The nonce-based script-src is incompatible with Next's static prerendering.
The nonce is minted per request in middleware, but statically generated HTML
was produced at build time with no nonce on its inline scripts, so on "/" and
the marketing routes every inline hydration script was blocked: the page
painted from SSR HTML, React failed to hydrate, and the tree unmounted to a
blank screen a moment later. Dynamic routes (/sign-in, /dashboard) render per
request, receive the nonce, and worked — which is why this was missed.
Browsers that honour a nonce ignore 'unsafe-inline', so the two cannot be
combined. Drop the nonce and allow inline scripts; the policy still restricts
which origins may serve scripts, and frame-src/connect-src stay strict.
Restoring nonces would require every route to render dynamically.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Turnstile bot protection (sign-in, sign-up, password-reset):
- Register Better Auth's captcha plugin with the cloudflare-turnstile
provider; endpoints listed explicitly rather than relying on defaults.
/reset-password is intentionally excluded — it is reached only via a
single-use emailed token.
- Add an explicit-render Turnstile widget component. Tokens are single-use,
so each form resets the challenge after a failed submit; submit stays
disabled until a token is held.
- Read the site key server-side and pass it down as a prop, so rotating it
does not require a rebuild.
- Fail fast in production when TURNSTILE_SECRET_KEY is missing, and when a
secret is set without a site key (that combination would demand a token
no form can produce, locking every user out).
- Pass a throwaway secret during `next build` in the Dockerfile, mirroring
the existing BETTER_AUTH_SECRET treatment, so image builds don't need it.
CSP fixes in middleware (these blocked Turnstile entirely):
- Add frame-src for challenges.cloudflare.com. Without it the widget's
iframe fell back to default-src 'self' and was blocked outright.
- Allow 'unsafe-eval' and websockets in DEVELOPMENT only. `next dev`
compiles with eval(), so the strict policy threw EvalError and killed
hydration — no client JS ran at all, which also meant form submit
handlers never fired. Production policy is unchanged and still strict.
Also included (concurrent work in the tree):
- Admin organizations pages and lib/admin/orgs.
- Episode moderation migration, SEO metadata (sitemap, robots, JSON-LD,
OG/Twitter images, manifest), Umami analytics, not-found page.
Local dev database: docker-compose.dev.yml provisions Postgres 18 on port
5443 (5432-5442 are in use by other local projects).
Note: `npx tsc --noEmit` currently fails in app/(app)/team/page.tsx — an
`invitations` prop the component does not accept. This predates the commit
and will fail `next build` until fixed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Cross-cutting input-validation, isolation, and DoS-resistance fixes across
the app, API, billing, queue, and infra layers.
- Runtime validation (zod) for client-supplied admin actions (role/plan/
limits), series generation index, and all pg-boss queue payloads
- Auth: require email verification before sign-in; reject weak/placeholder/
short BETTER_AUTH_SECRET in production
- Billing: sanitize Stripe/PayPal errors (log server-side, generic to client);
race-safe subscription upsert; only count "processed" webhook events as
handled; verify org membership in getEffectivePlan to block plan escalation
- Series generation: reserve usage up front and refund on failure; bill the
owning org, not the caller's active org
- Injection defenses: HTML-escape user fields in emails, strip CR/LF from
subject/recipient, validate ElevenLabs voiceId before URL interpolation
- Media routes: stream off disk instead of buffering whole files; rate-limit
anonymous public audio/cover endpoints by client IP
