ADDED - Admin SEO page, robots/sitemap hardening and media/maintenance security fixes
SEO - New Settings > SEO admin page (seo_settings in app_config): indexing switch, Google/Bing verification, X handle, JSON-LD identity (Person/Organization, sameAs), per-locale keywords, readiness checklist and open links for sitemap.xml / robots.txt / manifest. - robots.txt is now dynamic: disallows admin, api, success and coming-soon paths; blocks everything while indexing is off or maintenance is on. - sitemap.xml carries hreflang alternates per URL, lists only categories with published projects, and is empty while hidden. - Metadata: robots + verification meta, og:locale in de_DE/en_US/ar_AR form, alternateLocale, twitter site/creator, project cover as OG image with article type, noindex on /success and /coming-soon. - JSON-LD: WebSite + publisher graph on all public pages, CreativeWork per project (view-mode independent). Security - Maintenance bypass now requires a correctly signed admin cookie; the middleware previously only checked the cookie existed. Token helpers moved to lib/admin-session-token.ts (shared by proxy.ts and lib/admin-auth.ts). - Media uploads: magic-byte validation against the declared type, SVG sanitization (script/handlers/foreignObject/javascript: rejected), upload folder sanitized, kind inferred from the real file. - Media route: fixed prefix-based path check that accepted sibling directories, unknown extensions return 404, nosniff header, CSP sandbox on SVG, gif content type added. - External media URLs: protocol-relative (//host) URLs rejected. Portfolio - Project and category slugs share /portfolio/[slug]; saving now rejects a slug already used on the other side instead of silently shadowing it. Tooling/docs - Lint: ignore scripts/legacy-prisma-seed.cjs, drop unused import. - New docs/SEO.md; FEATURES, ARCHITECTURE (Drizzle instead of Prisma), admin spec and CLAUDE.md updated. - Tests for all of the above (unit + integration); suite green.
This commit is contained in:
moh
@@ -73,7 +73,7 @@ describe("getAdminNavigation", () => {
|
||||
const minimal = { ...copy, brandSettings: undefined, localizationSettings: undefined, marquee: undefined, smtp: undefined };
|
||||
const nav = getAdminNavigation(minimal, "overview");
|
||||
const siteSettings = nav.find((item) => item.label === "Site Settings");
|
||||
expect(siteSettings?.children?.map((c) => c.label)).toEqual(["Brand", "Localization"]);
|
||||
expect(siteSettings?.children?.map((c) => c.label)).toEqual(["Brand", "Localization", "SEO"]);
|
||||
expect(nav.find((item) => item.href.endsWith("/marquee"))?.label).toBe("Marquee");
|
||||
expect(nav.find((item) => item.href.endsWith("/smtp"))?.label).toBe("SMTP");
|
||||
});
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
import { afterEach, beforeEach, describe, expect, it } from "vitest";
|
||||
|
||||
import { buildAdminSessionToken, verifyAdminSessionToken } from "@/lib/admin-session-token";
|
||||
|
||||
const originalSecret = process.env.ADMIN_AUTH_SECRET;
|
||||
|
||||
beforeEach(() => {
|
||||
process.env.ADMIN_AUTH_SECRET = "unit-test-secret";
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
process.env.ADMIN_AUTH_SECRET = originalSecret;
|
||||
});
|
||||
|
||||
describe("admin session token", () => {
|
||||
it("round-trips a signed token", () => {
|
||||
expect(verifyAdminSessionToken(buildAdminSessionToken())).toBe(true);
|
||||
});
|
||||
|
||||
it("rejects forged, malformed, or missing tokens", () => {
|
||||
expect(verifyAdminSessionToken("superadmin")).toBe(false);
|
||||
expect(verifyAdminSessionToken("superadmin.deadbeef")).toBe(false);
|
||||
expect(verifyAdminSessionToken("other." + buildAdminSessionToken().split(".")[1])).toBe(false);
|
||||
expect(verifyAdminSessionToken("")).toBe(false);
|
||||
expect(verifyAdminSessionToken(undefined)).toBe(false);
|
||||
expect(verifyAdminSessionToken("1")).toBe(false);
|
||||
});
|
||||
|
||||
it("rejects a token signed with a different secret", () => {
|
||||
const token = buildAdminSessionToken();
|
||||
process.env.ADMIN_AUTH_SECRET = "rotated";
|
||||
expect(verifyAdminSessionToken(token)).toBe(false);
|
||||
});
|
||||
|
||||
it("never validates when no secret is configured", () => {
|
||||
process.env.ADMIN_AUTH_SECRET = "";
|
||||
expect(verifyAdminSessionToken("superadmin.anything")).toBe(false);
|
||||
});
|
||||
});
|
||||
@@ -7,6 +7,7 @@ import {
|
||||
MEDIA_UPLOAD_ROOT,
|
||||
getExtensionForMimeType,
|
||||
isManagedMediaFilePath,
|
||||
isMediaContentValid,
|
||||
removeManagedMediaFile,
|
||||
resolveMediaUploadPath,
|
||||
sanitizeBaseName,
|
||||
@@ -69,6 +70,42 @@ describe("resolveMediaUploadPath", () => {
|
||||
it("throws when a traversal attempt escapes the root", () => {
|
||||
expect(() => resolveMediaUploadPath("/uploads/media/../../etc/passwd")).toThrow(/escapes/i);
|
||||
});
|
||||
|
||||
it("rejects a sibling directory that merely shares the root prefix", () => {
|
||||
// `.../uploads/media-evil` starts with `.../uploads/media` as a string.
|
||||
expect(() => resolveMediaUploadPath("/uploads/media/../media-evil/x.png")).toThrow(/escapes/i);
|
||||
});
|
||||
|
||||
it("rejects the root itself, empty paths and null bytes", () => {
|
||||
expect(() => resolveMediaUploadPath("/uploads/media/")).toThrow(/escapes/i);
|
||||
expect(() => resolveMediaUploadPath("/uploads/media/./")).toThrow(/escapes/i);
|
||||
expect(() => resolveMediaUploadPath("/uploads/media/a\0.png")).toThrow(/escapes/i);
|
||||
});
|
||||
});
|
||||
|
||||
describe("isMediaContentValid", () => {
|
||||
it("accepts files whose magic bytes match the extension", () => {
|
||||
expect(isMediaContentValid(".png", Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 1, 2]))).toBe(true);
|
||||
expect(isMediaContentValid(".jpg", Buffer.from([0xff, 0xd8, 0xff, 0xe0]))).toBe(true);
|
||||
expect(isMediaContentValid(".gif", Buffer.from("GIF89a"))).toBe(true);
|
||||
expect(isMediaContentValid(".pdf", Buffer.from("%PDF-1.7"))).toBe(true);
|
||||
expect(isMediaContentValid(".webp", Buffer.from("RIFF\0\0\0\0WEBPVP8 "))).toBe(true);
|
||||
});
|
||||
|
||||
it("rejects mismatched bytes (e.g. HTML disguised as an image)", () => {
|
||||
expect(isMediaContentValid(".png", Buffer.from("<html><script>alert(1)</script>"))).toBe(false);
|
||||
expect(isMediaContentValid(".jpg", Buffer.from("GIF89a"))).toBe(false);
|
||||
expect(isMediaContentValid(".exe", Buffer.from("MZ"))).toBe(false);
|
||||
});
|
||||
|
||||
it("accepts plain svg and rejects active content", () => {
|
||||
expect(isMediaContentValid(".svg", Buffer.from('<svg xmlns="http://www.w3.org/2000/svg"><rect/></svg>'))).toBe(true);
|
||||
expect(isMediaContentValid(".svg", Buffer.from('<?xml version="1.0"?>\n<svg><circle/></svg>'))).toBe(true);
|
||||
expect(isMediaContentValid(".svg", Buffer.from("<svg><script>alert(1)</script></svg>"))).toBe(false);
|
||||
expect(isMediaContentValid(".svg", Buffer.from('<svg onload="alert(1)"></svg>'))).toBe(false);
|
||||
expect(isMediaContentValid(".svg", Buffer.from('<svg><a xlink:href="javascript:x"/></svg>'))).toBe(false);
|
||||
expect(isMediaContentValid(".svg", Buffer.from("<html><svg/></html>"))).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe("removeManagedMediaFile", () => {
|
||||
|
||||
@@ -25,6 +25,11 @@ describe("mediaFieldInputSchema", () => {
|
||||
expect(parsed.url).toBe("/uploads/media/x.png");
|
||||
});
|
||||
|
||||
it("rejects protocol-relative and javascript urls", () => {
|
||||
expect(() => mediaFieldInputSchema.parse({ ...base, mode: "external", url: "//evil.com/x.png" })).toThrow(/URL/i);
|
||||
expect(() => mediaFieldInputSchema.parse({ ...base, mode: "external", url: "javascript:alert(1)" })).toThrow(/URL/i);
|
||||
});
|
||||
|
||||
it("requires a url in external mode", () => {
|
||||
expect(() => mediaFieldInputSchema.parse({ ...base, mode: "external" })).toThrow(/URL/i);
|
||||
});
|
||||
|
||||
+106
-1
@@ -1,11 +1,15 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
import { buildDefaultSeoSettings } from "@/lib/seo-settings";
|
||||
import { buildDefaultSiteSettings } from "@/lib/site-settings";
|
||||
import {
|
||||
applyTitleTemplateFn,
|
||||
buildAppMetadataFromConfig,
|
||||
buildLocaleAlternates,
|
||||
buildLocalizedMetadataFromConfig,
|
||||
buildProjectJsonLd,
|
||||
buildSiteJsonLd,
|
||||
serializeJsonLd,
|
||||
} from "@/lib/metadata";
|
||||
|
||||
const noBindings = {
|
||||
@@ -82,7 +86,7 @@ describe("buildLocalizedMetadataFromConfig", () => {
|
||||
});
|
||||
expect(metadata.title).toBe("About | Studio");
|
||||
expect(metadata.description).toBe("English description");
|
||||
expect(metadata.openGraph?.locale).toBe("en");
|
||||
expect(metadata.openGraph?.locale).toBe("en_US");
|
||||
});
|
||||
|
||||
it("can skip the title template (homepage)", () => {
|
||||
@@ -111,3 +115,104 @@ describe("buildLocalizedMetadataFromConfig", () => {
|
||||
expect(metadata.description).toBe("Custom desc");
|
||||
});
|
||||
});
|
||||
|
||||
describe("seo-aware metadata", () => {
|
||||
const settings = buildDefaultSiteSettings("Studio");
|
||||
|
||||
it("indexes by default and emits verification + twitter handle when configured", () => {
|
||||
const seo = {
|
||||
...buildDefaultSeoSettings(),
|
||||
googleSiteVerification: "g123",
|
||||
bingSiteVerification: "b456",
|
||||
twitterHandle: "@moh",
|
||||
};
|
||||
const metadata = buildAppMetadataFromConfig(settings, noBindings, seo);
|
||||
expect(metadata.robots).toMatchObject({ index: true, follow: true });
|
||||
expect(metadata.verification).toEqual({ google: "g123", other: { "msvalidate.01": "b456" } });
|
||||
expect(metadata.twitter).toMatchObject({ site: "@moh", creator: "@moh" });
|
||||
expect(metadata.openGraph).toMatchObject({ locale: "de_DE", alternateLocale: ["en_US", "ar_AR"] });
|
||||
});
|
||||
|
||||
it("emits noindex everywhere when indexing is disabled", () => {
|
||||
const seo = { ...buildDefaultSeoSettings(), allowIndexing: false };
|
||||
expect(buildAppMetadataFromConfig(settings, noBindings, seo).robots).toMatchObject({ index: false });
|
||||
const page = buildLocalizedMetadataFromConfig({ settings, bindings: noBindings, seo, locale: "en", pathname: "/about", title: "About" });
|
||||
expect(page.robots).toMatchObject({ index: false, follow: false });
|
||||
});
|
||||
|
||||
it("supports per-page noindex, article type and a page-specific image", () => {
|
||||
const published = new Date("2026-01-02T00:00:00Z");
|
||||
const page = buildLocalizedMetadataFromConfig({
|
||||
settings,
|
||||
bindings: { ...noBindings, defaultOgImage: { assetId: "a", url: "/og.png", version: "1" } },
|
||||
locale: "en",
|
||||
pathname: "/portfolio/x",
|
||||
title: "X",
|
||||
image: "/uploads/media/covers/x.png",
|
||||
type: "article",
|
||||
publishedTime: published,
|
||||
});
|
||||
expect(page.robots).toMatchObject({ index: true });
|
||||
expect(page.openGraph).toMatchObject({
|
||||
type: "article",
|
||||
publishedTime: published.toISOString(),
|
||||
images: [{ url: "https://mohfarawati.de/uploads/media/covers/x.png", alt: "X" }],
|
||||
});
|
||||
|
||||
const thanks = buildLocalizedMetadataFromConfig({ settings, bindings: noBindings, locale: "en", pathname: "/success", title: "Thanks", noIndex: true });
|
||||
expect(thanks.robots).toMatchObject({ index: false });
|
||||
});
|
||||
|
||||
it("falls back to the default og image when no page image is given", () => {
|
||||
const page = buildLocalizedMetadataFromConfig({
|
||||
settings,
|
||||
bindings: { ...noBindings, defaultOgImage: { assetId: "a", url: "/og.png", version: "1" } },
|
||||
locale: "de",
|
||||
pathname: "/",
|
||||
title: "Home",
|
||||
});
|
||||
expect(page.openGraph).toMatchObject({ images: [{ url: "https://mohfarawati.de/og.png", alt: "Home" }] });
|
||||
});
|
||||
});
|
||||
|
||||
describe("json-ld", () => {
|
||||
const settings = buildDefaultSiteSettings("Studio");
|
||||
|
||||
it("builds a WebSite + Person graph linked by @id", () => {
|
||||
const seo = { ...buildDefaultSeoSettings(), structuredDataName: "Moh", structuredDataJobTitle: "Designer", sameAs: ["https://x.com/moh"] };
|
||||
const graph = buildSiteJsonLd({ settings, seo, bindings: noBindings, locale: "de" })["@graph"] as Array<Record<string, unknown>>;
|
||||
expect(graph[0]).toMatchObject({ "@type": "WebSite", publisher: { "@id": "https://mohfarawati.de/#person" } });
|
||||
expect(graph[1]).toMatchObject({ "@type": "Person", name: "Moh", jobTitle: "Designer", sameAs: ["https://x.com/moh"] });
|
||||
});
|
||||
|
||||
it("uses Organization shape when configured", () => {
|
||||
const seo = { ...buildDefaultSeoSettings(), structuredDataType: "Organization" as const, structuredDataJobTitle: "Studio" };
|
||||
const graph = buildSiteJsonLd({ settings, seo, bindings: noBindings, locale: "en" })["@graph"] as Array<Record<string, unknown>>;
|
||||
expect(graph[1]).toMatchObject({ "@type": "Organization", slogan: "Studio" });
|
||||
});
|
||||
|
||||
it("builds a CreativeWork per project with localized url", () => {
|
||||
const work = buildProjectJsonLd({
|
||||
settings,
|
||||
seo: buildDefaultSeoSettings(),
|
||||
locale: "en",
|
||||
pathname: "/portfolio/x",
|
||||
title: "X",
|
||||
description: "D",
|
||||
image: "/c.png",
|
||||
datePublished: new Date("2026-01-01T00:00:00Z"),
|
||||
clientName: "ACME",
|
||||
});
|
||||
expect(work).toMatchObject({
|
||||
"@type": "CreativeWork",
|
||||
url: "https://mohfarawati.de/en/portfolio/x",
|
||||
image: "https://mohfarawati.de/c.png",
|
||||
sourceOrganization: { "@type": "Organization", name: "ACME" },
|
||||
author: { "@id": "https://mohfarawati.de/#person" },
|
||||
});
|
||||
});
|
||||
|
||||
it("escapes < so the payload cannot close the script tag", () => {
|
||||
expect(serializeJsonLd({ name: "</script><script>alert(1)</script>" })).not.toContain("</script>");
|
||||
});
|
||||
});
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
import { ROBOTS_DISALLOWED_PATHS, buildRobots } from "@/app/robots";
|
||||
|
||||
describe("buildRobots", () => {
|
||||
it("blocks everything when not indexable and omits the sitemap", () => {
|
||||
const robots = buildRobots({ indexable: false });
|
||||
expect(robots.rules).toEqual([{ userAgent: "*", disallow: "/" }]);
|
||||
expect(robots.sitemap).toBeUndefined();
|
||||
});
|
||||
|
||||
it("allows crawling but hides admin, api and utility pages when indexable", () => {
|
||||
const robots = buildRobots({ indexable: true });
|
||||
const rule = Array.isArray(robots.rules) ? robots.rules[0] : robots.rules;
|
||||
expect(rule.allow).toBe("/");
|
||||
expect(rule.disallow).toEqual(ROBOTS_DISALLOWED_PATHS);
|
||||
expect(rule.disallow).toEqual(expect.arrayContaining(["/admin-internal", "/root", "/api/", "/success", "/coming-soon"]));
|
||||
expect(robots.sitemap).toBe("https://mohfarawati.de/sitemap.xml");
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,51 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
import { buildSeoChecklist, summarizeSeoChecklist } from "@/lib/seo-report";
|
||||
import { buildDefaultSeoSettings } from "@/lib/seo-settings";
|
||||
import { buildDefaultSiteSettings, getDefaultSiteSettingsMediaBindings } from "@/lib/site-settings";
|
||||
|
||||
function run(overrides: Partial<Parameters<typeof buildSeoChecklist>[0]> = {}) {
|
||||
return buildSeoChecklist({
|
||||
seo: buildDefaultSeoSettings(),
|
||||
settings: buildDefaultSiteSettings(),
|
||||
bindings: getDefaultSiteSettingsMediaBindings(),
|
||||
maintenanceEnabled: false,
|
||||
publishedProjectCount: 2,
|
||||
sitemapEntryCount: 12,
|
||||
siteUrl: "https://mohfarawati.de",
|
||||
...overrides,
|
||||
});
|
||||
}
|
||||
|
||||
describe("buildSeoChecklist", () => {
|
||||
it("flags maintenance mode as an indexing error", () => {
|
||||
const check = run({ maintenanceEnabled: true }).find((entry) => entry.id === "indexing");
|
||||
expect(check?.status).toBe("error");
|
||||
expect(check?.detail).toMatch(/Wartungsmodus/);
|
||||
});
|
||||
|
||||
it("flags disabled indexing and passes when enabled", () => {
|
||||
const seo = { ...buildDefaultSeoSettings(), allowIndexing: false };
|
||||
expect(run({ seo }).find((entry) => entry.id === "indexing")?.status).toBe("error");
|
||||
expect(run().find((entry) => entry.id === "indexing")?.status).toBe("ok");
|
||||
});
|
||||
|
||||
it("warns about localhost as public url", () => {
|
||||
expect(run({ siteUrl: "http://localhost:3014" }).find((entry) => entry.id === "site-url")?.status).toBe("warn");
|
||||
});
|
||||
|
||||
it("grades description length per locale", () => {
|
||||
const settings = buildDefaultSiteSettings();
|
||||
settings.locales.de.siteDescription = "";
|
||||
settings.locales.en.siteDescription = "x".repeat(80);
|
||||
const checks = run({ settings });
|
||||
expect(checks.find((entry) => entry.id === "description-de")?.status).toBe("error");
|
||||
expect(checks.find((entry) => entry.id === "description-en")?.status).toBe("ok");
|
||||
expect(checks.find((entry) => entry.id === "description-ar")?.status).toBe("warn");
|
||||
});
|
||||
|
||||
it("summarizes counts", () => {
|
||||
const summary = summarizeSeoChecklist(run());
|
||||
expect(summary.ok + summary.warn + summary.error).toBe(run().length);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,77 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
import {
|
||||
buildDefaultSeoSettings,
|
||||
normalizeKeywords,
|
||||
normalizeSameAs,
|
||||
normalizeTwitterHandle,
|
||||
normalizeVerificationToken,
|
||||
parseSeoSettingsValue,
|
||||
toOpenGraphLocale,
|
||||
} from "@/lib/seo-settings";
|
||||
|
||||
describe("parseSeoSettingsValue", () => {
|
||||
it("returns defaults for empty or invalid JSON", () => {
|
||||
expect(parseSeoSettingsValue(undefined)).toEqual(buildDefaultSeoSettings());
|
||||
expect(parseSeoSettingsValue("{not json")).toEqual(buildDefaultSeoSettings());
|
||||
expect(parseSeoSettingsValue(null).allowIndexing).toBe(true);
|
||||
});
|
||||
|
||||
it("only disables indexing on an explicit false", () => {
|
||||
expect(parseSeoSettingsValue(JSON.stringify({ allowIndexing: false })).allowIndexing).toBe(false);
|
||||
expect(parseSeoSettingsValue(JSON.stringify({ allowIndexing: "no" })).allowIndexing).toBe(true);
|
||||
});
|
||||
|
||||
it("normalizes every field and drops junk", () => {
|
||||
const parsed = parseSeoSettingsValue(
|
||||
JSON.stringify({
|
||||
googleSiteVerification: "abc-123_XYZ",
|
||||
bingSiteVerification: "<script>",
|
||||
twitterHandle: "https://x.com/moh_farawati",
|
||||
structuredDataType: "Company",
|
||||
sameAs: ["https://behance.net/x", "http://insecure", "javascript:alert(1)", "https://behance.net/x"],
|
||||
locales: { de: { keywords: " a , ,b,, c " } },
|
||||
}),
|
||||
);
|
||||
|
||||
expect(parsed.googleSiteVerification).toBe("abc-123_XYZ");
|
||||
expect(parsed.bingSiteVerification).toBe("");
|
||||
expect(parsed.twitterHandle).toBe("@moh_farawati");
|
||||
expect(parsed.structuredDataType).toBe("Person");
|
||||
expect(parsed.sameAs).toEqual(["https://behance.net/x"]);
|
||||
expect(parsed.locales.de.keywords).toBe("a, b, c");
|
||||
expect(parsed.locales.en.keywords).toBe("");
|
||||
});
|
||||
});
|
||||
|
||||
describe("normalizers", () => {
|
||||
it("rejects verification tokens with unsafe characters", () => {
|
||||
expect(normalizeVerificationToken("ok_token-1")).toBe("ok_token-1");
|
||||
expect(normalizeVerificationToken('x" onload="1')).toBe("");
|
||||
expect(normalizeVerificationToken(42)).toBe("");
|
||||
});
|
||||
|
||||
it("normalizes twitter handles with or without @ / URL", () => {
|
||||
expect(normalizeTwitterHandle("@moh")).toBe("@moh");
|
||||
expect(normalizeTwitterHandle("moh")).toBe("@moh");
|
||||
expect(normalizeTwitterHandle("https://twitter.com/moh")).toBe("@moh");
|
||||
expect(normalizeTwitterHandle("this-has-dashes")).toBe("");
|
||||
expect(normalizeTwitterHandle("a".repeat(16))).toBe("");
|
||||
});
|
||||
|
||||
it("accepts newline or comma separated https URLs only", () => {
|
||||
expect(normalizeSameAs("https://a.com\nhttps://b.com, ftp://c")).toEqual(["https://a.com", "https://b.com"]);
|
||||
expect(normalizeSameAs(null)).toEqual([]);
|
||||
});
|
||||
|
||||
it("caps keywords at 30 entries", () => {
|
||||
const keywords = normalizeKeywords(Array.from({ length: 40 }, (_, index) => `k${index}`).join(","));
|
||||
expect(keywords.split(", ")).toHaveLength(30);
|
||||
});
|
||||
|
||||
it("maps locales to og:locale codes", () => {
|
||||
expect(toOpenGraphLocale("de")).toBe("de_DE");
|
||||
expect(toOpenGraphLocale("en")).toBe("en_US");
|
||||
expect(toOpenGraphLocale("ar")).toBe("ar_AR");
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user