tillandClaude Opus 5
63d4b7d894
Mail goes out through the account's own mailbox (SMTP) rather than a sending service: the domain lives there anyway, so SPF and DKIM line up by themselves and no third party gets to see the messages. Credentials are AES-256-GCM encrypted in settings like every other secret, never in the repo. nodemailer has zero dependencies and no native postinstall -- checked before adding it, given the history. Password reset: single-use token, only its hash is stored, one hour, and the request endpoint answers identically whether or not the address exists so it cannot be used to enumerate accounts. Rate limited per address. Share links (/s/<slug>) let someone without an account see the pictures and download them at full resolution. These are photos of children, so the defaults lean safe: every link expires by itself (30 days), can be revoked, optionally carries a passphrase, and the page and files are noindex. Access is bound to the link, not the image -- swapping in another item id on a valid link returns 404. Private-session results can never be shared at all. Tracking records when and with what, never who: IP addresses are only stored salted-and-hashed, so repeat visitors can be counted but nobody identified. Sharing goes out by mail (several recipients at once, no attachment -- a link can be withdrawn later, an attachment cannot) or via wa.me, which opens WhatsApp with the text prepared. The WhatsApp Business API would need a Meta account, approved templates and per-conversation fees; this works today for free and the API can slot in behind it later. Verified end to end against a local SMTP server: reset issues and consumes its token exactly once, the old password stops working, an unknown address gives the same answer, share mail reaches several recipients. Link behaviour checked for expiry (410), revocation (410), wrong passphrase (401) and download lock (403). Outbound SMTP is blocked in the sandbox, so the real mailbox still needs one test from the live server. Also fixes a regression this introduced: the seventh nav item pushed the logout button off screen at 820px. The bar now shrinks and scrolls, logout never does. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BNhLunz586g6DeYMa7Qsd1
72 lines
3.4 KiB
SQL
72 lines
3.4 KiB
SQL
-- E-Mail-Versand, Passwort-Rücksetzung und Teilen-Links -------------------
|
|
-- Alles vorwärts und idempotent, wie die übrigen Migrationen.
|
|
|
|
-- SMTP-Zugang. Das Passwort wird wie die übrigen Geheimnisse AES-256-GCM
|
|
-- verschlüsselt abgelegt (src/lib/crypto.ts) — nie im Klartext.
|
|
ALTER TABLE settings ADD COLUMN IF NOT EXISTS smtp_host text;
|
|
ALTER TABLE settings ADD COLUMN IF NOT EXISTS smtp_port integer NOT NULL DEFAULT 465;
|
|
ALTER TABLE settings ADD COLUMN IF NOT EXISTS smtp_secure boolean NOT NULL DEFAULT true;
|
|
ALTER TABLE settings ADD COLUMN IF NOT EXISTS smtp_user text;
|
|
ALTER TABLE settings ADD COLUMN IF NOT EXISTS smtp_password text;
|
|
ALTER TABLE settings ADD COLUMN IF NOT EXISTS smtp_from text;
|
|
|
|
-- Wie lange ein neuer Teilen-Link standardmäßig gilt (0 = unbegrenzt).
|
|
ALTER TABLE settings ADD COLUMN IF NOT EXISTS share_default_days integer NOT NULL DEFAULT 30;
|
|
|
|
-- E-Mail am Nutzerkonto: für „Passwort vergessen" und optionale Hinweise.
|
|
ALTER TABLE users ADD COLUMN IF NOT EXISTS email text;
|
|
ALTER TABLE users ADD COLUMN IF NOT EXISTS notify_jobs boolean NOT NULL DEFAULT false;
|
|
CREATE UNIQUE INDEX IF NOT EXISTS users_email_idx ON users (lower(email)) WHERE email IS NOT NULL;
|
|
|
|
-- Passwort zurücksetzen. Gespeichert wird nur der **Hash** des Tokens — wer die
|
|
-- Datenbank liest, kann damit kein Konto übernehmen.
|
|
CREATE TABLE IF NOT EXISTS password_resets (
|
|
token_hash text PRIMARY KEY,
|
|
user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
expires_at timestamptz NOT NULL,
|
|
used_at timestamptz,
|
|
created_at timestamptz NOT NULL DEFAULT now()
|
|
);
|
|
CREATE INDEX IF NOT EXISTS password_resets_user_idx ON password_resets(user_id);
|
|
|
|
-- Teilen-Links: ein Bild oder eine Sammlung, öffentlich erreichbar unter /s/<slug>.
|
|
CREATE TABLE IF NOT EXISTS shares (
|
|
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
slug text UNIQUE NOT NULL,
|
|
kind text NOT NULL DEFAULT 'item' CHECK (kind IN ('item','collection')),
|
|
title text,
|
|
note text,
|
|
created_by uuid REFERENCES users(id) ON DELETE SET NULL,
|
|
expires_at timestamptz,
|
|
revoked_at timestamptz,
|
|
allow_download boolean NOT NULL DEFAULT true,
|
|
-- Optionales Zugangswort (argon2), damit ein weitergeleiteter Link allein nicht reicht.
|
|
password_hash text,
|
|
views integer NOT NULL DEFAULT 0,
|
|
downloads integer NOT NULL DEFAULT 0,
|
|
last_seen_at timestamptz,
|
|
created_at timestamptz NOT NULL DEFAULT now()
|
|
);
|
|
CREATE INDEX IF NOT EXISTS shares_created_by_idx ON shares(created_by);
|
|
|
|
CREATE TABLE IF NOT EXISTS share_items (
|
|
share_id uuid NOT NULL REFERENCES shares(id) ON DELETE CASCADE,
|
|
item_id uuid NOT NULL REFERENCES items(id) ON DELETE CASCADE,
|
|
position integer NOT NULL DEFAULT 0,
|
|
PRIMARY KEY (share_id, item_id)
|
|
);
|
|
CREATE INDEX IF NOT EXISTS share_items_item_idx ON share_items(item_id);
|
|
|
|
-- Zugriffe je Link. Die IP wird nur **gehasht** abgelegt (mit dem Server-Geheimnis
|
|
-- gesalzen): Man kann damit wiederkehrende Besucher zählen, aber niemanden
|
|
-- identifizieren oder die Adresse zurückrechnen.
|
|
CREATE TABLE IF NOT EXISTS share_views (
|
|
id bigserial PRIMARY KEY,
|
|
share_id uuid NOT NULL REFERENCES shares(id) ON DELETE CASCADE,
|
|
kind text NOT NULL DEFAULT 'view' CHECK (kind IN ('view','download')),
|
|
ip_hash text,
|
|
user_agent text,
|
|
at timestamptz NOT NULL DEFAULT now()
|
|
);
|
|
CREATE INDEX IF NOT EXISTS share_views_share_idx ON share_views(share_id, at DESC);
|