ADDED - Admin SEO page, robots/sitemap hardening and media/maintenance security fixes
SEO - New Settings > SEO admin page (seo_settings in app_config): indexing switch, Google/Bing verification, X handle, JSON-LD identity (Person/Organization, sameAs), per-locale keywords, readiness checklist and open links for sitemap.xml / robots.txt / manifest. - robots.txt is now dynamic: disallows admin, api, success and coming-soon paths; blocks everything while indexing is off or maintenance is on. - sitemap.xml carries hreflang alternates per URL, lists only categories with published projects, and is empty while hidden. - Metadata: robots + verification meta, og:locale in de_DE/en_US/ar_AR form, alternateLocale, twitter site/creator, project cover as OG image with article type, noindex on /success and /coming-soon. - JSON-LD: WebSite + publisher graph on all public pages, CreativeWork per project (view-mode independent). Security - Maintenance bypass now requires a correctly signed admin cookie; the middleware previously only checked the cookie existed. Token helpers moved to lib/admin-session-token.ts (shared by proxy.ts and lib/admin-auth.ts). - Media uploads: magic-byte validation against the declared type, SVG sanitization (script/handlers/foreignObject/javascript: rejected), upload folder sanitized, kind inferred from the real file. - Media route: fixed prefix-based path check that accepted sibling directories, unknown extensions return 404, nosniff header, CSP sandbox on SVG, gif content type added. - External media URLs: protocol-relative (//host) URLs rejected. Portfolio - Project and category slugs share /portfolio/[slug]; saving now rejects a slug already used on the other side instead of silently shadowing it. Tooling/docs - Lint: ignore scripts/legacy-prisma-seed.cjs, drop unused import. - New docs/SEO.md; FEATURES, ARCHITECTURE (Drizzle instead of Prisma), admin spec and CLAUDE.md updated. - Tests for all of the above (unit + integration); suite green.
This commit is contained in:
moh
@@ -32,7 +32,7 @@ describe("createMediaAssetAction", () => {
|
||||
});
|
||||
|
||||
it.skipIf(!canManageUploads)("creates an asset from an uploaded file", async () => {
|
||||
const file = new File([new Uint8Array([0x89, 0x50, 0x4e, 0x47])], "pic.png", { type: "image/png" });
|
||||
const file = new File([new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])], "pic.png", { type: "image/png" });
|
||||
const url = await captureRedirect(() =>
|
||||
createMediaAssetAction(formDataFrom({ kind: "IMAGE", label: "Pic", file })),
|
||||
);
|
||||
@@ -43,6 +43,15 @@ describe("createMediaAssetAction", () => {
|
||||
await removeManagedMediaFile(assets[0].url);
|
||||
});
|
||||
|
||||
it("rejects an upload whose bytes do not match the declared image type", async () => {
|
||||
const file = new File(["<html><script>alert(1)</script></html>"], "evil.png", { type: "image/png" });
|
||||
const url = await captureRedirect(() =>
|
||||
createMediaAssetAction(formDataFrom({ kind: "IMAGE", label: "Evil", file })),
|
||||
);
|
||||
expect(url).toContain("error=");
|
||||
expect((await db.select().from(mediaAsset)).length).toBe(0);
|
||||
});
|
||||
|
||||
it("redirects unauthenticated callers to the admin root", async () => {
|
||||
adminAuth.authenticated = false;
|
||||
const url = await captureRedirect(() => createMediaAssetAction(formDataFrom({ kind: "IMAGE", label: "L" })));
|
||||
|
||||
@@ -104,6 +104,14 @@ describe("upsertCategoryAction", () => {
|
||||
expect(category?.nameEn).toBe("Renamed");
|
||||
});
|
||||
|
||||
it("rejects a category slug that already belongs to a project", async () => {
|
||||
const other = await createCategory({ slug: "other" });
|
||||
await createProject({ categoryId: other.id, slug: "taken" });
|
||||
const url = await captureRedirect(() => upsertCategoryAction(categoryForm({ slug: "taken" })));
|
||||
expect(new URL(url, "http://test").searchParams.get("error")).toContain("Projekt Slug vergeben");
|
||||
expect(await db.query.category.findFirst({ where: eq(categoryTable.slug, "taken") })).toBeUndefined();
|
||||
});
|
||||
|
||||
it("reports a unique-constraint violation on duplicate slugs", async () => {
|
||||
await createCategory({ slug: "branding" });
|
||||
const url = await captureRedirect(() => upsertCategoryAction(categoryForm({ slug: "branding" })));
|
||||
@@ -141,6 +149,13 @@ describe("deleteCategoryAction", () => {
|
||||
});
|
||||
|
||||
describe("saveProjectAction", () => {
|
||||
it("rejects a project slug that already belongs to a category", async () => {
|
||||
const category = await createCategory({ slug: "branding" });
|
||||
const url = await captureRedirect(() => saveProjectAction(projectForm(category.id, { slug: "branding" })));
|
||||
expect(new URL(url, "http://test").searchParams.get("error")).toContain("Kategorie Slug vergeben");
|
||||
expect(await db.query.portfolioProject.findFirst({ where: eq(portfolioProjectTable.slug, "branding") })).toBeUndefined();
|
||||
});
|
||||
|
||||
it("creates a published project with cover and asset media usages", async () => {
|
||||
const category = await createCategory();
|
||||
const url = await captureRedirect(() => saveProjectAction(projectForm(category.id)));
|
||||
|
||||
@@ -11,10 +11,11 @@ vi.mock("@/lib/admin-auth", async () => {
|
||||
});
|
||||
|
||||
import {
|
||||
saveSeoSettingsAction,
|
||||
saveSiteBrandSettingsAction,
|
||||
saveSiteLocalizationSettingsAction,
|
||||
} from "@/app/_admin/site-settings/actions";
|
||||
import { getSiteSettings, getSiteSettingsMediaBindings } from "@/lib/app-config";
|
||||
import { getSeoSettings, getSiteSettings, getSiteSettingsMediaBindings } from "@/lib/app-config";
|
||||
import { adminAuth, captureRedirect, formDataFrom, resetNextMocks } from "@/tests/helpers/next-mocks";
|
||||
|
||||
beforeEach(() => {
|
||||
@@ -102,3 +103,51 @@ describe("saveSiteLocalizationSettingsAction", () => {
|
||||
expect(url).toBe("/");
|
||||
});
|
||||
});
|
||||
|
||||
describe("saveSeoSettingsAction", () => {
|
||||
it("persists normalized seo settings", async () => {
|
||||
const url = await captureRedirect(() =>
|
||||
saveSeoSettingsAction(
|
||||
formDataFrom({
|
||||
allowIndexing: "on",
|
||||
googleSiteVerification: "g-1",
|
||||
twitterHandle: "moh",
|
||||
structuredDataType: "Organization",
|
||||
structuredDataName: "Studio",
|
||||
sameAs: "https://a.com\nhttps://b.com",
|
||||
keywordsDe: "a, b",
|
||||
}),
|
||||
),
|
||||
);
|
||||
expect(url).toContain("success=");
|
||||
const seo = await getSeoSettings();
|
||||
expect(seo).toMatchObject({
|
||||
allowIndexing: true,
|
||||
googleSiteVerification: "g-1",
|
||||
twitterHandle: "@moh",
|
||||
structuredDataType: "Organization",
|
||||
sameAs: ["https://a.com", "https://b.com"],
|
||||
});
|
||||
expect(seo.locales.de.keywords).toBe("a, b");
|
||||
});
|
||||
|
||||
it("turns indexing off when the checkbox is missing", async () => {
|
||||
await captureRedirect(() => saveSeoSettingsAction(formDataFrom({})));
|
||||
expect((await getSeoSettings()).allowIndexing).toBe(false);
|
||||
});
|
||||
|
||||
it("rejects an invalid verification token without saving", async () => {
|
||||
await captureRedirect(() => saveSeoSettingsAction(formDataFrom({ allowIndexing: "on", googleSiteVerification: "ok" })));
|
||||
const url = await captureRedirect(() =>
|
||||
saveSeoSettingsAction(formDataFrom({ allowIndexing: "on", googleSiteVerification: "<bad>" })),
|
||||
);
|
||||
expect(url).toContain("error=");
|
||||
expect((await getSeoSettings()).googleSiteVerification).toBe("ok");
|
||||
});
|
||||
|
||||
it("redirects unauthenticated users", async () => {
|
||||
adminAuth.authenticated = false;
|
||||
const url = await captureRedirect(() => saveSeoSettingsAction(formDataFrom({})));
|
||||
expect(url).not.toContain("success=");
|
||||
});
|
||||
});
|
||||
|
||||
@@ -102,7 +102,7 @@ describe("resolveMediaSelection — missing configuration", () => {
|
||||
|
||||
describe("resolveMediaSelection — upload mode (filesystem)", () => {
|
||||
it.skipIf(!canManageUploads)("saves the file and creates an UPLOAD asset", async () => {
|
||||
const file = new File([new Uint8Array([0x89, 0x50, 0x4e, 0x47])], "shot.png", { type: "image/png" });
|
||||
const file = new File([new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])], "shot.png", { type: "image/png" });
|
||||
const result = await resolveMediaSelection({
|
||||
media: { mode: "upload", assetId: "", url: "", label: "Shot", kind: "IMAGE" },
|
||||
uploadFile: file,
|
||||
|
||||
Reference in New Issue
Block a user