refactor: enhance security and performance in configuration and API routes
- Update Content Security Policy (CSP) in next.config.ts to avoid `unsafe-eval` in production, improving security against XSS attacks. - Refactor API routes to enforce admin authentication and session validation, ensuring secure access to sensitive endpoints. - Optimize analytics data retrieval by using database aggregation instead of loading all records into memory, improving performance and reducing memory usage. - Implement session token creation and verification for better session management and security across the application. - Enhance error handling and input validation in various API routes to ensure robustness and prevent potential issues.
This commit is contained in:
@@ -14,21 +14,17 @@ export async function GET(request: NextRequest) {
|
||||
status: 429,
|
||||
headers: {
|
||||
'Content-Type': 'application/json',
|
||||
...getRateLimitHeaders(ip, 5, 60000)
|
||||
...getRateLimitHeaders(ip, 20, 60000)
|
||||
}
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
// Check admin authentication - for admin dashboard requests, we trust the session
|
||||
// The middleware has already verified the admin session for /manage routes
|
||||
// Admin-only endpoint: require explicit admin header AND a valid signed session token
|
||||
const isAdminRequest = request.headers.get('x-admin-request') === 'true';
|
||||
if (!isAdminRequest) {
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) {
|
||||
return authError;
|
||||
}
|
||||
}
|
||||
if (!isAdminRequest) return NextResponse.json({ error: 'Admin access required' }, { status: 403 });
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) return authError;
|
||||
|
||||
// Check cache first (but allow bypass with cache-bust parameter)
|
||||
const url = new URL(request.url);
|
||||
@@ -45,47 +41,57 @@ export async function GET(request: NextRequest) {
|
||||
const projectsResult = await projectService.getAllProjects();
|
||||
const projects = projectsResult.projects || projectsResult;
|
||||
const performanceStats = await projectService.getPerformanceStats();
|
||||
|
||||
// Get real page view data from database
|
||||
const allPageViews = await prisma.pageView.findMany({
|
||||
where: {
|
||||
timestamp: {
|
||||
gte: new Date(Date.now() - 30 * 24 * 60 * 60 * 1000) // Last 30 days
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// Calculate bounce rate (sessions with only 1 pageview)
|
||||
const pageViewsByIP = allPageViews.reduce((acc, pv) => {
|
||||
const ip = pv.ip || 'unknown';
|
||||
if (!acc[ip]) acc[ip] = [];
|
||||
acc[ip].push(pv);
|
||||
return acc;
|
||||
}, {} as Record<string, typeof allPageViews>);
|
||||
const since = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
|
||||
|
||||
const totalSessions = Object.keys(pageViewsByIP).length;
|
||||
const bouncedSessions = Object.values(pageViewsByIP).filter(session => session.length === 1).length;
|
||||
// Use DB aggregation instead of loading every PageView row into memory
|
||||
const [totalViews, sessionsByIp, viewsByProjectRows] = await Promise.all([
|
||||
prisma.pageView.count({ where: { timestamp: { gte: since } } }),
|
||||
prisma.pageView.groupBy({
|
||||
by: ['ip'],
|
||||
where: {
|
||||
timestamp: { gte: since },
|
||||
ip: { not: null },
|
||||
},
|
||||
_count: { _all: true },
|
||||
_min: { timestamp: true },
|
||||
_max: { timestamp: true },
|
||||
}),
|
||||
prisma.pageView.groupBy({
|
||||
by: ['projectId'],
|
||||
where: {
|
||||
timestamp: { gte: since },
|
||||
projectId: { not: null },
|
||||
},
|
||||
_count: { _all: true },
|
||||
}),
|
||||
]);
|
||||
|
||||
const totalSessions = sessionsByIp.length;
|
||||
const bouncedSessions = sessionsByIp.filter(s => (s as unknown as { _count?: { _all?: number } })._count?._all === 1).length;
|
||||
const bounceRate = totalSessions > 0 ? Math.round((bouncedSessions / totalSessions) * 100) : 0;
|
||||
|
||||
// Calculate average session duration (simplified - time between first and last pageview per IP)
|
||||
const sessionDurations = Object.values(pageViewsByIP)
|
||||
.map(session => {
|
||||
if (session.length < 2) return 0;
|
||||
const sorted = session.sort((a, b) => a.timestamp.getTime() - b.timestamp.getTime());
|
||||
return sorted[sorted.length - 1].timestamp.getTime() - sorted[0].timestamp.getTime();
|
||||
const sessionDurationsMs = sessionsByIp
|
||||
.map(s => {
|
||||
const count = (s as unknown as { _count?: { _all?: number } })._count?._all ?? 0;
|
||||
if (count < 2) return 0;
|
||||
const minTs = (s as unknown as { _min?: { timestamp?: Date | null } })._min?.timestamp;
|
||||
const maxTs = (s as unknown as { _max?: { timestamp?: Date | null } })._max?.timestamp;
|
||||
if (!minTs || !maxTs) return 0;
|
||||
return maxTs.getTime() - minTs.getTime();
|
||||
})
|
||||
.filter(d => d > 0);
|
||||
const avgSessionDuration = sessionDurations.length > 0
|
||||
? Math.round(sessionDurations.reduce((a, b) => a + b, 0) / sessionDurations.length / 1000) // in seconds
|
||||
.filter(ms => ms > 0);
|
||||
|
||||
const avgSessionDuration = sessionDurationsMs.length > 0
|
||||
? Math.round(sessionDurationsMs.reduce((a, b) => a + b, 0) / sessionDurationsMs.length / 1000)
|
||||
: 0;
|
||||
|
||||
// Get total unique users (unique IPs)
|
||||
const totalUsers = new Set(allPageViews.map(pv => pv.ip).filter(Boolean)).size;
|
||||
const totalUsers = totalSessions;
|
||||
|
||||
// Calculate real views from PageView table
|
||||
const viewsByProject = allPageViews.reduce((acc, pv) => {
|
||||
if (pv.projectId) {
|
||||
acc[pv.projectId] = (acc[pv.projectId] || 0) + 1;
|
||||
const viewsByProject = viewsByProjectRows.reduce((acc, row) => {
|
||||
const projectId = row.projectId as number | null;
|
||||
if (projectId != null) {
|
||||
acc[projectId] = (row as unknown as { _count?: { _all?: number } })._count?._all ?? 0;
|
||||
}
|
||||
return acc;
|
||||
}, {} as Record<number, number>);
|
||||
@@ -96,7 +102,7 @@ export async function GET(request: NextRequest) {
|
||||
totalProjects: projects.length,
|
||||
publishedProjects: projects.filter(p => p.published).length,
|
||||
featuredProjects: projects.filter(p => p.featured).length,
|
||||
totalViews: allPageViews.length, // Real views from PageView table
|
||||
totalViews, // Real views from PageView table
|
||||
totalLikes: 0, // Not implemented - no like buttons
|
||||
totalShares: 0, // Not implemented - no share buttons
|
||||
avgLighthouse: (() => {
|
||||
@@ -141,14 +147,14 @@ export async function GET(request: NextRequest) {
|
||||
? Math.round(projectsWithPerf.reduce((sum, p) => sum + ((p.performance as Record<string, unknown>)?.lighthouse as number || 0), 0) / projectsWithPerf.length)
|
||||
: 0;
|
||||
})(),
|
||||
totalViews: allPageViews.length, // Real total views
|
||||
totalViews, // Real total views
|
||||
totalLikes: 0,
|
||||
totalShares: 0
|
||||
},
|
||||
metrics: {
|
||||
bounceRate,
|
||||
avgSessionDuration,
|
||||
pagesPerSession: totalSessions > 0 ? (allPageViews.length / totalSessions).toFixed(1) : '0',
|
||||
pagesPerSession: totalSessions > 0 ? (totalViews / totalSessions).toFixed(1) : '0',
|
||||
newUsers: totalUsers,
|
||||
totalUsers
|
||||
}
|
||||
|
||||
@@ -4,14 +4,11 @@ import { requireSessionAuth } from '@/lib/auth';
|
||||
|
||||
export async function GET(request: NextRequest) {
|
||||
try {
|
||||
// Check admin authentication - for admin dashboard requests, we trust the session
|
||||
// Admin-only endpoint
|
||||
const isAdminRequest = request.headers.get('x-admin-request') === 'true';
|
||||
if (!isAdminRequest) {
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) {
|
||||
return authError;
|
||||
}
|
||||
}
|
||||
if (!isAdminRequest) return NextResponse.json({ error: 'Admin access required' }, { status: 403 });
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) return authError;
|
||||
|
||||
// Get performance data from database
|
||||
const pageViews = await prisma.pageView.findMany({
|
||||
|
||||
@@ -22,12 +22,9 @@ export async function POST(request: NextRequest) {
|
||||
|
||||
// Check admin authentication
|
||||
const isAdminRequest = request.headers.get('x-admin-request') === 'true';
|
||||
if (!isAdminRequest) {
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) {
|
||||
return authError;
|
||||
}
|
||||
}
|
||||
if (!isAdminRequest) return NextResponse.json({ error: 'Admin access required' }, { status: 403 });
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) return authError;
|
||||
|
||||
const { type } = await request.json();
|
||||
|
||||
|
||||
@@ -37,7 +37,13 @@ export async function POST(request: NextRequest) {
|
||||
}
|
||||
|
||||
// Get admin credentials from environment
|
||||
const adminAuth = process.env.ADMIN_BASIC_AUTH || 'admin:default_password_change_me';
|
||||
const adminAuth = process.env.ADMIN_BASIC_AUTH;
|
||||
if (!adminAuth || adminAuth.trim() === '' || adminAuth === 'admin:default_password_change_me') {
|
||||
return new NextResponse(
|
||||
JSON.stringify({ error: 'Admin auth is not configured' }),
|
||||
{ status: 503, headers: { 'Content-Type': 'application/json' } }
|
||||
);
|
||||
}
|
||||
const [, expectedPassword] = adminAuth.split(':');
|
||||
|
||||
// Secure password comparison using constant-time comparison
|
||||
@@ -48,22 +54,14 @@ export async function POST(request: NextRequest) {
|
||||
// Use constant-time comparison to prevent timing attacks
|
||||
if (passwordBuffer.length === expectedBuffer.length &&
|
||||
crypto.timingSafeEqual(passwordBuffer, expectedBuffer)) {
|
||||
// Generate cryptographically secure session token
|
||||
const timestamp = Date.now();
|
||||
const randomBytes = crypto.randomBytes(32);
|
||||
const randomString = randomBytes.toString('hex');
|
||||
|
||||
// Create session data
|
||||
const sessionData = {
|
||||
timestamp,
|
||||
random: randomString,
|
||||
ip: ip,
|
||||
userAgent: request.headers.get('user-agent') || 'unknown'
|
||||
};
|
||||
|
||||
// Encode session data (base64 is sufficient for this use case)
|
||||
const sessionJson = JSON.stringify(sessionData);
|
||||
const sessionToken = Buffer.from(sessionJson).toString('base64');
|
||||
const { createSessionToken } = await import('@/lib/auth');
|
||||
const sessionToken = createSessionToken(request);
|
||||
if (!sessionToken) {
|
||||
return new NextResponse(
|
||||
JSON.stringify({ error: 'Session secret not configured' }),
|
||||
{ status: 503, headers: { 'Content-Type': 'application/json' } }
|
||||
);
|
||||
}
|
||||
|
||||
return new NextResponse(
|
||||
JSON.stringify({
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { verifySessionToken } from '@/lib/auth';
|
||||
|
||||
export async function POST(request: NextRequest) {
|
||||
try {
|
||||
@@ -20,70 +21,26 @@ export async function POST(request: NextRequest) {
|
||||
);
|
||||
}
|
||||
|
||||
// Decode and validate session token
|
||||
try {
|
||||
const decodedJson = atob(sessionToken);
|
||||
const sessionData = JSON.parse(decodedJson);
|
||||
|
||||
// Validate session data structure
|
||||
if (!sessionData.timestamp || !sessionData.random || !sessionData.ip || !sessionData.userAgent) {
|
||||
return new NextResponse(
|
||||
JSON.stringify({ valid: false, error: 'Invalid session token structure' }),
|
||||
{ status: 401, headers: { 'Content-Type': 'application/json' } }
|
||||
);
|
||||
}
|
||||
|
||||
// Check if session is still valid (2 hours)
|
||||
const sessionTime = sessionData.timestamp;
|
||||
const now = Date.now();
|
||||
const sessionDuration = 2 * 60 * 60 * 1000; // 2 hours
|
||||
|
||||
if (now - sessionTime > sessionDuration) {
|
||||
return new NextResponse(
|
||||
JSON.stringify({ valid: false, error: 'Session expired' }),
|
||||
{ status: 401, headers: { 'Content-Type': 'application/json' } }
|
||||
);
|
||||
}
|
||||
|
||||
// Validate IP address (optional, but good security practice)
|
||||
const currentIp = request.headers.get('x-forwarded-for') || request.headers.get('x-real-ip') || 'unknown';
|
||||
if (sessionData.ip !== currentIp) {
|
||||
// Log potential session hijacking attempt
|
||||
console.warn(`Session IP mismatch: expected ${sessionData.ip}, got ${currentIp}`);
|
||||
return new NextResponse(
|
||||
JSON.stringify({ valid: false, error: 'Session validation failed' }),
|
||||
{ status: 401, headers: { 'Content-Type': 'application/json' } }
|
||||
);
|
||||
}
|
||||
|
||||
// Validate User-Agent (optional)
|
||||
const currentUserAgent = request.headers.get('user-agent') || 'unknown';
|
||||
if (sessionData.userAgent !== currentUserAgent) {
|
||||
console.warn(`Session User-Agent mismatch`);
|
||||
return new NextResponse(
|
||||
JSON.stringify({ valid: false, error: 'Session validation failed' }),
|
||||
{ status: 401, headers: { 'Content-Type': 'application/json' } }
|
||||
);
|
||||
}
|
||||
|
||||
const valid = verifySessionToken(request, sessionToken);
|
||||
if (!valid) {
|
||||
return new NextResponse(
|
||||
JSON.stringify({ valid: true, message: 'Session valid' }),
|
||||
{
|
||||
status: 200,
|
||||
headers: {
|
||||
'Content-Type': 'application/json',
|
||||
'X-Content-Type-Options': 'nosniff',
|
||||
'X-Frame-Options': 'DENY',
|
||||
'X-XSS-Protection': '1; mode=block'
|
||||
}
|
||||
}
|
||||
);
|
||||
} catch {
|
||||
return new NextResponse(
|
||||
JSON.stringify({ valid: false, error: 'Invalid session token format' }),
|
||||
JSON.stringify({ valid: false, error: 'Session expired or invalid' }),
|
||||
{ status: 401, headers: { 'Content-Type': 'application/json' } }
|
||||
);
|
||||
}
|
||||
|
||||
return new NextResponse(
|
||||
JSON.stringify({ valid: true, message: 'Session valid' }),
|
||||
{
|
||||
status: 200,
|
||||
headers: {
|
||||
'Content-Type': 'application/json',
|
||||
'X-Content-Type-Options': 'nosniff',
|
||||
'X-Frame-Options': 'DENY',
|
||||
'X-XSS-Protection': '1; mode=block'
|
||||
}
|
||||
}
|
||||
);
|
||||
} catch {
|
||||
return new NextResponse(
|
||||
JSON.stringify({ valid: false, error: 'Internal server error' }),
|
||||
|
||||
@@ -1,10 +1,15 @@
|
||||
import { type NextRequest, NextResponse } from "next/server";
|
||||
import { PrismaClientKnownRequestError } from '@prisma/client/runtime/library';
|
||||
import { checkRateLimit, getRateLimitHeaders } from '@/lib/auth';
|
||||
import { checkRateLimit, getRateLimitHeaders, requireSessionAuth } from '@/lib/auth';
|
||||
import { prisma } from '@/lib/prisma';
|
||||
|
||||
export async function GET(request: NextRequest) {
|
||||
try {
|
||||
const isAdminRequest = request.headers.get('x-admin-request') === 'true';
|
||||
if (!isAdminRequest) return NextResponse.json({ error: 'Admin access required' }, { status: 403 });
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) return authError;
|
||||
|
||||
const { searchParams } = new URL(request.url);
|
||||
const filter = searchParams.get('filter') || 'all';
|
||||
const limit = parseInt(searchParams.get('limit') || '50');
|
||||
|
||||
@@ -2,6 +2,7 @@ import { type NextRequest, NextResponse } from "next/server";
|
||||
import nodemailer from "nodemailer";
|
||||
import SMTPTransport from "nodemailer/lib/smtp-transport";
|
||||
import Mail from "nodemailer/lib/mailer";
|
||||
import { checkRateLimit, getRateLimitHeaders, getClientIp, requireSessionAuth } from "@/lib/auth";
|
||||
|
||||
const BRAND = {
|
||||
siteUrl: "https://dk0.dev",
|
||||
@@ -172,9 +173,10 @@ const emailTemplates = {
|
||||
},
|
||||
reply: {
|
||||
subject: "Antwort auf deine Nachricht 📧",
|
||||
template: (name: string, originalMessage: string) => {
|
||||
template: (name: string, originalMessage: string, responseMessage: string) => {
|
||||
const safeName = escapeHtml(name);
|
||||
const safeMsg = nl2br(escapeHtml(originalMessage));
|
||||
const safeOriginal = nl2br(escapeHtml(originalMessage));
|
||||
const safeResponse = nl2br(escapeHtml(responseMessage));
|
||||
return baseEmail({
|
||||
title: `Antwort für ${safeName}`,
|
||||
subtitle: "Neue Nachricht",
|
||||
@@ -189,7 +191,16 @@ const emailTemplates = {
|
||||
<div style="font-size:12px;letter-spacing:0.08em;text-transform:uppercase;font-weight:800;color:#57534e;">Antwort</div>
|
||||
</div>
|
||||
<div style="padding:16px;line-height:1.65;color:${BRAND.text};font-size:14px;border-left:4px solid ${BRAND.mint};">
|
||||
${safeMsg}
|
||||
${safeResponse}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div style="margin-top:16px;background:${BRAND.bg};border:1px solid ${BRAND.border};border-radius:16px;overflow:hidden;">
|
||||
<div style="padding:14px 16px;background:${BRAND.sand};border-bottom:1px solid ${BRAND.border};">
|
||||
<div style="font-size:12px;letter-spacing:0.08em;text-transform:uppercase;font-weight:800;color:#57534e;">Deine ursprüngliche Nachricht</div>
|
||||
</div>
|
||||
<div style="padding:16px;line-height:1.65;color:${BRAND.text};font-size:14px;border-left:4px solid ${BRAND.border};">
|
||||
${safeOriginal}
|
||||
</div>
|
||||
</div>
|
||||
`.trim(),
|
||||
@@ -200,25 +211,39 @@ const emailTemplates = {
|
||||
|
||||
export async function POST(request: NextRequest) {
|
||||
try {
|
||||
const isAdminRequest = request.headers.get("x-admin-request") === "true";
|
||||
if (!isAdminRequest) return NextResponse.json({ error: "Admin access required" }, { status: 403 });
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) return authError;
|
||||
|
||||
const ip = getClientIp(request);
|
||||
if (!checkRateLimit(ip, 10, 60000)) {
|
||||
return NextResponse.json(
|
||||
{ error: "Rate limit exceeded" },
|
||||
{ status: 429, headers: { ...getRateLimitHeaders(ip, 10, 60000) } },
|
||||
);
|
||||
}
|
||||
|
||||
const body = (await request.json()) as {
|
||||
to: string;
|
||||
name: string;
|
||||
template: 'welcome' | 'project' | 'quick' | 'reply';
|
||||
originalMessage: string;
|
||||
response?: string;
|
||||
};
|
||||
|
||||
const { to, name, template, originalMessage } = body;
|
||||
|
||||
console.log('📧 Email response request:', { to, name, template, messageLength: originalMessage.length });
|
||||
const { to, name, template, originalMessage, response } = body;
|
||||
|
||||
// Validate input
|
||||
if (!to || !name || !template || !originalMessage) {
|
||||
console.error('❌ Validation failed: Missing required fields');
|
||||
return NextResponse.json(
|
||||
{ error: "Alle Felder sind erforderlich" },
|
||||
{ status: 400 },
|
||||
);
|
||||
}
|
||||
if (template === "reply" && (!response || !response.trim())) {
|
||||
return NextResponse.json({ error: "Antworttext ist erforderlich" }, { status: 400 });
|
||||
}
|
||||
|
||||
// Validate email format
|
||||
const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
|
||||
@@ -232,7 +257,6 @@ export async function POST(request: NextRequest) {
|
||||
|
||||
// Check if template exists
|
||||
if (!emailTemplates[template]) {
|
||||
console.error('❌ Validation failed: Invalid template');
|
||||
return NextResponse.json(
|
||||
{ error: "Ungültiges Template" },
|
||||
{ status: 400 },
|
||||
@@ -274,9 +298,7 @@ export async function POST(request: NextRequest) {
|
||||
// Verify transport configuration
|
||||
try {
|
||||
await transport.verify();
|
||||
console.log('✅ SMTP connection verified successfully');
|
||||
} catch (verifyError) {
|
||||
console.error('❌ SMTP verification failed:', verifyError);
|
||||
} catch (_verifyError) {
|
||||
return NextResponse.json(
|
||||
{ error: "E-Mail-Server-Verbindung fehlgeschlagen" },
|
||||
{ status: 500 },
|
||||
@@ -284,19 +306,27 @@ export async function POST(request: NextRequest) {
|
||||
}
|
||||
|
||||
const selectedTemplate = emailTemplates[template];
|
||||
let html: string;
|
||||
if (template === "reply") {
|
||||
html = emailTemplates.reply.template(name, originalMessage, response || "");
|
||||
} else {
|
||||
// Narrow the template type so TS knows this is not the 3-arg reply template
|
||||
const nonReplyTemplate = template as Exclude<typeof template, "reply">;
|
||||
html = emailTemplates[nonReplyTemplate].template(name, originalMessage);
|
||||
}
|
||||
const mailOptions: Mail.Options = {
|
||||
from: `"Dennis Konkol" <${user}>`,
|
||||
to: to,
|
||||
replyTo: "contact@dk0.dev",
|
||||
subject: selectedTemplate.subject,
|
||||
html: selectedTemplate.template(name, originalMessage),
|
||||
html,
|
||||
text: `
|
||||
Hallo ${name}!
|
||||
|
||||
Vielen Dank für deine Nachricht:
|
||||
${originalMessage}
|
||||
|
||||
Ich werde mich so schnell wie möglich bei dir melden.
|
||||
${template === "reply" ? `\nAntwort:\n${response || ""}\n` : "\nIch werde mich so schnell wie möglich bei dir melden.\n"}
|
||||
|
||||
Beste Grüße,
|
||||
Dennis Konkol
|
||||
@@ -306,23 +336,18 @@ contact@dk0.dev
|
||||
`,
|
||||
};
|
||||
|
||||
console.log('📤 Sending templated email...');
|
||||
|
||||
const sendMailPromise = () =>
|
||||
new Promise<string>((resolve, reject) => {
|
||||
transport.sendMail(mailOptions, function (err, info) {
|
||||
if (!err) {
|
||||
console.log('✅ Templated email sent successfully:', info.response);
|
||||
resolve(info.response);
|
||||
} else {
|
||||
console.error("❌ Error sending templated email:", err);
|
||||
reject(err.message);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
const result = await sendMailPromise();
|
||||
console.log('🎉 Templated email process completed successfully');
|
||||
|
||||
return NextResponse.json({
|
||||
message: "Template-E-Mail erfolgreich gesendet",
|
||||
@@ -331,7 +356,6 @@ contact@dk0.dev
|
||||
});
|
||||
|
||||
} catch (err) {
|
||||
console.error("❌ Unexpected error in templated email API:", err);
|
||||
return NextResponse.json({
|
||||
error: "Fehler beim Senden der Template-E-Mail",
|
||||
details: err instanceof Error ? err.message : 'Unbekannter Fehler'
|
||||
|
||||
@@ -2,10 +2,8 @@ import { type NextRequest, NextResponse } from "next/server";
|
||||
import nodemailer from "nodemailer";
|
||||
import SMTPTransport from "nodemailer/lib/smtp-transport";
|
||||
import Mail from "nodemailer/lib/mailer";
|
||||
import { PrismaClient } from '@prisma/client';
|
||||
import { checkRateLimit, getRateLimitHeaders } from '@/lib/auth';
|
||||
|
||||
const prisma = new PrismaClient();
|
||||
import { prisma } from '@/lib/prisma';
|
||||
|
||||
// Sanitize input to prevent XSS
|
||||
function sanitizeInput(input: string, maxLength: number = 10000): string {
|
||||
@@ -95,12 +93,6 @@ export async function POST(request: NextRequest) {
|
||||
const user = process.env.MY_EMAIL ?? "";
|
||||
const pass = process.env.MY_PASSWORD ?? "";
|
||||
|
||||
console.log('🔑 Environment check:', {
|
||||
hasEmail: !!user,
|
||||
hasPassword: !!pass,
|
||||
emailHost: user.split('@')[1] || 'unknown'
|
||||
});
|
||||
|
||||
if (!user || !pass) {
|
||||
console.error("❌ Missing email/password environment variables");
|
||||
return NextResponse.json(
|
||||
@@ -123,11 +115,10 @@ export async function POST(request: NextRequest) {
|
||||
connectionTimeout: 30000, // 30 seconds
|
||||
greetingTimeout: 30000, // 30 seconds
|
||||
socketTimeout: 60000, // 60 seconds
|
||||
// Additional TLS options for better compatibility
|
||||
tls: {
|
||||
rejectUnauthorized: false, // Allow self-signed certificates
|
||||
ciphers: 'SSLv3'
|
||||
}
|
||||
// TLS hardening (allow insecure only when explicitly enabled)
|
||||
tls: process.env.SMTP_ALLOW_INSECURE_TLS === 'true'
|
||||
? { rejectUnauthorized: false }
|
||||
: { rejectUnauthorized: true, minVersion: 'TLSv1.2' }
|
||||
};
|
||||
|
||||
// Creating transport with configured options
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
import { NextRequest, NextResponse } from "next/server";
|
||||
import { prisma } from "@/lib/prisma";
|
||||
|
||||
/**
|
||||
* POST /api/n8n/generate-image
|
||||
@@ -57,23 +58,16 @@ export async function POST(req: NextRequest) {
|
||||
);
|
||||
}
|
||||
|
||||
// Fetch project data first (needed for the new webhook format)
|
||||
const projectResponse = await fetch(
|
||||
`${process.env.NEXT_PUBLIC_API_URL || "http://localhost:3000"}/api/projects/${projectId}`,
|
||||
{
|
||||
method: "GET",
|
||||
cache: "no-store",
|
||||
},
|
||||
);
|
||||
|
||||
if (!projectResponse.ok) {
|
||||
return NextResponse.json(
|
||||
{ error: "Project not found" },
|
||||
{ status: 404 },
|
||||
);
|
||||
const projectIdNum = typeof projectId === "string" ? parseInt(projectId, 10) : Number(projectId);
|
||||
if (!Number.isFinite(projectIdNum)) {
|
||||
return NextResponse.json({ error: "projectId must be a number" }, { status: 400 });
|
||||
}
|
||||
|
||||
const project = await projectResponse.json();
|
||||
// Fetch project data directly (avoid HTTP self-calls)
|
||||
const project = await prisma.project.findUnique({ where: { id: projectIdNum } });
|
||||
if (!project) {
|
||||
return NextResponse.json({ error: "Project not found" }, { status: 404 });
|
||||
}
|
||||
|
||||
// Optional: Check if project already has an image
|
||||
if (!regenerate) {
|
||||
@@ -83,7 +77,7 @@ export async function POST(req: NextRequest) {
|
||||
success: true,
|
||||
message:
|
||||
"Project already has an image. Use regenerate=true to force regeneration.",
|
||||
projectId: projectId,
|
||||
projectId: projectIdNum,
|
||||
existingImageUrl: project.imageUrl,
|
||||
regenerated: false,
|
||||
},
|
||||
@@ -106,7 +100,7 @@ export async function POST(req: NextRequest) {
|
||||
}),
|
||||
},
|
||||
body: JSON.stringify({
|
||||
projectId: projectId,
|
||||
projectId: projectIdNum,
|
||||
projectData: {
|
||||
title: project.title || "Unknown Project",
|
||||
category: project.category || "Technology",
|
||||
@@ -196,22 +190,13 @@ export async function POST(req: NextRequest) {
|
||||
|
||||
// If we got an image URL, we should update the project with it
|
||||
if (imageUrl) {
|
||||
// Update project with the new image URL
|
||||
const updateResponse = await fetch(
|
||||
`${process.env.NEXT_PUBLIC_API_URL || "http://localhost:3000"}/api/projects/${projectId}`,
|
||||
{
|
||||
method: "PUT",
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
"x-admin-request": "true",
|
||||
},
|
||||
body: JSON.stringify({
|
||||
imageUrl: imageUrl,
|
||||
}),
|
||||
},
|
||||
);
|
||||
|
||||
if (!updateResponse.ok) {
|
||||
try {
|
||||
await prisma.project.update({
|
||||
where: { id: projectIdNum },
|
||||
data: { imageUrl, updatedAt: new Date() },
|
||||
});
|
||||
} catch {
|
||||
// Non-fatal: image URL can still be returned to caller
|
||||
console.warn("Failed to update project with image URL");
|
||||
}
|
||||
}
|
||||
@@ -220,7 +205,7 @@ export async function POST(req: NextRequest) {
|
||||
{
|
||||
success: true,
|
||||
message: "AI image generation completed successfully",
|
||||
projectId: projectId,
|
||||
projectId: projectIdNum,
|
||||
imageUrl: imageUrl,
|
||||
generatedAt: generatedAt,
|
||||
fileSize: fileSize,
|
||||
@@ -257,23 +242,17 @@ export async function GET(req: NextRequest) {
|
||||
);
|
||||
}
|
||||
|
||||
// Fetch project to check image status
|
||||
const projectResponse = await fetch(
|
||||
`${process.env.NEXT_PUBLIC_API_URL || "http://localhost:3000"}/api/projects/${projectId}`,
|
||||
{
|
||||
method: "GET",
|
||||
cache: "no-store",
|
||||
},
|
||||
);
|
||||
|
||||
if (!projectResponse.ok) {
|
||||
const projectIdNum = parseInt(projectId, 10);
|
||||
if (!Number.isFinite(projectIdNum)) {
|
||||
return NextResponse.json({ error: "projectId must be a number" }, { status: 400 });
|
||||
}
|
||||
const project = await prisma.project.findUnique({ where: { id: projectIdNum } });
|
||||
if (!project) {
|
||||
return NextResponse.json({ error: "Project not found" }, { status: 404 });
|
||||
}
|
||||
|
||||
const project = await projectResponse.json();
|
||||
|
||||
return NextResponse.json({
|
||||
projectId: parseInt(projectId),
|
||||
projectId: projectIdNum,
|
||||
title: project.title,
|
||||
hasImage: !!project.imageUrl,
|
||||
imageUrl: project.imageUrl || null,
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { prisma } from '@/lib/prisma';
|
||||
import { apiCache } from '@/lib/cache';
|
||||
import { checkRateLimit, getRateLimitHeaders } from '@/lib/auth';
|
||||
import { checkRateLimit, getRateLimitHeaders, requireSessionAuth } from '@/lib/auth';
|
||||
import { PrismaClientKnownRequestError } from '@prisma/client/runtime/library';
|
||||
|
||||
export async function GET(
|
||||
@@ -11,6 +11,9 @@ export async function GET(
|
||||
try {
|
||||
const { id: idParam } = await params;
|
||||
const id = parseInt(idParam);
|
||||
if (!Number.isFinite(id)) {
|
||||
return NextResponse.json({ error: 'Invalid project id' }, { status: 400 });
|
||||
}
|
||||
|
||||
const project = await prisma.project.findUnique({
|
||||
where: { id }
|
||||
@@ -74,9 +77,14 @@ export async function PUT(
|
||||
{ status: 403 }
|
||||
);
|
||||
}
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) return authError;
|
||||
|
||||
const { id: idParam } = await params;
|
||||
const id = parseInt(idParam);
|
||||
if (!Number.isFinite(id)) {
|
||||
return NextResponse.json({ error: 'Invalid project id' }, { status: 400 });
|
||||
}
|
||||
const data = await request.json();
|
||||
|
||||
// Remove difficulty field if it exists (since we're removing it)
|
||||
@@ -147,9 +155,14 @@ export async function DELETE(
|
||||
{ status: 403 }
|
||||
);
|
||||
}
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) return authError;
|
||||
|
||||
const { id: idParam } = await params;
|
||||
const id = parseInt(idParam);
|
||||
if (!Number.isFinite(id)) {
|
||||
return NextResponse.json({ error: 'Invalid project id' }, { status: 400 });
|
||||
}
|
||||
|
||||
await prisma.project.delete({
|
||||
where: { id }
|
||||
|
||||
@@ -1,8 +1,14 @@
|
||||
import { NextResponse } from 'next/server';
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { projectService } from '@/lib/prisma';
|
||||
import { requireSessionAuth } from '@/lib/auth';
|
||||
|
||||
export async function GET() {
|
||||
export async function GET(request: NextRequest) {
|
||||
try {
|
||||
const isAdminRequest = request.headers.get('x-admin-request') === 'true';
|
||||
if (!isAdminRequest) return NextResponse.json({ error: 'Admin access required' }, { status: 403 });
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) return authError;
|
||||
|
||||
// Get all projects with full data
|
||||
const projectsResult = await projectService.getAllProjects();
|
||||
const projects = projectsResult.projects || projectsResult;
|
||||
|
||||
@@ -1,8 +1,14 @@
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { projectService } from '@/lib/prisma';
|
||||
import { requireSessionAuth } from '@/lib/auth';
|
||||
|
||||
export async function POST(request: NextRequest) {
|
||||
try {
|
||||
const isAdminRequest = request.headers.get('x-admin-request') === 'true';
|
||||
if (!isAdminRequest) return NextResponse.json({ error: 'Admin access required' }, { status: 403 });
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) return authError;
|
||||
|
||||
const body = await request.json();
|
||||
|
||||
// Validate import data structure
|
||||
@@ -19,13 +25,16 @@ export async function POST(request: NextRequest) {
|
||||
errors: [] as string[]
|
||||
};
|
||||
|
||||
// Preload existing titles once (avoid O(n^2) DB reads during import)
|
||||
const existingProjectsResult = await projectService.getAllProjects({ limit: 10000 });
|
||||
const existingProjects = existingProjectsResult.projects || existingProjectsResult;
|
||||
const existingTitles = new Set(existingProjects.map(p => p.title));
|
||||
|
||||
// Process each project
|
||||
for (const projectData of body.projects) {
|
||||
try {
|
||||
// Check if project already exists (by title)
|
||||
const existingProjectsResult = await projectService.getAllProjects();
|
||||
const existingProjects = existingProjectsResult.projects || existingProjectsResult;
|
||||
const exists = existingProjects.some(p => p.title === projectData.title);
|
||||
const exists = existingTitles.has(projectData.title);
|
||||
|
||||
if (exists) {
|
||||
results.skipped++;
|
||||
@@ -68,6 +77,7 @@ export async function POST(request: NextRequest) {
|
||||
});
|
||||
|
||||
results.imported++;
|
||||
existingTitles.add(projectData.title);
|
||||
} catch (error) {
|
||||
results.skipped++;
|
||||
results.errors.push(`Failed to import "${projectData.title}": ${error instanceof Error ? error.message : 'Unknown error'}`);
|
||||
|
||||
@@ -30,8 +30,10 @@ export async function GET(request: NextRequest) {
|
||||
}
|
||||
}
|
||||
const { searchParams } = new URL(request.url);
|
||||
const page = parseInt(searchParams.get('page') || '1');
|
||||
const limit = parseInt(searchParams.get('limit') || '50');
|
||||
const pageRaw = parseInt(searchParams.get('page') || '1');
|
||||
const limitRaw = parseInt(searchParams.get('limit') || '50');
|
||||
const page = Number.isFinite(pageRaw) && pageRaw > 0 ? pageRaw : 1;
|
||||
const limit = Number.isFinite(limitRaw) && limitRaw > 0 && limitRaw <= 200 ? limitRaw : 50;
|
||||
const category = searchParams.get('category');
|
||||
const featured = searchParams.get('featured');
|
||||
const published = searchParams.get('published');
|
||||
@@ -145,6 +147,8 @@ export async function POST(request: NextRequest) {
|
||||
{ status: 403 }
|
||||
);
|
||||
}
|
||||
const authError = requireSessionAuth(request);
|
||||
if (authError) return authError;
|
||||
|
||||
const data = await request.json();
|
||||
|
||||
|
||||
Reference in New Issue
Block a user