ticket-auction-manager/tam
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

(change): Client security

Browse Source
This commit is contained in:
dbob16 committed 2026-09-10 17:58:25 -04:00
1 parent a11c313a8e
commit 103f1cf3c4
16 files changed
+102 -40
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

client/src/hooks.server.js
+23 -3
View File
@@ -1,9 +1,9 @@
import { db } from '$lib/server/db';
import { env } from '$env/dynamic/private';
import { env } from '$env/dynamic/public';
import { randomUUID } from 'crypto';
export const init = async () => {
env.NODE_TLS_REJECT_UNAUTHORIZED = 0;
env.BODY_SIZE_LIMIT = 'Infinity';
env.PUBLIC_TAM_CLIENT_ID = randomUUID();
await db.run(`CREATE TABLE IF NOT EXISTS baskets (
prefix text,
b_id integer,
@@ -42,3 +42,23 @@ export const init = async () => {
SELECT 'Total', COUNT(DISTINCT(CONCAT(first_name, last_name, phone_number))), COUNT(*)
FROM tickets`);
};
export const handle = async ({ event, resolve }) => {
if (event.url.pathname.startsWith('/api')) {
const clientID = event.request.headers.get('TAM-CLIENT-ID');
if (env.PUBLIC_TAM_CLIENT_ID == clientID) {
const response = await resolve(event);
return response;
} else {
return new Response(JSON.stringify({detail: "Unauthorized"}), { status: 401 })
}
} else {
const response = await resolve(event);
return response;
}
}
export const handleFetch = async ({ request, fetch }) => {
request.headers.set('TAM-CLIENT-ID', env.PUBLIC_TAM_CLIENT_ID);
return fetch(request);
}
client/src/lib/client/components/PagerBar.svelte
+10
View File
@@ -43,6 +43,11 @@
oninput={() => {
if (functions.pagerFromUpdate) functions.pagerFromUpdate();
}}
onkeydown={(e) => {
if (e.key == "Enter") {
functions.getPage()
}
}}
bind:value={pager.idFrom}
/>
<div>-</div>
@@ -54,6 +59,11 @@
onclick={(e) => {
e.target.select();
}}
onkeydown={(e) => {
if (e.key == "Enter") {
functions.getPage()
}
}}
bind:value={pager.idTo}
/>
<button
client/src/lib/server/settings/index.js
+1 -2
View File
@@ -1,5 +1,5 @@
import { env } from '$env/dynamic/private';
import { readFileSync, writeFileSync, mkdirSync } from 'fs';
import { readFileSync, writeFileSync } from 'fs';
const defaultSettings = {
remote_server: '',
@@ -17,7 +17,6 @@ export const getSettings = () => {
const settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));
return settings;
} catch {
mkdirSync(env.TAM_DATA_DIR || './data', { recursive: true });
writeFileSync(settingsPath, JSON.stringify(defaultSettings, null, 2), 'utf-8');
return defaultSettings;
}
client/src/routes/+layout.server.js
+6
View File
@@ -0,0 +1,6 @@
import { env } from "$env/dynamic/public"
export const load = async () => {
const tamClientID = `${env.PUBLIC_TAM_CLIENT_ID}`;
return { tamClientID }
}
client/src/routes/api/backuprestore/local/+server.js
+9 -3
View File
@@ -15,6 +15,7 @@ export const GET = async () => {
export const POST = async ({ request }) => {
const reqData = await request.json();
if (reqData.prefixes) {
for (let i = 0; i < reqData.prefixes.length; i += chunk_size) {
const chunk = reqData.prefixes.slice(i, i + chunk_size);
await db
@@ -24,7 +25,9 @@ export const POST = async ({ request }) => {
target: prefixes.prefix,
set: { color: sql`EXCLUDED.color`, weight: sql`EXCLUDED.weight` }
});
}
};
};
if (reqData.baskets) {
for (let i = 0; i < reqData.baskets.length; i += chunk_size) {
const chunk = reqData.baskets.slice(i, i + chunk_size);
await db
@@ -38,7 +41,9 @@ export const POST = async ({ request }) => {
winning_ticket: sql`EXCLUDED.winning_ticket`
}
});
}
};
};
if (reqData.tickets) {
for (let i = 0; i < reqData.tickets.length; i += chunk_size) {
const chunk = reqData.tickets.slice(i, i + chunk_size);
await db
@@ -53,6 +58,7 @@ export const POST = async ({ request }) => {
pref: sql`EXCLUDED.pref`
}
});
}
};
};
return json({ details: 'Data loaded successfully.' });
};
client/src/routes/baskets/[prefix]/+page.svelte
+9 -4
View File
@@ -7,7 +7,7 @@
import CommandBar from '$lib/client/components/CommandBar.svelte';
let { data } = $props();
let { prefix, prefixes } = $derived(data);
let { prefix, prefixes, tamClientID } = $derived(data);
let pageTitle = $derived(`${prefix.prefix} Baskets | TAM`);
@@ -38,7 +38,9 @@
if (pager.idTo - pager.idFrom > 300) {
pager.idTo = pager.idFrom + 300;
}
const res = await fetch(`/api/baskets/${prefix.prefix}/${pager.idFrom}/${pager.idTo}`);
const res = await fetch(`/api/baskets/${prefix.prefix}/${pager.idFrom}/${pager.idTo}`, {
headers: { 'TAM-CLIENT-ID': tamClientID }
});
const resData = await res.json();
resData.map((i) => (i.changed = false));
items = [...resData];
@@ -51,7 +53,10 @@
if (itemsBuffer.length > 0) {
const res = await fetch('/api/baskets', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: {
'Content-Type': 'application/json',
'TAM-CLIENT-ID': tamClientID
},
body: JSON.stringify(itemsBuffer)
});
if (res.ok) {
@@ -68,7 +73,7 @@
if (itemsBuffer.length > 0) {
itemsBuffer.forEach((i) => (i.changed = false));
this.getPage();
};
}
},
prevPage() {
((pager.idFrom -= itemsLength), (pager.idTo -= itemsLength));
client/src/routes/drawing/[prefix]/+page.svelte
+9 -5
View File
@@ -7,7 +7,7 @@
import CommandBar from '$lib/client/components/CommandBar.svelte';
let { data } = $props();
let { prefix, prefixes } = $derived(data);
let { prefix, prefixes, tamClientID } = $derived(data);
let pageTitle = $derived(`${prefix.prefix} Drawing Form | TAM`);
@@ -38,7 +38,9 @@
if (pager.idTo - pager.idFrom > 300) {
pager.idTo = pager.idFrom + 300;
}
const res = await fetch(`/api/drawing/${prefix.prefix}/${pager.idFrom}/${pager.idTo}`);
const res = await fetch(`/api/drawing/${prefix.prefix}/${pager.idFrom}/${pager.idTo}`, {
headers: { 'TAM-CLIENT-ID': tamClientID }
});
const resData = await res.json();
resData.map((i) => (i.changed = false));
items = [...resData];
@@ -48,7 +50,7 @@
if (itemsBuffer.length > 0) {
const res = await fetch('/api/drawing', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: JSON.stringify(itemsBuffer)
});
if (res.ok) {
@@ -65,7 +67,7 @@
if (itemsBuffer.length > 0) {
itemsBuffer.forEach((i) => (i.changed = false));
this.getPage();
};
}
},
pagerFromUpdate() {
pager.idTo = pager.idFrom + (itemsLength - 1);
@@ -191,7 +193,9 @@
id="{idx}_first"
oninput={async () => {
item.changed = true;
const res = await fetch(`/api/tickets/${prefix.prefix}/${item.winning_ticket}`);
const res = await fetch(`/api/tickets/${prefix.prefix}/${item.winning_ticket}`, {
headers: { 'TAM-CLIENT-ID': tamClientID }
});
if (res.ok) {
const data = await res.json();
[item.last_name, item.first_name, item.phone_number] = [
client/src/routes/reports/counts/+page.svelte
+2 -2
View File
@@ -4,7 +4,7 @@
import { tS, bS } from '$lib/client/styles';
let { data } = $props();
let prefixes = $derived(data.prefixes);
let { prefixes, tamClientID } = $derived(data);
let tableData = $state([]);
let currentTimeout = $state();
let lastRefreshed = $state('');
@@ -12,7 +12,7 @@
const loadCounts = async () => {
const rtnData = {};
const res = await fetch('/api/reports/counts');
const res = await fetch('/api/reports/counts', {headers: {'TAM-CLIENT-ID': tamClientID}});
if (res.ok) {
prefixes.forEach((p) => (rtnData[p.prefix] = { ...p }));
const resData = await res.json();
client/src/routes/search/tickets/+page.svelte
+5 -3
View File
@@ -6,7 +6,7 @@
import TicketSearchBar from '$lib/client/components/TicketSearchBar.svelte';
let { data } = $props();
let { prefix, prefixes } = $derived(data);
let { prefix, prefixes, tamClientID } = $derived(data);
let pageTitle = 'Ticket Search | TAM';
@@ -36,7 +36,9 @@
const functions = {
async search() {
const searchParams = new URLSearchParams({ ...searchForm });
const res = await fetch(`/api/search/tickets?${searchParams.toString()}`);
const res = await fetch(`/api/search/tickets?${searchParams.toString()}`, {
headers: { 'TAM-CLIENT-ID': tamClientID }
});
if (res.ok) {
const resData = await res.json();
items = [...resData];
@@ -47,7 +49,7 @@
if (itemsBuffer.length > 0) {
const res = await fetch('/api/search/tickets', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: JSON.stringify(itemsBuffer)
});
if (res.ok) {
client/src/routes/settings/+page.svelte
+7 -3
View File
@@ -5,6 +5,7 @@
import HeaderBar from '$lib/client/components/HeaderBar.svelte';
let { data } = $props();
let { tamClientID } = $derived(data);
let settings = $state({});
let status = $state({
message: '',
@@ -78,8 +79,11 @@
<button
class={bS.gray}
onclick={() => {
settings.disable_attrib ? settings.disable_attrib = false : settings.disable_attrib = true
}}>{ settings.disable_attrib ? "Yes" : "No" }</button>
settings.disable_attrib
? (settings.disable_attrib = false)
: (settings.disable_attrib = true);
}}>{settings.disable_attrib ? 'Yes' : 'No'}</button
>
</div>
<div class="flex flex-row gap-1 items-center">
<button
@@ -88,7 +92,7 @@
const res = await fetch('/api/settings', {
method: 'POST',
body: JSON.stringify(settings),
headers: { 'Content-Type': 'application/json' }
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID }
});
if (!res.ok) {
status.message = `Error Code: ${res.status}`;
client/src/routes/settings/auth-keys/+page.svelte
+5 -4
View File
@@ -3,6 +3,7 @@
import { resolve } from '$app/paths';
import { bS, iS } from '$lib/client/styles';
let { data } = $props();
let { tamClientID } = $derived(data);
const pageTitle = 'Auth Keys | TAM';
@@ -17,7 +18,7 @@
async function getKeys() {
const res = await fetch('/api/auth', {
headers: { 'TAM-PWD': auth.pwd }
headers: { 'TAM-PWD': auth.pwd, 'TAM-CLIENT-ID': tamClientID }
});
if (res.ok) {
auth.toggle = true;
@@ -72,7 +73,7 @@
onclick={async () => {
const res = await fetch('/api/settings', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: JSON.stringify({ remote_key: key.auth_key })
});
if (res.ok) {
@@ -86,7 +87,7 @@
onclick={async () => {
const res = await fetch(`/api/auth?key_to_del=${key.auth_key}`, {
method: 'DELETE',
headers: { 'TAM-PWD': auth.pwd }
headers: { 'TAM-PWD': auth.pwd, 'TAM-CLIENT-ID': tamClientID }
});
if (res.ok) {
setTimeout(() => {
@@ -112,7 +113,7 @@
if (newDesc) {
const res = await fetch('/api/auth', {
method: 'POST',
headers: { 'TAM-PWD': auth.pwd, 'Content-Type': 'application/json' },
headers: { 'TAM-PWD': auth.pwd, 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: JSON.stringify({ description: newDesc })
});
if (res.ok) {
client/src/routes/settings/backuprestore/+page.svelte
+7 -4
View File
@@ -6,7 +6,7 @@
const pageTitle = 'Backup and Restore | TAM';
let { data } = $props();
let remoteServer = $derived(data.remoteServer);
let { remoteServer, tamClientID } = $derived(data);
let uploadFile = $state();
let contents = $state('');
let results = $state('');
@@ -31,7 +31,7 @@
hour: String(now.getHours()).padStart(2, '0'),
minutes: String(now.getMinutes()).padStart(2, '0')
};
const res = await fetch(fetch_url);
const res = await fetch(fetch_url, { headers: { 'TAM-CLIENT-ID': tamClientID } });
if (res.ok) {
const data = await res.json();
const jsonString = JSON.stringify(data, null, 2);
@@ -58,7 +58,7 @@
setTimeout(async () => {
const res = await fetch(`/api/backuprestore/${target}`, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: contents
});
if (res.ok) setResult('File uploaded successfully. Check to see if your data exists.');
@@ -67,7 +67,10 @@
}
async function pushData(target) {
const res = await fetch(`/api/backuprestore/push/${target}`, { method: 'HEAD' });
const res = await fetch(`/api/backuprestore/push/${target}`, {
method: 'HEAD',
headers: { 'TAM-CLIENT-ID': tamClientID }
});
const targetStr = target.charAt(0).toUpperCase() + target.slice(1);
if (res.ok) {
setResult(`${targetStr} pushed successfully.`);
client/src/routes/settings/prefixes/+page.svelte
+4 -2
View File
@@ -5,6 +5,7 @@
import { resolve } from '$app/paths';
let { data } = $props();
let { tamClientID } = $derived(data);
const pageTitle = 'Prefixes | TAM';
@@ -56,7 +57,7 @@
if (editPrefix.prefix) {
const req = await fetch('/api/prefixes', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: JSON.stringify([editPrefix])
});
if (req.ok) window.location.reload();
@@ -125,7 +126,8 @@
class={bS[prefix.color]}
onclick={async () => {
const res = await fetch(`/api/prefixes?p=${prefix.prefix}`, {
method: 'DELETE'
method: 'DELETE',
headers: { 'TAM-CLIENT-ID': tamClientID }
});
if (res.ok) window.location.reload();
}}>Delete</button
client/src/routes/tickets/[prefix]/+page.svelte
+3 -3
View File
@@ -7,7 +7,7 @@
import CommandBar from '$lib/client/components/CommandBar.svelte';
let { data } = $props();
let { prefix, prefixes } = $derived(data);
let { prefix, prefixes, tamClientID } = $derived(data);
let pageTitle = $derived(`${prefix.prefix} Tickets | TAM`);
@@ -38,7 +38,7 @@
if (pager.idTo - pager.idFrom > 300) {
pager.idTo = pager.idFrom + 300;
}
const res = await fetch(`/api/tickets/${prefix.prefix}/${pager.idFrom}/${pager.idTo}`);
const res = await fetch(`/api/tickets/${prefix.prefix}/${pager.idFrom}/${pager.idTo}`, {headers: {'TAM-CLIENT-ID': tamClientID}});
const resData = await res.json();
resData.map((i) => (i.changed = false));
items = [...resData];
@@ -51,7 +51,7 @@
if (itemsBuffer.length > 0) {
const res = await fetch('/api/tickets', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', 'TAM-CLIENT-ID': tamClientID },
body: JSON.stringify(itemsBuffer)
});
if (res.ok) {
deployments/client/portable/linux/run-server.sh
+1 -1
View File
@@ -3,4 +3,4 @@
if [ ! -d "./data" ]; then
mkdir ./data
fi
HOST=127.0.0.1 PORT=3000 ./exe/bin/node ./build
NODE_TLS_REJECT_UNAUTHORIZED=0 BODY_SIZE_LIMIT=Infinity HOST=localhost PORT=3000 ./exe/bin/node ./build
rp/Caddyfile
+1 -1
View File
@@ -1,4 +1,4 @@
{$TAM_HOSTNAME:tam.lan}:8443 {
*:8443 {
tls internal
reverse_proxy {$TAM_SERVER:localhost}:8000
}