Claude
7a21cc636c
Standalone bot/ service (its own package.json/Dockerfile) managed entirely through a new admin-only Discord Bot panel — token stored encrypted in the DB and pushed to the bot process in-memory, never an env var. Built in phases, each independently verified against a live Discord guild: - Bot skeleton: gateway connection, internal shared-secret API, self-heals on its own restart by pulling config from the site - Moderation core: /ban /kick /mute /warn /warnings + mod-log channel - Word/invite/spam filtering with leetspeak-resistant normalization and a staff role/channel allowlist - Scheduled messages: recurring (cron) and one-off channel posts - Role assignment: button role menus, auto-role on join, temp roles, bulk role ops - Auto-rotating primary invite with an audit log - Site integration: news-publish -> Discord announce webhook, manual /announce, read-only /wiki search Also fixes a pre-existing bug in both DB pools (server + bot): the mariadb driver defaulted to timezone 'local', silently mis-serializing bound Date params by the host's local offset instead of the DB's UTC session. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
20 lines
770 B
JavaScript
20 lines
770 B
JavaScript
// Gate for the bot's /internal/* API. The only caller is the main UOMysticmoon
|
|
// server, over the private compose network — never expose this route through
|
|
// the public reverse proxy. Timing-safe compare so response time can't be used
|
|
// to brute-force the shared secret one byte at a time.
|
|
const crypto = require('crypto')
|
|
|
|
function requireInternalKey(req, res, next) {
|
|
const expected = process.env.BOT_INTERNAL_KEY || ''
|
|
const provided = req.get('X-Internal-Key') || ''
|
|
|
|
const a = Buffer.from(expected)
|
|
const b = Buffer.from(provided)
|
|
const match = expected.length > 0 && a.length === b.length && crypto.timingSafeEqual(a, b)
|
|
|
|
if (!match) return res.status(401).json({ message: 'Unauthorized' })
|
|
return next()
|
|
}
|
|
|
|
module.exports = requireInternalKey
|