desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)
Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.
This commit is contained in:
78 files changed
+4908
-1430
No files matched your search
@@ -0,0 +1,47 @@
|
||||
import { afterEach, describe, expect, it, vi } from "vitest";
|
||||
import { GET } from "@/app/api/discord-app/[id]/route";
|
||||
|
||||
afterEach(() => {
|
||||
vi.unstubAllGlobals();
|
||||
vi.restoreAllMocks();
|
||||
});
|
||||
|
||||
function contextWith(id: string) {
|
||||
return { params: Promise.resolve({ id }) };
|
||||
}
|
||||
|
||||
describe("GET /api/discord-app/[id]", () => {
|
||||
it("returns 400 for non-numeric ids", async () => {
|
||||
const response = await GET(
|
||||
new Request("https://fristy.net/api/discord-app/abc"),
|
||||
contextWith("abc"),
|
||||
);
|
||||
expect(response.status).toBe(400);
|
||||
});
|
||||
|
||||
it("returns 404 when the app is unknown", async () => {
|
||||
vi.stubGlobal(
|
||||
"fetch",
|
||||
vi.fn(async () => ({ ok: false, status: 404 })),
|
||||
);
|
||||
const response = await GET(
|
||||
new Request("https://fristy.net/api/discord-app/123"),
|
||||
contextWith("123"),
|
||||
);
|
||||
expect(response.status).toBe(404);
|
||||
});
|
||||
|
||||
it("returns 502 when upstream networking fails", async () => {
|
||||
vi.stubGlobal(
|
||||
"fetch",
|
||||
vi.fn(async () => {
|
||||
throw new Error("down");
|
||||
}),
|
||||
);
|
||||
const response = await GET(
|
||||
new Request("https://fristy.net/api/discord-app/123"),
|
||||
contextWith("123"),
|
||||
);
|
||||
expect(response.status).toBe(502);
|
||||
});
|
||||
});
|
||||
@@ -1,37 +1,32 @@
|
||||
import { NextResponse } from "next/server";
|
||||
import { corsHeaders, forbidden, isAllowedOrigin } from "@/lib/api-cors";
|
||||
import { getDiscordAppInfo } from "@/lib/lanyard";
|
||||
import { getDiscordAppInfo } from "@/lib/game/discord-app";
|
||||
import {
|
||||
invalidIdResponse,
|
||||
jsonErrorWithCors,
|
||||
jsonWithCors,
|
||||
parseAppId,
|
||||
requestOrigin,
|
||||
} from "@/lib/api-route";
|
||||
import { warnDev } from "@/lib/log";
|
||||
import type { NextResponse } from "next/server";
|
||||
|
||||
export async function OPTIONS(request: Request) {
|
||||
if (!isAllowedOrigin(request)) {
|
||||
return forbidden();
|
||||
export async function GET(
|
||||
request: Request,
|
||||
context: { params: Promise<{ id: string }> },
|
||||
): Promise<NextResponse> {
|
||||
const origin = requestOrigin(request);
|
||||
const id = await parseAppId(context);
|
||||
if (!id) {
|
||||
return invalidIdResponse(origin);
|
||||
}
|
||||
return new NextResponse(null, {
|
||||
status: 204,
|
||||
headers: {
|
||||
...corsHeaders(),
|
||||
"Access-Control-Allow-Methods": "GET, OPTIONS",
|
||||
"Access-Control-Max-Age": "86400",
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export async function GET(request: Request, context: { params: Promise<{ id: string }> }) {
|
||||
if (!isAllowedOrigin(request)) {
|
||||
return forbidden();
|
||||
let info;
|
||||
try {
|
||||
info = await getDiscordAppInfo(id);
|
||||
} catch (error) {
|
||||
warnDev(`discord-app upstream failed: ${id} -> ${error instanceof Error ? error.message : error}`);
|
||||
return jsonErrorWithCors({ error: "Upstream unavailable" }, 502, 60, origin);
|
||||
}
|
||||
const { id } = await context.params;
|
||||
if (!/^\d+$/.test(id)) {
|
||||
return NextResponse.json({ error: "Invalid application id" }, { status: 400 });
|
||||
}
|
||||
const info = await getDiscordAppInfo(id);
|
||||
if (!info) {
|
||||
return NextResponse.json({ error: "Application not found" }, { status: 404 });
|
||||
return jsonErrorWithCors({ error: "Application not found" }, 404, 60, origin);
|
||||
}
|
||||
return NextResponse.json(info, {
|
||||
headers: {
|
||||
"Cache-Control": "public, s-maxage=86400, stale-while-revalidate=86400",
|
||||
...corsHeaders(),
|
||||
},
|
||||
});
|
||||
return jsonWithCors(info, 86400, origin);
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
import { afterEach, describe, expect, it, vi } from "vitest";
|
||||
import { GET } from "@/app/api/game/[id]/route";
|
||||
|
||||
afterEach(() => {
|
||||
vi.unstubAllGlobals();
|
||||
vi.restoreAllMocks();
|
||||
});
|
||||
|
||||
function contextWith(id: string) {
|
||||
return { params: Promise.resolve({ id }) };
|
||||
}
|
||||
|
||||
function requestWith(url: string) {
|
||||
return new Request(url);
|
||||
}
|
||||
|
||||
describe("GET /api/game/[id]", () => {
|
||||
it("returns 400 for non-numeric ids", async () => {
|
||||
const response = await GET(
|
||||
requestWith("https://fristy.net/api/game/abc"),
|
||||
contextWith("abc"),
|
||||
);
|
||||
expect(response.status).toBe(400);
|
||||
expect(response.headers.get("Access-Control-Allow-Origin")).toBe("https://fristy.net");
|
||||
});
|
||||
|
||||
it("returns 404 when no profile resolves", async () => {
|
||||
vi.stubGlobal(
|
||||
"fetch",
|
||||
vi.fn(async () => ({ ok: false, status: 404 })),
|
||||
);
|
||||
const response = await GET(
|
||||
requestWith("https://fristy.net/api/game/123"),
|
||||
contextWith("123"),
|
||||
);
|
||||
expect(response.status).toBe(404);
|
||||
});
|
||||
|
||||
it("returns 502 when upstream networking fails", async () => {
|
||||
vi.stubGlobal(
|
||||
"fetch",
|
||||
vi.fn(async () => {
|
||||
throw new Error("down");
|
||||
}),
|
||||
);
|
||||
const response = await GET(
|
||||
requestWith("https://fristy.net/api/game/123"),
|
||||
contextWith("123"),
|
||||
);
|
||||
expect(response.status).toBe(502);
|
||||
expect(response.headers.get("Access-Control-Allow-Origin")).toBe("https://fristy.net");
|
||||
});
|
||||
});
|
||||
+32
-39
@@ -1,44 +1,37 @@
|
||||
import { NextResponse } from "next/server";
|
||||
import { corsHeaders, forbidden, isAllowedOrigin } from "@/lib/api-cors";
|
||||
import { getGameProfile } from "@/lib/game-profile";
|
||||
import {
|
||||
invalidIdResponse,
|
||||
jsonErrorWithCors,
|
||||
jsonWithCors,
|
||||
parseAppId,
|
||||
requestOrigin,
|
||||
} from "@/lib/api-route";
|
||||
import { resolveGameLocale } from "@/lib/game/game-format";
|
||||
import { getGameProfile } from "@/lib/game/game-profile";
|
||||
import { warnDev } from "@/lib/log";
|
||||
import type { NextResponse } from "next/server";
|
||||
|
||||
export async function OPTIONS(request: Request) {
|
||||
if (!isAllowedOrigin(request)) {
|
||||
return forbidden();
|
||||
}
|
||||
return new NextResponse(null, {
|
||||
status: 204,
|
||||
headers: {
|
||||
...corsHeaders(),
|
||||
"Access-Control-Allow-Methods": "GET, OPTIONS",
|
||||
"Access-Control-Max-Age": "86400",
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export async function GET(request: Request, context: { params: Promise<{ id: string }> }) {
|
||||
if (!isAllowedOrigin(request)) {
|
||||
return forbidden();
|
||||
}
|
||||
const { id } = await context.params;
|
||||
if (!/^\d+$/.test(id)) {
|
||||
return NextResponse.json({ error: "Invalid application id" }, { status: 400 });
|
||||
export async function GET(
|
||||
request: Request,
|
||||
context: { params: Promise<{ id: string }> },
|
||||
): Promise<NextResponse> {
|
||||
const origin = requestOrigin(request);
|
||||
const id = await parseAppId(context);
|
||||
if (!id) {
|
||||
return invalidIdResponse(origin);
|
||||
}
|
||||
const { searchParams } = new URL(request.url);
|
||||
const country = /^[A-Z]{2}$/.test(searchParams.get("country") ?? "")
|
||||
? (searchParams.get("country") as string)
|
||||
: "TR";
|
||||
const lang = ["tr", "en", "de"].includes(searchParams.get("lang") ?? "")
|
||||
? (searchParams.get("lang") as string)
|
||||
: "en";
|
||||
const profile = await getGameProfile(id, country, lang);
|
||||
if (!profile) {
|
||||
return NextResponse.json({ error: "Game not found" }, { status: 404 });
|
||||
const countryRaw = searchParams.get("country") ?? "";
|
||||
const country = /^[A-Z]{2}$/.test(countryRaw) ? countryRaw : "TR";
|
||||
const { lang } = resolveGameLocale(searchParams.get("lang") ?? "");
|
||||
let profile;
|
||||
try {
|
||||
profile = await getGameProfile(id, lang, country);
|
||||
} catch (error) {
|
||||
warnDev(`game upstream failed: ${id} -> ${error instanceof Error ? error.message : error}`);
|
||||
return jsonErrorWithCors({ error: "Upstream unavailable" }, 502, 60, origin);
|
||||
}
|
||||
return NextResponse.json(profile, {
|
||||
headers: {
|
||||
"Cache-Control": "public, s-maxage=3600, stale-while-revalidate=86400",
|
||||
...corsHeaders(),
|
||||
},
|
||||
});
|
||||
if (!profile) {
|
||||
return jsonErrorWithCors({ error: "Game not found" }, 404, 60, origin);
|
||||
}
|
||||
return jsonWithCors(profile, 3600, origin);
|
||||
}
|
||||
Reference in new issue
Block a user