Andrew S Erwin
4e421f6ea2
release gate / check (push) Failing after 6m43s
High severity: - wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup - bucket public rate limits on effective client IP, add per-bookmark budget, and forward the signed browser identity from the share page - disable first-run bootstrap in server deployments and document seeding - serialize last-admin demotion in one advisory-locked transaction Medium/low: - cap and batch share recipient inserts - add a shared outbound budget for preview/CardDAV/IMAP/signal work - pin CardDAV dials to 443 and bound IMAP logout - fix rightward kanban column drags and normalize cards on column delete - classify backend outages in auth guards, add request timeouts and an error boundary, remove the dead login route, surface throttling - enforce pinned/unpinned page reorder grouping server-side - avoid preview work for stale bookmark versions; drop duplicate dialog fetch - sequence-guard collection/tag/calendar/quick-find loads - validate property config and fix MULTI_SELECT/DATE filter inputs - document index maintenance; apply same-origin check to sign-out - trim signup names, unique shared dates and kanban keys (migration 010), reset reference cache on identity changes, hide OIDC issuer, return 413 for oversized direct bodies, escape Markdown link destinations - remove dead template files and duplicate test helper Verified with go build/vet, full PostgreSQL race suite, db convergence, tsc, both ESLint configs and a Next production build.
22 lines
915 B
TypeScript
22 lines
915 B
TypeScript
import { apiBase, forwardedClientHeaders } from '@/lib/api'
|
|
import { headers } from 'next/headers'
|
|
import { notFound } from 'next/navigation'
|
|
import { PublicBookmarkView } from './client'
|
|
|
|
export default async function PublicSharePage({ params }: { params: Promise<{ id: string }> }) {
|
|
const { id } = await params
|
|
|
|
// Review H-2: pass the attested browser identity through to Go. Without it
|
|
// every server-rendered share view shares the web container's public
|
|
// rate-limit bucket, so one hot link (or one client) could exhaust it.
|
|
const response = await fetch(`${apiBase()}/api/public/bookmarks/${encodeURIComponent(id)}`, {
|
|
cache: 'no-store',
|
|
headers: forwardedClientHeaders(await headers()),
|
|
signal: AbortSignal.timeout(10_000),
|
|
})
|
|
if (!response.ok) notFound()
|
|
const bookmark = await response.json()
|
|
|
|
return <PublicBookmarkView bookmark={JSON.parse(JSON.stringify(bookmark))} />
|
|
}
|