(change): Client security

This commit is contained in:
dbob16 committed 2026-09-10 17:58:25 -04:00
1 parent a11c313a8e
commit 103f1cf3c4
16 files changed
+177 -115

No files matched your search

+23 -3
View File
@@ -1,9 +1,9 @@
import { db } from '$lib/server/db';
import { env } from '$env/dynamic/private';
import { env } from '$env/dynamic/public';
import { randomUUID } from 'crypto';
export const init = async () => {
env.NODE_TLS_REJECT_UNAUTHORIZED = 0;
env.BODY_SIZE_LIMIT = 'Infinity';
env.PUBLIC_TAM_CLIENT_ID = randomUUID();
await db.run(`CREATE TABLE IF NOT EXISTS baskets (
prefix text,
b_id integer,
@@ -42,3 +42,23 @@ export const init = async () => {
SELECT 'Total', COUNT(DISTINCT(CONCAT(first_name, last_name, phone_number))), COUNT(*)
FROM tickets`);
};
export const handle = async ({ event, resolve }) => {
if (event.url.pathname.startsWith('/api')) {
const clientID = event.request.headers.get('TAM-CLIENT-ID');
if (env.PUBLIC_TAM_CLIENT_ID == clientID) {
const response = await resolve(event);
return response;
} else {
return new Response(JSON.stringify({detail: "Unauthorized"}), { status: 401 })
}
} else {
const response = await resolve(event);
return response;
}
}
export const handleFetch = async ({ request, fetch }) => {
request.headers.set('TAM-CLIENT-ID', env.PUBLIC_TAM_CLIENT_ID);
return fetch(request);
}
@@ -43,6 +43,11 @@
oninput={() => {
if (functions.pagerFromUpdate) functions.pagerFromUpdate();
}}
onkeydown={(e) => {
if (e.key == "Enter") {
functions.getPage()
}
}}
bind:value={pager.idFrom}
/>
<div>-</div>
@@ -54,6 +59,11 @@
onclick={(e) => {
e.target.select();
}}
onkeydown={(e) => {
if (e.key == "Enter") {
functions.getPage()
}
}}
bind:value={pager.idTo}
/>
<button
+1 -2
View File
@@ -1,5 +1,5 @@
import { env } from '$env/dynamic/private';
import { readFileSync, writeFileSync, mkdirSync } from 'fs';
import { readFileSync, writeFileSync } from 'fs';
const defaultSettings = {
remote_server: '',
@@ -17,7 +17,6 @@ export const getSettings = () => {
const settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));
return settings;
} catch {
mkdirSync(env.TAM_DATA_DIR || './data', { recursive: true });
writeFileSync(settingsPath, JSON.stringify(defaultSettings, null, 2), 'utf-8');
return defaultSettings;
}
+6
View File
@@ -0,0 +1,6 @@
import { env } from "$env/dynamic/public"
export const load = async () => {
const tamClientID = `${env.PUBLIC_TAM_CLIENT_ID}`;
return { tamClientID }
}
@@ -15,44 +15,50 @@ export const GET = async () => {
export const POST = async ({ request }) => {
const reqData = await request.json();
for (let i = 0; i < reqData.prefixes.length; i += chunk_size) {
const chunk = reqData.prefixes.slice(i, i + chunk_size);
await db
.insert(prefixes)
.values(chunk)
.onConflictDoUpdate({
target: prefixes.prefix,
set: { color: sql`EXCLUDED.color`, weight: sql`EXCLUDED.weight` }
});
}
for (let i = 0; i < reqData.baskets.length; i += chunk_size) {
const chunk = reqData.baskets.slice(i, i + chunk_size);
await db
.insert(baskets)
.values(chunk)
.onConflictDoUpdate({
target: [baskets.prefix, baskets.b_id],
set: {
description: sql`EXCLUDED.description`,
donors: sql`EXCLUDED.donors`,
winning_ticket: sql`EXCLUDED.winning_ticket`
}
});
}
for (let i = 0; i < reqData.tickets.length; i += chunk_size) {
const chunk = reqData.tickets.slice(i, i + chunk_size);
await db
.insert(tickets)
.values(chunk)
.onConflictDoNothing({
target: [tickets.prefix, tickets.t_id],
set: {
first_name: sql`EXCLUDED.first_name`,
last_name: sql`EXCLUDED.last_name`,
phone_number: sql`EXCLUDED.phone_number`,
pref: sql`EXCLUDED.pref`
}
});
}
if (reqData.prefixes) {
for (let i = 0; i < reqData.prefixes.length; i += chunk_size) {
const chunk = reqData.prefixes.slice(i, i + chunk_size);
await db
.insert(prefixes)
.values(chunk)
.onConflictDoUpdate({
target: prefixes.prefix,
set: { color: sql`EXCLUDED.color`, weight: sql`EXCLUDED.weight` }
});
};
};
if (reqData.baskets) {
for (let i = 0; i < reqData.baskets.length; i += chunk_size) {
const chunk = reqData.baskets.slice(i, i + chunk_size);
await db
.insert(baskets)
.values(chunk)
.onConflictDoUpdate({
target: [baskets.prefix, baskets.b_id],
set: {
description: sql`EXCLUDED.description`,
donors: sql`EXCLUDED.donors`,
winning_ticket: sql`EXCLUDED.winning_ticket`
}
});
};
};
if (reqData.tickets) {
for (let i = 0; i < reqData.tickets.length; i += chunk_size) {
const chunk = reqData.tickets.slice(i, i + chunk_size);
await db
.insert(tickets)
.values(chunk)
.onConflictDoNothing({
target: [tickets.prefix, tickets.t_id],
set: {
first_name: sql`EXCLUDED.first_name`,
last_name: sql`EXCLUDED.last_name`,
phone_number: sql`EXCLUDED.phone_number`,
pref: sql`EXCLUDED.pref`
}
});
};
};
return json({ details: 'Data loaded successfully.' });
};
+23 -18
View File
@@ -7,7 +7,7 @@
import CommandBar from '$lib/client/components/CommandBar.svelte';
let { data } = $props();
let { prefix, prefixes } = $derived(data);
let { prefix, prefixes, tamClientID } = $derived(data);
let pageTitle = $derived(`${prefix.prefix} Baskets | TAM`);
@@ -30,7 +30,7 @@
let itemsLength = $derived(items.length || 1);
let itemsBuffer = $derived(items.filter((i) => i.changed));
const functions = {
async getPage(){
async getPage() {
this.save();
if (pager.idFrom > pager.idTo) {
[pager.idFrom, pager.idTo] = [pager.idTo, pager.idFrom];
@@ -38,20 +38,25 @@
if (pager.idTo - pager.idFrom > 300) {
pager.idTo = pager.idFrom + 300;
}
const res = await fetch(`/api/baskets/${prefix.prefix}/${pager.idFrom}/${pager.idTo}`);
const res = await fetch(`/api/baskets/${prefix.prefix}/${pager.idFrom}/${pager.idTo}`, {
headers: { 'TAM-CLIENT-ID': tamClientID }
});
const resData = await res.json();
resData.map((i) => (i.changed = false));
items = [...resData];
setTimeout(() => focusIdx(0));
},
pagerFromUpdate(){
pager.idTo = pager.idFrom + (itemsLength - 1);
pagerFromUpdate() {
pager.idTo = pager.idFrom + (itemsLength - 1);
},
async save(){
async save() {
if (itemsBuffer.length > 0) {
const res = await fetch('/api/baskets', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: {
'Content-Type': 'application/json',
'TAM-CLIENT-ID': tamClientID
},
body: JSON.stringify(itemsBuffer)
});
if (res.ok) {
@@ -64,21 +69,21 @@
focusIdx(0);
}, 1);
},
cancel(){
if (itemsBuffer.length > 0) {
cancel() {
if (itemsBuffer.length > 0) {
itemsBuffer.forEach((i) => (i.changed = false));
this.getPage();
};
}
},
prevPage(){
prevPage() {
((pager.idFrom -= itemsLength), (pager.idTo -= itemsLength));
this.getPage();
},
nextPage(){
nextPage() {
((pager.idFrom += itemsLength), (pager.idTo += itemsLength));
this.getPage();
},
nextLine(){
nextLine() {
if (items[nextIdx]) {
setTimeout(() => {
focusIdx(nextIdx);
@@ -89,7 +94,7 @@
}, 1);
}
},
prevLine(){
prevLine() {
if (curIdx > 0) {
setTimeout(() => {
focusIdx(prevIdx);
@@ -100,7 +105,7 @@
}, 1);
}
},
dupDown(){
dupDown() {
if (items[nextIdx]) {
const buffer = { ...items[curIdx] };
['prefix', 'b_id'].forEach((key) => delete buffer[key]);
@@ -110,7 +115,7 @@
focusIdx(curIdx);
}
},
dupUp(){
dupUp() {
if (curIdx > 0) {
const buffer = { ...items[curIdx] };
['prefix', 'b_id'].forEach((key) => delete buffer[key]);
@@ -120,7 +125,7 @@
focusIdx(curIdx);
}
},
copy(){
copy() {
if (items[curIdx]) {
const buffer = { ...items[curIdx] };
['prefix', 't_id'].forEach((key) => delete buffer[key]);
@@ -128,7 +133,7 @@
}
focusIdx(curIdx);
},
paste(){
paste() {
if (items[curIdx]) {
const buffer = JSON.parse(window.localStorage.getItem('tam-basket'));
items[curIdx] = { ...items[curIdx], ...buffer, changed: true };
+23 -19
View File
@@ -7,7 +7,7 @@
import CommandBar from '$lib/client/components/CommandBar.svelte';
let { data } = $props();
let { prefix, prefixes } = $derived(data);
let { prefix, prefixes, tamClientID } = $derived(data);
let pageTitle = $derived(`${prefix.prefix} Drawing Form | TAM`);
@@ -30,7 +30,7 @@
let itemsLength = $derived(items.length || 1);
let itemsBuffer = $derived(items.filter((i) => i.changed));
const functions = {
async getPage(){
async getPage() {
this.save();
if (pager.idFrom > pager.idTo) {
[pager.idFrom, pager.idTo] = [pager.idTo, pager.idFrom];
@@ -38,17 +38,19 @@
if (pager.idTo - pager.idFrom > 300) {
pager.idTo = pager.idFrom + 300;
}
const res = await fetch(`/api/drawing/${prefix.prefix}/${pager.idFrom}/${pager.idTo}`);
const res = await fetch(`/api/drawing/${prefix.prefix}/${pager.idFrom}/${pager.idTo}`, {
headers: { 'TAM-CLIENT-ID': tamClientID }
});
const resData = await res.json();
resData.map((i) => (i.changed = false));
items = [...resData];
setTimeout(() => focusIdx(0));
},
async save(){
async save() {
if (itemsBuffer.length > 0) {
const res = await fetch('/api/drawing', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: JSON.stringify(itemsBuffer)
});
if (res.ok) {
@@ -61,24 +63,24 @@
focusIdx(0);
}, 1);
},
cancel(){
if (itemsBuffer.length > 0) {
cancel() {
if (itemsBuffer.length > 0) {
itemsBuffer.forEach((i) => (i.changed = false));
this.getPage();
};
}
},
pagerFromUpdate(){
pager.idTo = pager.idFrom + (itemsLength - 1);
pagerFromUpdate() {
pager.idTo = pager.idFrom + (itemsLength - 1);
},
prevPage(){
prevPage() {
((pager.idFrom -= itemsLength), (pager.idTo -= itemsLength));
this.getPage();
},
nextPage(){
nextPage() {
((pager.idFrom += itemsLength), (pager.idTo += itemsLength));
this.getPage();
},
nextLine(){
nextLine() {
if (items[nextIdx]) {
setTimeout(() => {
focusIdx(nextIdx);
@@ -89,7 +91,7 @@
}, 1);
}
},
prevLine(){
prevLine() {
if (curIdx > 0) {
setTimeout(() => {
focusIdx(prevIdx);
@@ -100,7 +102,7 @@
}, 1);
}
},
dupDown(){
dupDown() {
if (items[nextIdx]) {
const buffer = { ...items[curIdx] };
['prefix', 'b_id'].forEach((key) => delete buffer[key]);
@@ -110,7 +112,7 @@
focusIdx(curIdx);
}
},
dupUp(){
dupUp() {
if (curIdx > 0) {
const buffer = { ...items[curIdx] };
['prefix', 'b_id'].forEach((key) => delete buffer[key]);
@@ -120,7 +122,7 @@
focusIdx(curIdx);
}
},
copy(){
copy() {
if (items[curIdx]) {
const buffer = { ...items[curIdx] };
['prefix', 'b_id'].forEach((key) => delete buffer[key]);
@@ -128,7 +130,7 @@
}
focusIdx(curIdx);
},
paste(){
paste() {
if (items[curIdx]) {
const buffer = JSON.parse(window.localStorage.getItem('tam-drawing'));
items[curIdx] = { ...items[curIdx], ...buffer, changed: true };
@@ -191,7 +193,9 @@
id="{idx}_first"
oninput={async () => {
item.changed = true;
const res = await fetch(`/api/tickets/${prefix.prefix}/${item.winning_ticket}`);
const res = await fetch(`/api/tickets/${prefix.prefix}/${item.winning_ticket}`, {
headers: { 'TAM-CLIENT-ID': tamClientID }
});
if (res.ok) {
const data = await res.json();
[item.last_name, item.first_name, item.phone_number] = [
@@ -4,7 +4,7 @@
import { tS, bS } from '$lib/client/styles';
let { data } = $props();
let prefixes = $derived(data.prefixes);
let { prefixes, tamClientID } = $derived(data);
let tableData = $state([]);
let currentTimeout = $state();
let lastRefreshed = $state('');
@@ -12,7 +12,7 @@
const loadCounts = async () => {
const rtnData = {};
const res = await fetch('/api/reports/counts');
const res = await fetch('/api/reports/counts', {headers: {'TAM-CLIENT-ID': tamClientID}});
if (res.ok) {
prefixes.forEach((p) => (rtnData[p.prefix] = { ...p }));
const resData = await res.json();
+13 -11
View File
@@ -6,7 +6,7 @@
import TicketSearchBar from '$lib/client/components/TicketSearchBar.svelte';
let { data } = $props();
let { prefix, prefixes } = $derived(data);
let { prefix, prefixes, tamClientID } = $derived(data);
let pageTitle = 'Ticket Search | TAM';
@@ -34,20 +34,22 @@
let items = $state([]);
let itemsBuffer = $derived(items.filter((i) => i.changed));
const functions = {
async search(){
async search() {
const searchParams = new URLSearchParams({ ...searchForm });
const res = await fetch(`/api/search/tickets?${searchParams.toString()}`);
const res = await fetch(`/api/search/tickets?${searchParams.toString()}`, {
headers: { 'TAM-CLIENT-ID': tamClientID }
});
if (res.ok) {
const resData = await res.json();
items = [...resData];
setTimeout(() => focusIdx(0), 1);
}
},
async save(){
async save() {
if (itemsBuffer.length > 0) {
const res = await fetch('/api/search/tickets', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: JSON.stringify(itemsBuffer)
});
if (res.ok) {
@@ -60,7 +62,7 @@
focusIdx(0);
}, 1);
},
nextLine(){
nextLine() {
if (items[nextIdx]) {
setTimeout(() => {
focusIdx(nextIdx);
@@ -71,7 +73,7 @@
}, 1);
}
},
prevLine(){
prevLine() {
if (curIdx > 0) {
setTimeout(() => {
focusIdx(prevIdx);
@@ -82,7 +84,7 @@
}, 1);
}
},
dupDown(){
dupDown() {
if (items[nextIdx]) {
const buffer = { ...items[curIdx] };
['prefix', 't_id'].forEach((key) => delete buffer[key]);
@@ -92,7 +94,7 @@
focusIdx(curIdx);
}
},
dupUp(){
dupUp() {
if (curIdx > 0) {
const buffer = { ...items[curIdx] };
['prefix', 't_id'].forEach((key) => delete buffer[key]);
@@ -102,7 +104,7 @@
focusIdx(curIdx);
}
},
copy(){
copy() {
if (items[curIdx]) {
const buffer = { ...items[curIdx] };
['prefix', 't_id'].forEach((key) => delete buffer[key]);
@@ -110,7 +112,7 @@
}
setTimeout(() => focusIdx(curIdx), 1);
},
paste(){
paste() {
if (items[curIdx]) {
const buffer = JSON.parse(window.localStorage.getItem('tam-ticket'));
items[curIdx] = { ...items[curIdx], ...buffer, changed: true };
+10 -6
View File
@@ -5,6 +5,7 @@
import HeaderBar from '$lib/client/components/HeaderBar.svelte';
let { data } = $props();
let { tamClientID } = $derived(data);
let settings = $state({});
let status = $state({
message: '',
@@ -74,12 +75,15 @@
<input type="text" id="venue_name" class={iS.normal} bind:value={settings.venue_name} />
</div>
<div class="flex flex-row gap-1 items-center">
<div>Disable Attribution:</div>
<div>Disable Attribution:</div>
<button
class={bS.gray}
onclick={() => {
settings.disable_attrib ? settings.disable_attrib = false : settings.disable_attrib = true
}}>{ settings.disable_attrib ? "Yes" : "No" }</button>
class={bS.gray}
onclick={() => {
settings.disable_attrib
? (settings.disable_attrib = false)
: (settings.disable_attrib = true);
}}>{settings.disable_attrib ? 'Yes' : 'No'}</button
>
</div>
<div class="flex flex-row gap-1 items-center">
<button
@@ -88,7 +92,7 @@
const res = await fetch('/api/settings', {
method: 'POST',
body: JSON.stringify(settings),
headers: { 'Content-Type': 'application/json' }
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID }
});
if (!res.ok) {
status.message = `Error Code: ${res.status}`;
@@ -3,6 +3,7 @@
import { resolve } from '$app/paths';
import { bS, iS } from '$lib/client/styles';
let { data } = $props();
let { tamClientID } = $derived(data);
const pageTitle = 'Auth Keys | TAM';
@@ -17,7 +18,7 @@
async function getKeys() {
const res = await fetch('/api/auth', {
headers: { 'TAM-PWD': auth.pwd }
headers: { 'TAM-PWD': auth.pwd, 'TAM-CLIENT-ID': tamClientID }
});
if (res.ok) {
auth.toggle = true;
@@ -72,7 +73,7 @@
onclick={async () => {
const res = await fetch('/api/settings', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: JSON.stringify({ remote_key: key.auth_key })
});
if (res.ok) {
@@ -86,7 +87,7 @@
onclick={async () => {
const res = await fetch(`/api/auth?key_to_del=${key.auth_key}`, {
method: 'DELETE',
headers: { 'TAM-PWD': auth.pwd }
headers: { 'TAM-PWD': auth.pwd, 'TAM-CLIENT-ID': tamClientID }
});
if (res.ok) {
setTimeout(() => {
@@ -112,7 +113,7 @@
if (newDesc) {
const res = await fetch('/api/auth', {
method: 'POST',
headers: { 'TAM-PWD': auth.pwd, 'Content-Type': 'application/json' },
headers: { 'TAM-PWD': auth.pwd, 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: JSON.stringify({ description: newDesc })
});
if (res.ok) {
@@ -6,7 +6,7 @@
const pageTitle = 'Backup and Restore | TAM';
let { data } = $props();
let remoteServer = $derived(data.remoteServer);
let { remoteServer, tamClientID } = $derived(data);
let uploadFile = $state();
let contents = $state('');
let results = $state('');
@@ -31,7 +31,7 @@
hour: String(now.getHours()).padStart(2, '0'),
minutes: String(now.getMinutes()).padStart(2, '0')
};
const res = await fetch(fetch_url);
const res = await fetch(fetch_url, { headers: { 'TAM-CLIENT-ID': tamClientID } });
if (res.ok) {
const data = await res.json();
const jsonString = JSON.stringify(data, null, 2);
@@ -58,7 +58,7 @@
setTimeout(async () => {
const res = await fetch(`/api/backuprestore/${target}`, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: contents
});
if (res.ok) setResult('File uploaded successfully. Check to see if your data exists.');
@@ -67,7 +67,10 @@
}
async function pushData(target) {
const res = await fetch(`/api/backuprestore/push/${target}`, { method: 'HEAD' });
const res = await fetch(`/api/backuprestore/push/${target}`, {
method: 'HEAD',
headers: { 'TAM-CLIENT-ID': tamClientID }
});
const targetStr = target.charAt(0).toUpperCase() + target.slice(1);
if (res.ok) {
setResult(`${targetStr} pushed successfully.`);
@@ -5,6 +5,7 @@
import { resolve } from '$app/paths';
let { data } = $props();
let { tamClientID } = $derived(data);
const pageTitle = 'Prefixes | TAM';
@@ -56,7 +57,7 @@
if (editPrefix.prefix) {
const req = await fetch('/api/prefixes', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: JSON.stringify([editPrefix])
});
if (req.ok) window.location.reload();
@@ -125,7 +126,8 @@
class={bS[prefix.color]}
onclick={async () => {
const res = await fetch(`/api/prefixes?p=${prefix.prefix}`, {
method: 'DELETE'
method: 'DELETE',
headers: { 'TAM-CLIENT-ID': tamClientID }
});
if (res.ok) window.location.reload();
}}>Delete</button
@@ -7,7 +7,7 @@
import CommandBar from '$lib/client/components/CommandBar.svelte';
let { data } = $props();
let { prefix, prefixes } = $derived(data);
let { prefix, prefixes, tamClientID } = $derived(data);
let pageTitle = $derived(`${prefix.prefix} Tickets | TAM`);
@@ -38,7 +38,7 @@
if (pager.idTo - pager.idFrom > 300) {
pager.idTo = pager.idFrom + 300;
}
const res = await fetch(`/api/tickets/${prefix.prefix}/${pager.idFrom}/${pager.idTo}`);
const res = await fetch(`/api/tickets/${prefix.prefix}/${pager.idFrom}/${pager.idTo}`, {headers: {'TAM-CLIENT-ID': tamClientID}});
const resData = await res.json();
resData.map((i) => (i.changed = false));
items = [...resData];
@@ -51,7 +51,7 @@
if (itemsBuffer.length > 0) {
const res = await fetch('/api/tickets', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: JSON.stringify(itemsBuffer)
});
if (res.ok) {
@@ -3,4 +3,4 @@
if [ ! -d "./data" ]; then
mkdir ./data
fi
HOST=127.0.0.1 PORT=3000 ./exe/bin/node ./build
NODE_TLS_REJECT_UNAUTHORIZED=0 BODY_SIZE_LIMIT=Infinity HOST=localhost PORT=3000 ./exe/bin/node ./build
+1 -1
View File
@@ -1,4 +1,4 @@
{$TAM_HOSTNAME:tam.lan}:8443 {
*:8443 {
tls internal
reverse_proxy {$TAM_SERVER:localhost}:8000
}