217 lines
9.9 KiB
TypeScript
217 lines
9.9 KiB
TypeScript
import { Elysia, t } from "elysia";
|
|
import { requireAuth } from "./auth";
|
|
import sql from "../db";
|
|
|
|
const Theme = t.Union([t.Literal("auto"), t.Literal("light"), t.Literal("dark")]);
|
|
const BarFrequency = t.Union([t.Literal("hourly"), t.Literal("daily")]);
|
|
|
|
const StatusPageBody = t.Object({
|
|
slug: t.String({ minLength: 1, maxLength: 80, pattern: "^[a-z0-9][a-z0-9-]*$", description: "URL slug, lowercase + hyphens" }),
|
|
title: t.String({ minLength: 1, maxLength: 200 }),
|
|
description: t.Optional(t.Nullable(t.String({ maxLength: 2000 }))),
|
|
theme: t.Optional(Theme),
|
|
password: t.Optional(t.Nullable(t.String({ description: "Plain text. Will be hashed at write time. Pass null to clear." }))),
|
|
index_search: t.Optional(t.Boolean()),
|
|
show_powered_by: t.Optional(t.Boolean()),
|
|
show_response_time: t.Optional(t.Boolean()),
|
|
bar_frequency: t.Optional(BarFrequency),
|
|
bar_count: t.Optional(t.Number({ minimum: 1, maximum: 180 })),
|
|
custom_domain: t.Optional(t.Nullable(t.String({ maxLength: 253 }))),
|
|
custom_css: t.Optional(t.Nullable(t.String({ maxLength: 50_000 }))),
|
|
footer_text: t.Optional(t.Nullable(t.String({ maxLength: 5000 }))),
|
|
auto_refresh_s: t.Optional(t.Number({ minimum: 10, maximum: 3600 })),
|
|
groups: t.Optional(t.Array(t.Object({
|
|
name: t.String({ minLength: 1, maxLength: 200 }),
|
|
position: t.Optional(t.Number()),
|
|
}))),
|
|
monitors: t.Optional(t.Array(t.Object({
|
|
monitor_id: t.String(),
|
|
group_index: t.Optional(t.Nullable(t.Number())),
|
|
display_name: t.Optional(t.Nullable(t.String({ maxLength: 200 }))),
|
|
position: t.Optional(t.Number()),
|
|
}))),
|
|
});
|
|
|
|
// Strip @import and expression() from custom CSS - basic sanity, not a full
|
|
// parser. The CSS still runs in the visitor's browser; this just blocks the
|
|
// most common smuggling vectors.
|
|
function sanitizeCss(css: string | null | undefined): string | null {
|
|
if (!css) return null;
|
|
return css
|
|
.replace(/@import[^;]*;?/gi, "")
|
|
.replace(/expression\s*\(/gi, "");
|
|
}
|
|
|
|
async function hashPassword(plain: string): Promise<string> {
|
|
return await Bun.password.hash(plain, { algorithm: "bcrypt", cost: 10 });
|
|
}
|
|
|
|
async function replaceGroupsAndMonitors(
|
|
pageId: string,
|
|
accountId: string,
|
|
groups: { name: string; position?: number }[] | undefined,
|
|
monitorsList: { monitor_id: string; group_index?: number | null; display_name?: string | null; position?: number }[] | undefined,
|
|
) {
|
|
if (groups !== undefined) {
|
|
await sql`DELETE FROM status_page_groups WHERE status_page_id = ${pageId}`;
|
|
}
|
|
// Single bulk INSERT instead of one round-trip per group. The RETURNING set
|
|
// comes back in INSERT order, which equals the array order - that lets us
|
|
// map index → id without a follow-up SELECT. Mirrors the bulk insert pattern
|
|
// used by the monitors block right below.
|
|
const groupIds: string[] = [];
|
|
if (groups && groups.length > 0) {
|
|
const rows = groups.map((g, i) => ({
|
|
status_page_id: pageId,
|
|
name: g.name,
|
|
position: g.position ?? i,
|
|
}));
|
|
const inserted = await sql<{ id: string }[]>`
|
|
INSERT INTO status_page_groups ${sql(rows, "status_page_id", "name", "position")}
|
|
RETURNING id
|
|
`;
|
|
for (const r of inserted) groupIds.push(r.id);
|
|
}
|
|
|
|
if (monitorsList !== undefined) {
|
|
await sql`DELETE FROM status_page_monitors WHERE status_page_id = ${pageId}`;
|
|
}
|
|
if (monitorsList && monitorsList.length > 0) {
|
|
// Validate that the monitors all belong to this account.
|
|
const monitorIds = monitorsList.map((m) => m.monitor_id);
|
|
const owned = await sql<{ id: string }[]>`
|
|
SELECT id FROM monitors
|
|
WHERE account_id = ${accountId} AND id = ANY(${sql.array(monitorIds)}::text[])
|
|
`;
|
|
const ownedSet = new Set(owned.map((o) => o.id));
|
|
const rows: any[] = [];
|
|
for (let i = 0; i < monitorsList.length; i++) {
|
|
const m = monitorsList[i]!;
|
|
if (!ownedSet.has(m.monitor_id)) continue;
|
|
const groupId = m.group_index != null && groupIds[m.group_index] ? groupIds[m.group_index] : null;
|
|
rows.push({
|
|
status_page_id: pageId,
|
|
monitor_id: m.monitor_id,
|
|
group_id: groupId,
|
|
display_name: m.display_name ?? null,
|
|
position: m.position ?? i,
|
|
});
|
|
}
|
|
if (rows.length > 0) {
|
|
await sql`
|
|
INSERT INTO status_page_monitors ${sql(rows, "status_page_id", "monitor_id", "group_id", "display_name", "position")}
|
|
`;
|
|
}
|
|
}
|
|
}
|
|
|
|
export const statusPages = new Elysia({ prefix: "/pages" })
|
|
.use(requireAuth)
|
|
|
|
.get("/", async ({ accountId }) => {
|
|
return sql`
|
|
SELECT id, slug, title, description, theme, created_at, updated_at
|
|
FROM status_pages
|
|
WHERE account_id = ${accountId}
|
|
ORDER BY created_at DESC
|
|
`;
|
|
}, { detail: { summary: "List status pages", tags: ["status-pages"] } })
|
|
|
|
.post("/", async ({ accountId, body, set }) => {
|
|
const password_hash = body.password ? await hashPassword(body.password) : null;
|
|
const css = sanitizeCss(body.custom_css);
|
|
let row;
|
|
try {
|
|
[row] = await sql`
|
|
INSERT INTO status_pages (
|
|
account_id, slug, title, description, theme, password_hash, index_search,
|
|
show_powered_by, show_response_time,
|
|
bar_frequency, bar_count,
|
|
custom_domain, custom_css, footer_text, auto_refresh_s
|
|
)
|
|
VALUES (
|
|
${accountId}, ${body.slug}, ${body.title}, ${body.description ?? null},
|
|
${body.theme ?? 'auto'}, ${password_hash}, ${body.index_search ?? true},
|
|
${body.show_powered_by ?? true}, ${body.show_response_time ?? true},
|
|
${body.bar_frequency ?? 'daily'}, ${body.bar_count ?? 90},
|
|
${body.custom_domain || null}, ${css}, ${body.footer_text ?? null},
|
|
${body.auto_refresh_s ?? 60}
|
|
)
|
|
RETURNING *
|
|
`;
|
|
} catch (e: any) {
|
|
if (e?.code === "23505") { set.status = 409; return { error: "Slug already in use" }; }
|
|
throw e;
|
|
}
|
|
await replaceGroupsAndMonitors(row.id, accountId, body.groups, body.monitors);
|
|
return row;
|
|
}, { body: StatusPageBody, detail: { summary: "Create status page", tags: ["status-pages"] } })
|
|
|
|
.get("/:id", async ({ accountId, params, set }) => {
|
|
const [page] = await sql`
|
|
SELECT * FROM status_pages WHERE id = ${params.id} AND account_id = ${accountId}
|
|
`;
|
|
if (!page) { set.status = 404; return { error: "Not found" }; }
|
|
const groups = await sql`
|
|
SELECT id, name, position FROM status_page_groups
|
|
WHERE status_page_id = ${page.id} ORDER BY position ASC
|
|
`;
|
|
const monitors = await sql`
|
|
SELECT spm.monitor_id, spm.group_id, spm.display_name, spm.position, m.name, m.url
|
|
FROM status_page_monitors spm
|
|
JOIN monitors m ON m.id = spm.monitor_id
|
|
WHERE spm.status_page_id = ${page.id}
|
|
ORDER BY spm.position ASC
|
|
`;
|
|
delete (page as any).password_hash;
|
|
return { ...page, has_password: !!(page as any).password_hash || false, groups, monitors };
|
|
}, { detail: { summary: "Get status page", tags: ["status-pages"] } })
|
|
|
|
.patch("/:id", async ({ accountId, params, body, set }) => {
|
|
const password_hash =
|
|
body.password === undefined ? null
|
|
: body.password === null ? null
|
|
: await hashPassword(body.password);
|
|
const css = body.custom_css === undefined ? null : sanitizeCss(body.custom_css);
|
|
let row;
|
|
try {
|
|
[row] = await sql`
|
|
UPDATE status_pages SET
|
|
slug = COALESCE(${body.slug ?? null}, slug),
|
|
title = COALESCE(${body.title ?? null}, title),
|
|
description = COALESCE(${body.description ?? null}, description),
|
|
theme = COALESCE(${body.theme ?? null}, theme),
|
|
password_hash = CASE WHEN ${body.password === null} THEN NULL
|
|
WHEN ${body.password !== undefined} THEN ${password_hash}
|
|
ELSE password_hash END,
|
|
index_search = COALESCE(${body.index_search ?? null}, index_search),
|
|
show_powered_by = COALESCE(${body.show_powered_by ?? null}, show_powered_by),
|
|
show_response_time = COALESCE(${body.show_response_time ?? null}, show_response_time),
|
|
bar_frequency = COALESCE(${body.bar_frequency ?? null}, bar_frequency),
|
|
bar_count = COALESCE(${body.bar_count ?? null}, bar_count),
|
|
custom_domain = CASE WHEN ${body.custom_domain !== undefined} THEN ${body.custom_domain || null} ELSE custom_domain END,
|
|
custom_css = CASE WHEN ${body.custom_css !== undefined} THEN ${css} ELSE custom_css END,
|
|
footer_text = COALESCE(${body.footer_text ?? null}, footer_text),
|
|
auto_refresh_s = COALESCE(${body.auto_refresh_s ?? null}, auto_refresh_s),
|
|
updated_at = now()
|
|
WHERE id = ${params.id} AND account_id = ${accountId}
|
|
RETURNING *
|
|
`;
|
|
} catch (e: any) {
|
|
if (e?.code === "23505") { set.status = 409; return { error: "Slug already in use" }; }
|
|
throw e;
|
|
}
|
|
if (!row) { set.status = 404; return { error: "Not found" }; }
|
|
await replaceGroupsAndMonitors(row.id, accountId, body.groups, body.monitors);
|
|
return row;
|
|
}, { body: t.Partial(StatusPageBody), detail: { summary: "Update status page", tags: ["status-pages"] } })
|
|
|
|
.delete("/:id", async ({ accountId, params, set }) => {
|
|
const [row] = await sql`
|
|
DELETE FROM status_pages WHERE id = ${params.id} AND account_id = ${accountId}
|
|
RETURNING id
|
|
`;
|
|
if (!row) { set.status = 404; return { error: "Not found" }; }
|
|
return { deleted: true };
|
|
}, { detail: { summary: "Delete status page", tags: ["status-pages"] } });
|