|
|
|
|
console.log('trash.purge.scheduler.started interval=24h')
|
|
function purgeExpiredTrashJob(): void {
|
|
void (async () => {
|
|
try {
|
|
const purged = await purgeExpiredTrash(
|
|
platform.db,
|
|
resolveTrashRetentionDays(process.env.ZPAN_TRASH_RETENTION_DAYS),
|
|
)
|
|
if (purged > 0) console.log(`trash.purge.done count=${purged}`)
|
|
} catch (err) {
|
|
console.error(`trash.purge.error code=${err instanceof Error ? err.message : String(err)}`)
|
|
}
|
|
})()
|
|
}
|
|
purgeExpiredTrashJob()
|
|
setInterval(purgeExpiredTrashJob, TRASH_PURGE_INTERVAL_MS)
|