Claude
7a21cc636c
Standalone bot/ service (its own package.json/Dockerfile) managed entirely through a new admin-only Discord Bot panel — token stored encrypted in the DB and pushed to the bot process in-memory, never an env var. Built in phases, each independently verified against a live Discord guild: - Bot skeleton: gateway connection, internal shared-secret API, self-heals on its own restart by pulling config from the site - Moderation core: /ban /kick /mute /warn /warnings + mod-log channel - Word/invite/spam filtering with leetspeak-resistant normalization and a staff role/channel allowlist - Scheduled messages: recurring (cron) and one-off channel posts - Role assignment: button role menus, auto-role on join, temp roles, bulk role ops - Auto-rotating primary invite with an audit log - Site integration: news-publish -> Discord announce webhook, manual /announce, read-only /wiki search Also fixes a pre-existing bug in both DB pools (server + bot): the mariadb driver defaulted to timezone 'local', silently mis-serializing bound Date params by the host's local offset instead of the DB's UTC session. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
21 lines
869 B
JavaScript
21 lines
869 B
JavaScript
// Gate for server-side /internal/* routes. The only caller is the bot process,
|
|
// on its own boot, over the private compose network — never expose this route
|
|
// through the public reverse proxy. Timing-safe compare so response time can't
|
|
// be used to brute-force the shared secret one byte at a time. Same pattern as
|
|
// bot/src/internal/requireInternalKey.js on the other side of this call.
|
|
const crypto = require('crypto')
|
|
|
|
function requireInternalKey(req, res, next) {
|
|
const expected = process.env.BOT_INTERNAL_KEY || ''
|
|
const provided = req.get('X-Internal-Key') || ''
|
|
|
|
const a = Buffer.from(expected)
|
|
const b = Buffer.from(provided)
|
|
const match = expected.length > 0 && a.length === b.length && crypto.timingSafeEqual(a, b)
|
|
|
|
if (!match) return res.status(401).json({ message: 'Unauthorized' })
|
|
return next()
|
|
}
|
|
|
|
module.exports = requireInternalKey
|