Fehler melden mit Screenshot und Markierung, Sammlung für Bearbeiter
Käfer-Button unten rechts: nimmt den sichtbaren Bildschirm mit html2canvas (selbst gehostet) auf, Vorschau mit roten Rechtecken, Beschreibung, Name optional, Senden ohne Anmeldung. Aus offenen Dialogen heraus wird der Dialog selbst aufgenommen. Bearbeiter sehen die Meldungen unter „Fehler" mit Zähler, kopieren einen fertigen Claude-Prompt und den Screenshot. Serverseitig: Pfade nur in exakter Schreibweise, /api standardmäßig nur für Bearbeiter mit ausdrücklicher Freigabeliste, Bremse zählt jeden Versuch vor dem Lesen großer Bodies, X-Forwarded-For nur von vertrauten Proxys, Nutzertext im Prompt eingezäunt. HTTP-Tests für die Sperren. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
ferdi2goandClaude Fable 5.1 committed
1 parent
6a3c68aaac
commit
4ec23ccd25
15 files changed
+877
-36
No files matched your search
+138
-15
@@ -1,12 +1,14 @@
|
||||
import express from 'express';
|
||||
import path from 'node:path';
|
||||
import { randomUUID, timingSafeEqual } from 'node:crypto';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
import { execSync } from 'node:child_process';
|
||||
import { fileURLToPath, pathToFileURL } from 'node:url';
|
||||
import { loadEnvFile } from './env.js';
|
||||
import { createStore, imageMime } from './store.js';
|
||||
import { looksLikePlaceholder } from './image.js';
|
||||
import { createAuth, readCookie, cookieHeader } from './auth.js';
|
||||
import { validateRequest, applySwap, REQUEST_STATUS } from './requests.js';
|
||||
import { parseScreenshot, buildPrompt, BUG_STATUS, DEFAULT_PROMPT_TEMPLATE } from './bugs.js';
|
||||
import { workingDays, generateSchedule, isValidDate, countAssignments, addDays } from './scheduler.js';
|
||||
import { germanHolidays, BUNDESLAENDER } from './holidays.js';
|
||||
import { buildEventLines, buildCalendar, eventUid } from './ics.js';
|
||||
@@ -24,9 +26,21 @@ if (String(process.env.NEXTCLOUD_INSECURE_TLS).toLowerCase() === 'true') {
|
||||
console.warn('Warnung: TLS-Zertifikate werden nicht geprüft (NEXTCLOUD_INSECURE_TLS=true).');
|
||||
}
|
||||
|
||||
const app = express();
|
||||
// Versionskennung für Fehlermeldungen: Commit aus Umgebung oder Git, sonst unbekannt
|
||||
let appVersion = (process.env.VCH_COMMIT || process.env.APP_VERSION || '').trim();
|
||||
if (!appVersion) {
|
||||
try { appVersion = execSync('git rev-parse --short HEAD', { cwd: path.join(__dirname, '..'), stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim(); } catch { appVersion = 'unbekannt'; }
|
||||
}
|
||||
|
||||
export const app = express();
|
||||
app.disable('x-powered-by');
|
||||
app.set('etag', false);
|
||||
// Pfade nur in exakter Schreibweise zuordnen – sonst liefe /API/… an der Bearbeitungssperre vorbei
|
||||
app.set('case sensitive routing', true);
|
||||
// Welche Proxys dürfen X-Forwarded-For setzen? Leer = nur localhost, "none" = keiner, sonst Adressen/Netze
|
||||
const trustedProxy = (process.env.TRUSTED_PROXY || '').trim();
|
||||
app.set('trust proxy', trustedProxy === '' ? 'loopback' : trustedProxy === 'none' ? false : trustedProxy.split(',').map((x) => x.trim()));
|
||||
const clientIp = (req) => req.ip || req.socket?.remoteAddress || '?';
|
||||
|
||||
// Healthcheck ohne Passwort, damit die Plattform den Prüfling erreichen kann
|
||||
app.get('/health', (req, res) => res.type('text/plain').send('ok'));
|
||||
@@ -45,25 +59,45 @@ if (appPassword) {
|
||||
});
|
||||
}
|
||||
|
||||
app.use(express.json({ limit: '1mb' }));
|
||||
const jsonBody = express.json({ limit: '1mb' });
|
||||
const bigJsonBody = express.json({ limit: '9mb' }); // Fehlermeldung mit Screenshot (6 MB Bild als Base64)
|
||||
|
||||
// Bremse für Fehlermeldungen: jeder Versuch zählt, auch ein später abgelehnter – und zwar bevor der große Body gelesen wird
|
||||
const bugHits = new Map(); // ip → [{ t, bytes }]
|
||||
const BUG_WINDOW_MS = 3_600_000;
|
||||
const BUG_MAX_PER_HOUR = 10;
|
||||
const BUG_MAX_BYTES_PER_HOUR = 30 * 1024 * 1024;
|
||||
function bugLimited(req) {
|
||||
const ip = clientIp(req);
|
||||
const now = Date.now();
|
||||
const hits = (bugHits.get(ip) || []).filter((h) => now - h.t < BUG_WINDOW_MS);
|
||||
const declared = Number(req.headers['content-length']) || 0;
|
||||
const bytes = hits.reduce((n, h) => n + h.bytes, 0);
|
||||
bugHits.set(ip, hits);
|
||||
if (hits.length >= BUG_MAX_PER_HOUR || bytes + declared > BUG_MAX_BYTES_PER_HOUR) return true;
|
||||
hits.push({ t: now, bytes: declared });
|
||||
return false;
|
||||
}
|
||||
app.use((req, res, next) => {
|
||||
if (req.method !== 'POST' || req.path !== '/api/bugs') return jsonBody(req, res, next);
|
||||
if (bugLimited(req)) return res.status(429).json({ error: 'Zu viele Meldungen in kurzer Zeit. Bitte später noch einmal.' });
|
||||
return bigJsonBody(req, res, next);
|
||||
});
|
||||
app.use(express.static(path.join(__dirname, '..', 'public')));
|
||||
|
||||
// ---------- Bearbeitungsschutz ----------
|
||||
// Ohne EDIT_PASSWORD darf jeder alles (wie bisher). Mit Passwort sehen Betrachter nur den Kalender.
|
||||
const auth = createAuth({ password: process.env.EDIT_PASSWORD, secretFile: path.join(dataDir, 'session-secret') });
|
||||
const clientIp = (req) => (req.headers['x-forwarded-for'] || '').split(',')[0].trim() || req.socket.remoteAddress || '?';
|
||||
const isSecure = (req) => req.secure || req.headers['x-forwarded-proto'] === 'https';
|
||||
app.use((req, res, next) => {
|
||||
req.isEditor = !auth.enabled || auth.verify(readCookie(req.headers.cookie));
|
||||
next();
|
||||
});
|
||||
const needsEditor = (req) => {
|
||||
if (!req.path.startsWith('/api/')) return false;
|
||||
if (req.path.startsWith('/api/auth')) return false;
|
||||
if (req.method === 'POST' && req.path === '/api/requests') return false; // Tauschanfragen dürfen alle stellen
|
||||
if (req.method !== 'GET' && req.method !== 'HEAD') return true;
|
||||
return req.path.startsWith('/api/nextcloud/') || req.path.startsWith('/api/persons/placeholder');
|
||||
};
|
||||
// Alles unter /api ist für Bearbeiter – außer dieser ausdrücklichen Liste
|
||||
const PUBLIC_API = (method, p) => p === '/api/auth' || p.startsWith('/api/auth/')
|
||||
|| (method === 'POST' && (p === '/api/requests' || p === '/api/bugs')) // Tauschanfragen und Fehlermeldungen darf jeder stellen
|
||||
|| ((method === 'GET' || method === 'HEAD') && (p === '/api/state' || p === '/api/stats' || p === '/api/export.ics'));
|
||||
const needsEditor = (req) => req.path.startsWith('/api/') && !PUBLIC_API(req.method, req.path);
|
||||
app.use((req, res, next) => {
|
||||
if (needsEditor(req) && !req.isEditor) return res.status(403).json({ error: 'Anmeldung erforderlich.', authRequired: true });
|
||||
next();
|
||||
@@ -138,6 +172,7 @@ app.get('/api/state', (req, res) => {
|
||||
assignments: st.assignments,
|
||||
requestDates: [...new Set(st.requests.filter((r) => r.status === 'offen').map((r) => r.date))],
|
||||
exported: {},
|
||||
version: appVersion,
|
||||
settings: { meetingTime: st.settings.meetingTime, durationMinutes: st.settings.durationMinutes },
|
||||
bundeslaender: BUNDESLAENDER,
|
||||
absenceTypes: ABSENCE_TYPES,
|
||||
@@ -152,6 +187,8 @@ app.get('/api/state', (req, res) => {
|
||||
assignments: st.assignments,
|
||||
requests: st.requests,
|
||||
requestDates: [...new Set(st.requests.filter((r) => r.status === 'offen').map((r) => r.date))],
|
||||
bugs: st.bugs,
|
||||
version: appVersion,
|
||||
exported: st.exported,
|
||||
settings: st.settings,
|
||||
bundeslaender: BUNDESLAENDER,
|
||||
@@ -347,6 +384,7 @@ app.put('/api/settings', (req, res) => {
|
||||
if (!Number.isInteger(d) || d < 0 || d > 365) return bad(res, 'Fairness-Fenster zwischen 0 und 365 Tagen.');
|
||||
s.historyWindowDays = d;
|
||||
}
|
||||
if (b.bugPromptTemplate !== undefined) s.bugPromptTemplate = clean(b.bugPromptTemplate, 4000) || DEFAULT_PROMPT_TEMPLATE;
|
||||
for (const key of ['targetCalendarHref', 'absenceCalendarHref']) {
|
||||
if (b[key] === undefined) continue;
|
||||
const href = clean(b[key], 500);
|
||||
@@ -515,6 +553,87 @@ app.delete('/api/requests/:id', (req, res) => {
|
||||
res.status(204).end();
|
||||
});
|
||||
|
||||
// ---------- Fehlermeldungen ----------
|
||||
const bugMeta = (b) => b;
|
||||
app.post('/api/bugs', (req, res) => {
|
||||
const st = S();
|
||||
if (st.bugs.filter((b) => b.status === 'offen').length >= 500) return res.status(409).json({ error: 'Zu viele offene Meldungen. Bitte die Planung direkt ansprechen.' });
|
||||
const b = req.body || {};
|
||||
const text = clean(b.text, 2000);
|
||||
if (!text) return bad(res, 'Bitte beschreibe kurz, was falsch läuft.');
|
||||
let screenshot = null;
|
||||
try { screenshot = parseScreenshot(b.screenshot); } catch (err) { return bad(res, err.message); }
|
||||
const bug = {
|
||||
id: randomUUID(),
|
||||
createdAt: new Date().toISOString(),
|
||||
text,
|
||||
reporter: clean(b.reporter, 80),
|
||||
page: clean(b.page, 120),
|
||||
url: clean(b.url, 500),
|
||||
viewport: clean(b.viewport, 40),
|
||||
userAgent: clean(b.userAgent, 300),
|
||||
version: appVersion,
|
||||
status: 'offen',
|
||||
resolvedAt: null,
|
||||
hasScreenshot: Boolean(screenshot),
|
||||
};
|
||||
if (screenshot) {
|
||||
store.saveBug(bug.id, screenshot);
|
||||
// Ohne Content-Length (gestückelter Body) die echte Größe nachtragen
|
||||
const hits = bugHits.get(clientIp(req)) || [];
|
||||
const last = hits[hits.length - 1];
|
||||
if (last && last.bytes === 0) last.bytes = screenshot.length;
|
||||
}
|
||||
st.bugs.push(bug);
|
||||
store.save();
|
||||
res.status(201).json({ id: bug.id });
|
||||
});
|
||||
|
||||
const findBug = (req, res) => {
|
||||
const bug = S().bugs.find((x) => x.id === req.params.id);
|
||||
if (!bug) res.status(404).json({ error: 'Meldung nicht gefunden.' });
|
||||
return bug;
|
||||
};
|
||||
|
||||
app.get('/api/bugs/:id/prompt', (req, res) => {
|
||||
const bug = findBug(req, res);
|
||||
if (!bug) return;
|
||||
res.type('text/plain; charset=utf-8').send(buildPrompt(S().settings.bugPromptTemplate, bug, { version: bug.version || appVersion }));
|
||||
});
|
||||
|
||||
app.put('/api/bugs/:id', (req, res) => {
|
||||
const bug = findBug(req, res);
|
||||
if (!bug) return;
|
||||
const status = String(req.body?.status || '');
|
||||
if (!BUG_STATUS.includes(status)) return bad(res, 'Unbekannter Status.');
|
||||
bug.status = status;
|
||||
bug.resolvedAt = status === 'offen' ? null : new Date().toISOString();
|
||||
store.save();
|
||||
res.json(bugMeta(bug));
|
||||
});
|
||||
|
||||
app.delete('/api/bugs/:id', (req, res) => {
|
||||
const st = S();
|
||||
const bug = findBug(req, res);
|
||||
if (!bug) return;
|
||||
st.bugs = st.bugs.filter((x) => x.id !== bug.id);
|
||||
store.deleteBug(bug.id);
|
||||
store.save();
|
||||
res.status(204).end();
|
||||
});
|
||||
|
||||
/** Screenshots nur für Bearbeiter – sie zeigen Namen und Planung. */
|
||||
app.get('/bugs/:id.png', (req, res) => {
|
||||
if (!req.isEditor) return res.status(403).type('text/plain').send('Anmeldung erforderlich.');
|
||||
const id = String(req.params.id);
|
||||
if (!/^[a-f0-9-]{36}$/.test(id)) return res.status(404).end();
|
||||
const buf = store.readBug(id);
|
||||
if (!buf) return res.status(404).end();
|
||||
res.set('Cache-Control', 'private, max-age=3600');
|
||||
res.type(imageMime(buf) || 'image/png');
|
||||
res.send(buf);
|
||||
});
|
||||
|
||||
// ---------- Export ----------
|
||||
function eventsForRange(from, to) {
|
||||
const st = S();
|
||||
@@ -750,7 +869,11 @@ app.use((err, req, res, next) => {
|
||||
if (status === 500) console.error(err);
|
||||
});
|
||||
|
||||
const port = Number(process.env.PORT) || 3000;
|
||||
app.listen(port, () => {
|
||||
console.log(`Rotatory läuft auf Port ${port}, Daten in ${dataDir}, Nextcloud ${nc.configured ? 'konfiguriert' : 'nicht konfiguriert'}`);
|
||||
});
|
||||
export function start(port = Number(process.env.PORT) || 3000) {
|
||||
return app.listen(port, () => {
|
||||
console.log(`Rotatory läuft auf Port ${port}, Daten in ${dataDir}, Nextcloud ${nc.configured ? 'konfiguriert' : 'nicht konfiguriert'}`);
|
||||
});
|
||||
}
|
||||
|
||||
// Nur beim direkten Start lauschen; Tests importieren die App und starten sie auf einem freien Port
|
||||
if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) start();
|
||||
Reference in new issue
Block a user