Andrew S Erwin
4e421f6ea2
release gate / check (push) Failing after 6m43s
High severity: - wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup - bucket public rate limits on effective client IP, add per-bookmark budget, and forward the signed browser identity from the share page - disable first-run bootstrap in server deployments and document seeding - serialize last-admin demotion in one advisory-locked transaction Medium/low: - cap and batch share recipient inserts - add a shared outbound budget for preview/CardDAV/IMAP/signal work - pin CardDAV dials to 443 and bound IMAP logout - fix rightward kanban column drags and normalize cards on column delete - classify backend outages in auth guards, add request timeouts and an error boundary, remove the dead login route, surface throttling - enforce pinned/unpinned page reorder grouping server-side - avoid preview work for stale bookmark versions; drop duplicate dialog fetch - sequence-guard collection/tag/calendar/quick-find loads - validate property config and fix MULTI_SELECT/DATE filter inputs - document index maintenance; apply same-origin check to sign-out - trim signup names, unique shared dates and kanban keys (migration 010), reset reference cache on identity changes, hide OIDC issuer, return 413 for oversized direct bodies, escape Markdown link destinations - remove dead template files and duplicate test helper Verified with go build/vet, full PostgreSQL race suite, db convergence, tsc, both ESLint configs and a Next production build.
28 lines
1.3 KiB
TypeScript
28 lines
1.3 KiB
TypeScript
// Review H-1: the proxy-attested client IP is what gives every browser its
|
|
// own login/signup/public-endpoint rate-limit bucket. It only works when the
|
|
// Next server trusts the proxy that pins X-Real-IP. A TLS deployment without
|
|
// that switch silently puts every client in the web container's bucket, so
|
|
// warn loudly at startup instead of waiting for an outage caused by one
|
|
// caller exhausting the instance limit.
|
|
export async function register() {
|
|
// Runs for both the Node and Edge runtimes; env diagnostics only apply to
|
|
// the server process.
|
|
if (process.env.NEXT_RUNTIME !== 'nodejs') return
|
|
const url = process.env.NEXTAUTH_URL || ''
|
|
const trusted = process.env.TRUSTED_PROXY === '1'
|
|
if (url.startsWith('https://') && !trusted) {
|
|
console.warn(
|
|
'[config] NEXTAUTH_URL is HTTPS but TRUSTED_PROXY is not 1. All clients ' +
|
|
'share the web container rate-limit bucket; set TRUSTED_PROXY=1 when a ' +
|
|
'proxy in front of web overwrites X-Real-IP (see RUNNING.md).',
|
|
)
|
|
}
|
|
if (trusted && !url.startsWith('https://')) {
|
|
console.warn(
|
|
'[config] TRUSTED_PROXY=1 is set for a non-HTTPS NEXTAUTH_URL. Only do ' +
|
|
'this when the proxy is the sole route to this server; otherwise ' +
|
|
'clients can spoof X-Real-IP and choose their rate-limit identity.',
|
|
)
|
|
}
|
|
}
|