Files
sass-mohfarawati/lib/site-icons.tsx
T
moh dc21c33867 ADDED - Admin SEO page, robots/sitemap hardening and media/maintenance security fixes
SEO
- New Settings > SEO admin page (seo_settings in app_config): indexing switch,
  Google/Bing verification, X handle, JSON-LD identity (Person/Organization,
  sameAs), per-locale keywords, readiness checklist and open links for
  sitemap.xml / robots.txt / manifest.
- robots.txt is now dynamic: disallows admin, api, success and coming-soon
  paths; blocks everything while indexing is off or maintenance is on.
- sitemap.xml carries hreflang alternates per URL, lists only categories with
  published projects, and is empty while hidden.
- Metadata: robots + verification meta, og:locale in de_DE/en_US/ar_AR form,
  alternateLocale, twitter site/creator, project cover as OG image with
  article type, noindex on /success and /coming-soon.
- JSON-LD: WebSite + publisher graph on all public pages, CreativeWork per
  project (view-mode independent).

Security
- Maintenance bypass now requires a correctly signed admin cookie; the
  middleware previously only checked the cookie existed. Token helpers moved
  to lib/admin-session-token.ts (shared by proxy.ts and lib/admin-auth.ts).
- Media uploads: magic-byte validation against the declared type, SVG
  sanitization (script/handlers/foreignObject/javascript: rejected), upload
  folder sanitized, kind inferred from the real file.
- Media route: fixed prefix-based path check that accepted sibling
  directories, unknown extensions return 404, nosniff header, CSP sandbox on
  SVG, gif content type added.
- External media URLs: protocol-relative (//host) URLs rejected.

Portfolio
- Project and category slugs share /portfolio/[slug]; saving now rejects a
  slug already used on the other side instead of silently shadowing it.

Tooling/docs
- Lint: ignore scripts/legacy-prisma-seed.cjs, drop unused import.
- New docs/SEO.md; FEATURES, ARCHITECTURE (Drizzle instead of Prisma), admin
  spec and CLAUDE.md updated.
- Tests for all of the above (unit + integration); suite green.
2026-09-20 21:36:16 +02:00

112 lines
3.3 KiB
TypeScript

import { readFile } from "fs/promises";
import path from "path";
import { getSiteSettings, getSiteSettingsMediaBindings } from "./app-config";
import { isManagedMediaFilePath, resolveMediaUploadPath } from "./media-storage";
const INTERNAL_FAVICON_PATH = "/favicon.ico";
const INTERNAL_APPLE_ICON_PATH = "/apple-icon.png";
export const INTERNAL_MANIFEST_PATH = "/manifest.webmanifest";
const DEFAULT_ICON_VERSION = "default";
const TRANSPARENT_PNG_BASE64 =
"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAusB9sot5WQAAAAASUVORK5CYII=";
const ICON_CONTENT_TYPES: Record<string, string> = {
".ico": "image/x-icon",
".jpg": "image/jpeg",
".jpeg": "image/jpeg",
".png": "image/png",
".svg": "image/svg+xml",
".webp": "image/webp",
};
type SiteIconInput = {
siteName: string;
faviconVersion?: string | null;
faviconUrl?: string | null;
};
type SiteIconUrls = {
siteName: string;
version: string;
faviconHref: string;
appleIconHref: string;
manifestHref: string;
faviconAssetUrl: string | null;
};
function appendVersionToUrl(url: string, version: string): string {
const base = url.startsWith("http://") || url.startsWith("https://") ? undefined : "https://local.invalid";
const resolved = new URL(url, base);
resolved.searchParams.set("v", version);
if (base) {
return `${resolved.pathname}${resolved.search}${resolved.hash}`;
}
return resolved.toString();
}
export function buildSiteIconUrls(input: SiteIconInput): SiteIconUrls {
const siteName = input.siteName.trim() || "Moh";
const version = input.faviconVersion?.trim() || DEFAULT_ICON_VERSION;
return {
siteName,
version,
faviconHref: appendVersionToUrl(INTERNAL_FAVICON_PATH, version),
appleIconHref: appendVersionToUrl(INTERNAL_APPLE_ICON_PATH, version),
manifestHref: appendVersionToUrl(INTERNAL_MANIFEST_PATH, version),
faviconAssetUrl: input.faviconUrl ? appendVersionToUrl(input.faviconUrl, version) : null,
};
}
export async function getDynamicSiteIconUrls(): Promise<SiteIconUrls> {
const [settings, bindings] = await Promise.all([getSiteSettings(), getSiteSettingsMediaBindings()]);
const defaultLocaleSettings = settings.locales[settings.defaultLocale];
return buildSiteIconUrls({
siteName: defaultLocaleSettings.siteName,
faviconVersion: bindings.favicon?.version,
faviconUrl: bindings.favicon?.url,
});
}
function getResolvedPathname(iconUrl: string) {
const resolvedUrl = new URL(iconUrl, "https://local.invalid");
return resolvedUrl.pathname;
}
async function createFileResponse(absolutePath: string) {
const fileBuffer = await readFile(absolutePath);
const contentType = ICON_CONTENT_TYPES[path.extname(absolutePath).toLowerCase()] ?? "application/octet-stream";
return new Response(fileBuffer, {
status: 200,
headers: {
"Content-Type": contentType,
"Cache-Control": "no-store, max-age=0",
},
});
}
export async function buildSiteIconResponse(iconUrl: string | null) {
if (iconUrl) {
const pathname = getResolvedPathname(iconUrl);
if (isManagedMediaFilePath(pathname)) {
return createFileResponse(resolveMediaUploadPath(pathname));
}
}
return new Response(Buffer.from(TRANSPARENT_PNG_BASE64, "base64"), {
status: 200,
headers: {
"Content-Type": "image/png",
"Cache-Control": "no-store, max-age=0",
},
});
}