mirror of
https://github.com/shuaiplus/nodewarden.git
synced 2026-06-20 21:00:41 +00:00
shuaiplus
c0683016c3
- Updated the deployment script to build the web application before deploying. - Upgraded Wrangler dependency from 4.61.1 to 4.69.0. feat: add import item limit and request body size limit - Introduced a new limit for the maximum total items allowed in a single import (5000). - Set a hard body size limit for JSON API endpoints (25 MB). feat: validate KDF parameters during registration and password change - Added validation for KDF parameters to ensure compliance with Bitwarden's minimum requirements. - Enhanced error handling for invalid KDF parameters during user registration and password change. feat: clean up R2 files on user deletion - Implemented cleanup of R2 files associated with user attachments and sends before deleting user metadata. feat: verify folder ownership when creating or updating ciphers - Added checks to ensure that users cannot reference folders owned by other users when creating or updating ciphers. fix: handle corrupted cipher data gracefully - Improved error handling when retrieving ciphers from the database to avoid crashes due to corrupted data. feat: increment send access count atomically - Added a method to atomically increment the access count for sends and return whether the update was successful. fix: enforce request body size limits - Implemented checks to reject oversized request bodies for non-file upload paths. fix: update error handling for database initialization - Enhanced error logging for database initialization failures while providing a generic message to clients. feat: enhance security with Content Security Policy - Added a Content Security Policy to the web application to improve security against XSS attacks. fix: remove plaintext TOTP secret from localStorage - Updated the TOTP enabling process to remove the plaintext secret from localStorage after it is stored on the server. fix: ensure only PBKDF2 hash is sent for public send access - Modified the public send access payload to ensure only the PBKDF2 hash is sent, never the plaintext password.
57 lines
1.7 KiB
TypeScript
57 lines
1.7 KiB
TypeScript
import { Env } from './types';
|
|
import { handleRequest } from './router';
|
|
import { StorageService } from './services/storage';
|
|
import { applyCors, jsonResponse } from './utils/response';
|
|
|
|
let dbInitialized = false;
|
|
let dbInitError: string | null = null;
|
|
let dbInitPromise: Promise<void> | null = null;
|
|
|
|
async function ensureDatabaseInitialized(env: Env): Promise<void> {
|
|
if (dbInitialized) return;
|
|
|
|
if (!dbInitPromise) {
|
|
dbInitPromise = (async () => {
|
|
const storage = new StorageService(env.DB);
|
|
await storage.initializeDatabase();
|
|
dbInitialized = true;
|
|
dbInitError = null;
|
|
})()
|
|
.catch((error: unknown) => {
|
|
console.error('Failed to initialize database:', error);
|
|
dbInitError = error instanceof Error ? error.message : 'Unknown database initialization error';
|
|
})
|
|
.finally(() => {
|
|
dbInitPromise = null;
|
|
});
|
|
}
|
|
|
|
await dbInitPromise;
|
|
}
|
|
|
|
export default {
|
|
async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
|
|
void ctx;
|
|
await ensureDatabaseInitialized(env);
|
|
if (dbInitError) {
|
|
// Log full error server-side, return generic message to client.
|
|
console.error('DB init error (not forwarded to client):', dbInitError);
|
|
const resp = jsonResponse(
|
|
{
|
|
error: 'Database not initialized',
|
|
error_description: 'Database initialization failed. Check server logs for details.',
|
|
ErrorModel: {
|
|
Message: 'Service temporarily unavailable',
|
|
Object: 'error',
|
|
},
|
|
},
|
|
500
|
|
);
|
|
return applyCors(request, resp);
|
|
}
|
|
|
|
const resp = await handleRequest(request, env);
|
|
return applyCors(request, resp);
|
|
},
|
|
};
|