Leon SerfatyandClaude Opus 5
3e9ba07175
Turnstile bot protection (sign-in, sign-up, password-reset): - Register Better Auth's captcha plugin with the cloudflare-turnstile provider; endpoints listed explicitly rather than relying on defaults. /reset-password is intentionally excluded — it is reached only via a single-use emailed token. - Add an explicit-render Turnstile widget component. Tokens are single-use, so each form resets the challenge after a failed submit; submit stays disabled until a token is held. - Read the site key server-side and pass it down as a prop, so rotating it does not require a rebuild. - Fail fast in production when TURNSTILE_SECRET_KEY is missing, and when a secret is set without a site key (that combination would demand a token no form can produce, locking every user out). - Pass a throwaway secret during `next build` in the Dockerfile, mirroring the existing BETTER_AUTH_SECRET treatment, so image builds don't need it. CSP fixes in middleware (these blocked Turnstile entirely): - Add frame-src for challenges.cloudflare.com. Without it the widget's iframe fell back to default-src 'self' and was blocked outright. - Allow 'unsafe-eval' and websockets in DEVELOPMENT only. `next dev` compiles with eval(), so the strict policy threw EvalError and killed hydration — no client JS ran at all, which also meant form submit handlers never fired. Production policy is unchanged and still strict. Also included (concurrent work in the tree): - Admin organizations pages and lib/admin/orgs. - Episode moderation migration, SEO metadata (sitemap, robots, JSON-LD, OG/Twitter images, manifest), Umami analytics, not-found page. Local dev database: docker-compose.dev.yml provisions Postgres 18 on port 5443 (5432-5442 are in use by other local projects). Note: `npx tsc --noEmit` currently fails in app/(app)/team/page.tsx — an `invitations` prop the component does not accept. This predates the commit and will fail `next build` until fixed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
63 lines
2.8 KiB
JavaScript
63 lines
2.8 KiB
JavaScript
/** @type {import('next').NextConfig} */
|
|
const nextConfig = {
|
|
// Standalone output so PM2 can run `node .next/standalone/server.js` on the Plesk VPS.
|
|
output: "standalone",
|
|
reactStrictMode: true,
|
|
eslint: {
|
|
// Lint is run as its own step in CI; don't fail production builds on lint.
|
|
ignoreDuringBuilds: true,
|
|
},
|
|
images: {
|
|
remotePatterns: [
|
|
// DALL·E asset URLs (OpenAI blob storage) used before they are persisted to local disk.
|
|
// Scoped to the single OpenAI host actually used — no broad *.blob.core.windows.net wildcard.
|
|
{ protocol: "https", hostname: "oaidalleapiprodscus.blob.core.windows.net" },
|
|
// Marketing imagery (features/about pages).
|
|
{ protocol: "https", hostname: "images.unsplash.com" },
|
|
],
|
|
},
|
|
// Serve the self-hosted Umami tracker and its /api/send beacon from this
|
|
// origin. The CSP in middleware.ts uses 'strict-dynamic', which makes browsers
|
|
// ignore host allowlists in script-src, and connect-src is 'self' — so a
|
|
// third-party tracker could not be allowlisted without weakening the policy.
|
|
// Proxying keeps both same-origin, and content blockers leave it alone.
|
|
async rewrites() {
|
|
const host = process.env.UMAMI_HOST_URL?.trim().replace(/\/+$/, "");
|
|
if (!host) return [];
|
|
return [{ source: "/_a/:path*", destination: `${host}/:path*` }];
|
|
},
|
|
// The OG image route reads the brand mark off disk. That path is built at
|
|
// runtime so Next's static file tracing cannot infer it — list it explicitly so
|
|
// the asset is copied into the standalone output as well.
|
|
outputFileTracingIncludes: {
|
|
"/opengraph-image": ["./app/icon.png"],
|
|
"/twitter-image": ["./app/icon.png"],
|
|
},
|
|
// Server-only packages that should be required at runtime, not bundled by webpack.
|
|
// better-auth ships internal adapters (kysely) that break webpack's ESM analysis.
|
|
serverExternalPackages: ["pg-boss", "@prisma/client", "better-auth"],
|
|
// Static security headers applied to every route. The Content-Security-Policy is
|
|
// intentionally NOT set here — it is built per-request with a nonce in middleware.ts
|
|
// so script-src can drop 'unsafe-inline'/'unsafe-eval' (nonce + 'strict-dynamic').
|
|
async headers() {
|
|
return [
|
|
{
|
|
source: "/:path*",
|
|
headers: [
|
|
{ key: "X-Frame-Options", value: "DENY" },
|
|
{ key: "X-Content-Type-Options", value: "nosniff" },
|
|
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
|
|
{ key: "X-DNS-Prefetch-Control", value: "off" },
|
|
{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
|
|
{
|
|
key: "Strict-Transport-Security",
|
|
value: "max-age=63072000; includeSubDomains; preload",
|
|
},
|
|
],
|
|
},
|
|
];
|
|
},
|
|
};
|
|
|
|
export default nextConfig;
|