mirror of
https://github.com/hanzo-apps/dataroom.git
synced 2026-10-30 14:47:36 +00:00
zeekayandHanzo Dev
42425d6bcd
QStash was already gone — `lib/cron/index.ts` shipped a stub whose publishJSON
logged a warning, returned `{ messageId: "noop" }` and DISCARDED the event. Every
customer webhook has been silently dropped since. Its sibling stub, `receiver`,
returned `true` for any signature.
Deliveries now go to a KV list (lib/kv-queue/webhooks.ts): rpush to enqueue, lpop
to take, failures returned with a raised attempt count until MAX_ATTEMPTS so a
customer endpoint that is briefly down keeps its event and one that is gone does
not spin. The signature is computed at enqueue and carried with the item, so a
retry re-sends identical bytes rather than re-signing a payload whose shape may
have moved. Enqueue never throws: a KV outage must not fail the caller's write.
/api/cron/webhooks drains it.
The cron guard was worse than the stub. It read
if (process.env.VERCEL === "1") { ...verify Upstash-Signature... }
and this app runs on Kubernetes, so the branch was ALWAYS false — every
/api/cron/* route was reachable by anyone with the path, and the verifier behind
it asserted nothing anyway. Replaced with a shared secret that FAILS CLOSED: no
CRON_SECRET, no cron. Nothing schedules these today, so a missing secret costs
nothing where the old behaviour cost everything. It is a secret, not an identity —
user-facing auth stays with Hanzo IAM.
Also drops the QStash env block, the dead Upstash locker vars, and the vendor
vocabulary in lib/kv.ts, where the shims describe a SHAPE (options object,
{ score, member }) rather than whoever shipped it.
Verified with npx tsc --noEmit: 100 errors before and after, 0 introduced,
compared set-wise by file:line:code.
Co-authored-by: Hanzo Dev <[email protected]>
122 lines
3.1 KiB
TypeScript
122 lines
3.1 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
|
|
import { verifyCron } from "@/lib/cron/verify";
|
|
import {
|
|
getConfigResponse,
|
|
getDomainResponse,
|
|
verifyDomain,
|
|
} from "@/lib/domains";
|
|
import prisma from "@/lib/prisma";
|
|
import { log } from "@/lib/utils";
|
|
|
|
import { handleDomainUpdates } from "./utils";
|
|
|
|
/**
|
|
* Cron to check if domains are verified.
|
|
* If a domain is invalid for more than 14 days, we send a reminder email to the owner.
|
|
* If a domain is invalid for more than 28 days, we send a second and final reminder email to the owner.
|
|
* If a domain is invalid for more than 30 days, we delete it from the database.
|
|
**/
|
|
// Runs once per day at 12pm (0 12 * * *)
|
|
|
|
export const maxDuration = 300; // 5 minutes in seconds
|
|
|
|
export async function POST(req: Request) {
|
|
const body = await req.json();
|
|
const auth = verifyCron(req);
|
|
if (!auth.ok) {
|
|
return new Response("Unauthorized", { status: auth.status });
|
|
}
|
|
|
|
try {
|
|
const domains = await prisma.domain.findMany({
|
|
where: {
|
|
slug: {
|
|
not: {
|
|
in: ["dataroom.hanzo.ai", "dataroom.hanzo.ai"],
|
|
},
|
|
},
|
|
},
|
|
select: {
|
|
slug: true,
|
|
verified: true,
|
|
createdAt: true,
|
|
userId: true,
|
|
teamId: true,
|
|
_count: {
|
|
select: {
|
|
links: true,
|
|
},
|
|
},
|
|
},
|
|
orderBy: {
|
|
lastChecked: "asc", // earliest first
|
|
},
|
|
});
|
|
|
|
const results = await Promise.allSettled(
|
|
domains.map(async (domain) => {
|
|
const { slug, verified, createdAt, _count } = domain;
|
|
const [domainJson, configJson] = await Promise.all([
|
|
getDomainResponse(slug),
|
|
getConfigResponse(slug),
|
|
]);
|
|
|
|
let newVerified;
|
|
|
|
if (domainJson?.error?.code === "not_found") {
|
|
newVerified = false;
|
|
} else if (!domainJson.verified) {
|
|
const verificationJson = await verifyDomain(slug);
|
|
if (verificationJson && verificationJson.verified) {
|
|
newVerified = true;
|
|
} else {
|
|
newVerified = false;
|
|
}
|
|
} else if (!configJson.misconfigured) {
|
|
newVerified = true;
|
|
} else {
|
|
newVerified = false;
|
|
}
|
|
|
|
const prismaResponse = await prisma.domain.update({
|
|
where: {
|
|
slug,
|
|
},
|
|
data: {
|
|
verified: newVerified,
|
|
lastChecked: new Date(),
|
|
},
|
|
});
|
|
|
|
const changed = newVerified !== verified;
|
|
|
|
const updates = await handleDomainUpdates({
|
|
domain: slug,
|
|
createdAt,
|
|
verified: newVerified,
|
|
changed,
|
|
linksCount: _count.links,
|
|
});
|
|
|
|
return {
|
|
domain,
|
|
previousStatus: verified,
|
|
currentStatus: newVerified,
|
|
changed,
|
|
updates,
|
|
prismaResponse,
|
|
};
|
|
}),
|
|
);
|
|
return NextResponse.json(results);
|
|
} catch (error) {
|
|
await log({
|
|
message: `Domains cron failed. \n\nError: ${(error as Error).message}`,
|
|
type: "cron",
|
|
mention: true,
|
|
});
|
|
return NextResponse.json({ error: (error as Error).message });
|
|
}
|
|
}
|