maroandClaude Sonnet 5
1cd15aff25
- Customer accounts now require email verification (hashed, single-use, time-limited tokens) before they can request/confirm bookings, with resend flows on login/account/booking widget and rate limiting. - Admins get a private, rotatable iCalendar (ICS) subscription feed of their confirmed bookings and public events, timezone-correct for Europe/Berlin including DST, never exposing meeting passwords. - Adds a full SEO layer: per-page canonical/OG/Twitter metadata with CMS-editable overrides and content-derived fallbacks, a dynamic sitemap.xml and robots.txt driven by real published content, JSON-LD (Organization/LocalBusiness, WebSite, WebPage, BreadcrumbList, Service, Event, BlogPosting) that never fabricates data, and a CMS-managed redirect table for changed slugs. - Global ANOUMA-naming audit: the brand name is never used to label personal account/calendar areas anywhere in the app, CMS, or emails. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
39 lines
1.3 KiB
TypeScript
39 lines
1.3 KiB
TypeScript
/**
|
|
* Minimal in-memory fixed-window rate limiter for a single Node process
|
|
* (this app always runs as one process — see server.ts). Good enough to
|
|
* blunt abuse of the email-verification resend endpoint without adding an
|
|
* external store; resets on deploy/restart, which is an acceptable
|
|
* trade-off for this use case.
|
|
*/
|
|
const buckets = new Map<string, { count: number; resetAt: number }>();
|
|
|
|
// Opportunistic cleanup so long-running processes don't accumulate an
|
|
// unbounded number of stale keys (one per distinct IP/email ever seen).
|
|
const MAX_TRACKED_KEYS = 5000;
|
|
|
|
function sweepExpired(now: number) {
|
|
for (const [key, bucket] of buckets) {
|
|
if (bucket.resetAt < now) buckets.delete(key);
|
|
}
|
|
}
|
|
|
|
export function checkRateLimit(key: string, opts: { max: number; windowMs: number }): boolean {
|
|
const now = Date.now();
|
|
if (buckets.size > MAX_TRACKED_KEYS) sweepExpired(now);
|
|
|
|
const bucket = buckets.get(key);
|
|
if (!bucket || bucket.resetAt < now) {
|
|
buckets.set(key, { count: 1, resetAt: now + opts.windowMs });
|
|
return true;
|
|
}
|
|
if (bucket.count >= opts.max) return false;
|
|
bucket.count += 1;
|
|
return true;
|
|
}
|
|
|
|
export function getClientIp(request: Request): string {
|
|
const forwarded = request.headers.get("x-forwarded-for");
|
|
if (forwarded) return forwarded.split(",")[0]!.trim();
|
|
return "unknown";
|
|
}
|