maro
82c4261a81
- Restrict meetingPassword field so it isn't leaked via the public REST/GraphQL API - Fix booking slot computation to use Europe/Berlin time instead of the server's UTC clock - Reset email verification when a customer changes their email address - Fix ICS calendar injection via unescaped carriage returns in event descriptions - Bind WebRTC meeting kicks to a persistent client id so they survive a rejoin - Move the meeting signaling token out of the WebSocket query string into the first message - Prevent duplicate signaling connections from leaking when the same participant reconnects - Use the rightmost X-Forwarded-For entry for rate limiting (single trusted reverse proxy) - Use constant-time comparison for the cron endpoint's bearer token - Remove SVG from allowed Media upload types (stored-XSS risk, unused anyway) - Add baseline security headers and a CSP to next.config.ts - Fix CI/CD script injection via unsanitized git ref names in release.yml
37 lines
1.2 KiB
TypeScript
37 lines
1.2 KiB
TypeScript
import { timingSafeEqual } from "node:crypto";
|
|
import { NextResponse } from "next/server";
|
|
import { runEventReminders } from "@/lib/meeting/reminders";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
function safeEqual(a: string, b: string): boolean {
|
|
const bufA = Buffer.from(a);
|
|
const bufB = Buffer.from(b);
|
|
if (bufA.length !== bufB.length) return false;
|
|
return timingSafeEqual(bufA, bufB);
|
|
}
|
|
|
|
/**
|
|
* Intended to be called by an external cron job every few minutes, e.g.:
|
|
* curl -H "Authorization: Bearer $CRON_SECRET" https://anouma.org/api/cron/event-reminders
|
|
*/
|
|
export async function GET(request: Request) {
|
|
const secret = process.env.CRON_SECRET;
|
|
if (!secret) {
|
|
return NextResponse.json({ error: "CRON_SECRET is not configured" }, { status: 500 });
|
|
}
|
|
|
|
const authHeader = request.headers.get("authorization");
|
|
if (!authHeader || !safeEqual(authHeader, `Bearer ${secret}`)) {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
|
|
try {
|
|
const result = await runEventReminders();
|
|
return NextResponse.json({ ok: true, ...result });
|
|
} catch (error) {
|
|
console.error("event-reminders cron failed", error);
|
|
return NextResponse.json({ error: "Internal error" }, { status: 500 });
|
|
}
|
|
}
|