fix: improve auth

2026-04-09 07:55:38 +04:00
parent d8ecabe2e2
commit 59a29a1e63
4 changed files with 122 additions and 13 deletions
@@ -103,7 +103,11 @@ async function renderHtml(slug: string, request: Request): Promise<Response> {
  const page = await loadStatusPage(slug);
  if (!page) return notFound();
  if (!isAuthorised(page, request)) {
-    return new Response(eta.render("password", { title: page.title, slug: page.slug, error: null }), {
+    // Do NOT pass page.title to the password template — that would let any
+    // OSINT scraper iterating slugs harvest the human-readable name of every
+    // private page without ever authenticating. Slug is fine: it's already
+    // in the URL the visitor typed.
+    return new Response(eta.render("password", { slug: page.slug, error: null }), {
      status: 401,
      headers: { "content-type": "text/html; charset=utf-8", ...NO_STORE_HEADERS },
    });
@@ -302,9 +306,9 @@ const app = new Elysia()
    const password = String(form.get("password") ?? "");
    const ok = await checkPassword(password, page.password_hash);
    if (!ok) {
-      return new Response(eta.render("password", { title: page.title, slug: page.slug, error: "Wrong password" }), {
+      return new Response(eta.render("password", { slug: page.slug, error: "Wrong password" }), {
        status: 401,
-        headers: { "content-type": "text/html; charset=utf-8" },
+        headers: { "content-type": "text/html; charset=utf-8", ...NO_STORE_HEADERS },
      });
    }
    return new Response(null, {
@@ -316,7 +320,32 @@ const app = new Elysia()
 const port = Number(process.env.STATUS_PORT ?? 3003);
 const server = Bun.serve({
  port,
-  fetch(req) { return app.handle(req); },
+  // Wrap app.handle in a try/catch so any unexpected throw — Postgres
+  // connection blip, template render error, missing env var, etc. — turns
+  // into a generic 500 with an opaque body. Without this wrapper Bun's
+  // default error path may include framework details, file paths, or stack
+  // traces in the response, which would leak internal layout to anyone who
+  // could trigger an exception. We log the real reason server-side.
+  async fetch(req) {
+    try {
+      return await app.handle(req);
+    } catch (err) {
+      console.error("[fetch] unhandled error:", err);
+      return new Response("Internal server error", {
+        status: 500,
+        headers: { "content-type": "text/plain; charset=utf-8", ...NO_STORE_HEADERS },
+      });
+    }
+  },
+  error(err) {
+    // Belt-and-suspenders: even if Bun catches an error before our fetch
+    // wrapper sees it, return a generic body rather than the default page.
+    console.error("[server] error:", err);
+    return new Response("Internal server error", {
+      status: 500,
+      headers: { "content-type": "text/plain; charset=utf-8", ...NO_STORE_HEADERS },
+    });
+  },
 });

 console.log(`PingQL status service running at http://localhost:${server.port}`);
@@ -4,7 +4,7 @@
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <meta name="robots" content="noindex,nofollow">
-  <title><%= it.title %> — Password required</title>
+  <title>Password required</title>
  <style>
    body { background: #0a0a0a; color: #f1f5f9; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
    .card { background: #111827; border: 1px solid #1f2937; border-radius: 12px; padding: 2rem; max-width: 400px; width: 90%; }
@@ -19,7 +19,7 @@
 </head>
 <body>
  <div class="card">
-    <h1><%= it.title %></h1>
+    <h1>Password required</h1>
    <p>This status page is password protected.</p>
    <form method="POST" action="/<%= it.slug %>/auth">
      <input type="password" name="password" placeholder="Password" autofocus required>