nate/Siteforge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Gate Titus download, require full name forms, remove companion UI

Browse Source
This commit is contained in:
nmemmert
2026-04-20 11:29:37 -04:00
parent 0c328057c8
commit cc4a4b4d63
6 changed files with 357 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server.js
+157 -33
View File
@@ -34,6 +34,10 @@ const CHATBOT_FILE = path.join(DATA_DIR, 'chatbot-content.json')
const BACKUP_DIR = path.join(DATA_DIR, 'backups')
const DIST_DIR = path.join(__dirname, 'dist')
const INDEX_FILE = path.join(DIST_DIR, 'index.html')
const TITUS_STUDY_FILE = process.env.TITUS_STUDY_FILE
? path.resolve(__dirname, process.env.TITUS_STUDY_FILE)
: path.join(__dirname, 'A_Study_of_Titus.pdf')
const TITUS_STUDY_DOWNLOAD_NAME = process.env.TITUS_STUDY_DOWNLOAD_NAME ?? 'A_Study_of_Titus.pdf'
const EMPTY_HIT_STATS = {
totalHits: 0,
@@ -68,6 +72,8 @@ const EMPTY_VISITOR_STATS = {
}
const MAX_CONTACT_SUBMISSIONS = 5000
const DOWNLOAD_TOKEN_TTL_MS = 10 * 60 * 1000
const titusDownloadTokens = new Map()
const MAX_QUESTIONS = 1000
let visitorStats = { ...EMPTY_VISITOR_STATS }
@@ -267,6 +273,57 @@ function addContactSubmission({ name, email, message, messageType, subscribe })
return submission
}
async function syncContactToResend(name, email) {
if (!process.env.RESEND_API_KEY) return
const { firstName, lastName } = splitName(name)
const contactResend = new Resend(process.env.RESEND_CONTACTS_API_KEY ?? process.env.RESEND_API_KEY)
try {
const { error: contactError } = await contactResend.contacts.create({
email,
firstName,
lastName,
unsubscribed: false,
...(process.env.RESEND_SEGMENT_ID
? { segments: [{ id: process.env.RESEND_SEGMENT_ID }] }
: {}),
})
if (contactError) {
const { error: updateError } = await contactResend.contacts.update({
email,
firstName,
lastName,
unsubscribed: false,
})
if (updateError) {
console.error('[resend] contact sync error:', updateError)
}
}
} catch (err) {
console.error('[resend] contact sync exception:', err)
}
}
function createTitusDownloadToken(email) {
const token = randomUUID()
titusDownloadTokens.set(token, {
email,
expiresAt: Date.now() + DOWNLOAD_TOKEN_TTL_MS,
})
return token
}
function consumeTitusDownloadToken(token) {
const entry = titusDownloadTokens.get(token)
if (!entry) return false
titusDownloadTokens.delete(token)
if (entry.expiresAt <= Date.now()) return false
return true
}
function sanitizeUserAgent(userAgent) {
if (!userAgent || typeof userAgent !== 'string') return 'unknown'
return userAgent.trim().slice(0, 300) || 'unknown'
@@ -1042,6 +1099,7 @@ app.use((req, res, next) => {
// Rate-limit contact submissions: max 5 per IP per 10 minutes
const contactHits = new Map()
const downloadHits = new Map()
function contactRateLimit(req, res, next) {
const ip = req.ip ?? 'unknown'
const now = Date.now()
@@ -1060,9 +1118,99 @@ function contactRateLimit(req, res, next) {
next()
}
function studyDownloadRateLimit(req, res, next) {
const ip = req.ip ?? 'unknown'
const now = Date.now()
const windowMs = 10 * 60 * 1000
const entry = downloadHits.get(ip) ?? { count: 0, start: now }
if (now - entry.start > windowMs) {
entry.count = 0
entry.start = now
}
entry.count += 1
downloadHits.set(ip, entry)
if (entry.count > 10) {
res.status(429).json({ message: 'Too many download requests. Please wait a few minutes.' })
return
}
next()
}
app.post('/api/study-downloads/titus', studyDownloadRateLimit, async (req, res) => {
try {
const { firstName, lastName, email, subscribe, _honey } = req.body ?? {}
if (_honey) {
res.json({ ok: true })
return
}
if (!firstName || typeof firstName !== 'string' || firstName.trim().length < 1 || firstName.trim().length > 100) {
res.status(400).json({ message: 'First name is required.' })
return
}
if (!lastName || typeof lastName !== 'string' || lastName.trim().length < 1 || lastName.trim().length > 100) {
res.status(400).json({ message: 'Last name is required.' })
return
}
if (!email || typeof email !== 'string' || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim())) {
res.status(400).json({ message: 'A valid email address is required.' })
return
}
try {
await stat(TITUS_STUDY_FILE)
} catch {
res.status(503).json({ message: 'The Titus study file is not configured yet.' })
return
}
const trimmedFirstName = firstName.trim()
const trimmedLastName = lastName.trim()
const trimmedName = `${trimmedFirstName} ${trimmedLastName}`.trim()
const trimmedEmail = email.trim()
const wantsSubscribe = subscribe !== false
addContactSubmission({
name: trimmedName,
email: trimmedEmail,
message: 'Requested Titus study download.',
messageType: 'general',
subscribe: wantsSubscribe,
})
if (wantsSubscribe) {
await syncContactToResend(trimmedName, trimmedEmail)
}
const token = createTitusDownloadToken(trimmedEmail)
res.json({ ok: true, downloadUrl: `/api/study-downloads/titus/file?token=${encodeURIComponent(token)}` })
} catch (err) {
console.error('[study-download] request error:', err)
res.status(500).json({ message: 'Failed to process your request. Please try again.' })
}
})
app.get('/api/study-downloads/titus/file', async (req, res) => {
const token = typeof req.query?.token === 'string' ? req.query.token : ''
if (!token || !consumeTitusDownloadToken(token)) {
res.status(403).json({ message: 'Invalid or expired download link. Submit the form again.' })
return
}
try {
await stat(TITUS_STUDY_FILE)
res.download(TITUS_STUDY_FILE, TITUS_STUDY_DOWNLOAD_NAME)
} catch {
res.status(503).json({ message: 'The Titus study file is not configured yet.' })
}
})
app.post('/api/contact', contactRateLimit, async (req, res) => {
try {
const { name, email, message, messageType, subscribe, _honey } = req.body ?? {}
const { firstName, lastName, email, message, messageType, subscribe, _honey } = req.body ?? {}
// Honeypot — silently discard if filled by a bot
if (_honey) {
@@ -1070,8 +1218,12 @@ app.post('/api/contact', contactRateLimit, async (req, res) => {
return
}
if (!name || typeof name !== 'string' || name.trim().length < 1 || name.trim().length > 200) {
res.status(400).json({ message: 'Name is required.' })
if (!firstName || typeof firstName !== 'string' || firstName.trim().length < 1 || firstName.trim().length > 100) {
res.status(400).json({ message: 'First name is required.' })
return
}
if (!lastName || typeof lastName !== 'string' || lastName.trim().length < 1 || lastName.trim().length > 100) {
res.status(400).json({ message: 'Last name is required.' })
return
}
if (!email || typeof email !== 'string' || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim())) {
@@ -1089,7 +1241,7 @@ app.post('/api/contact', contactRateLimit, async (req, res) => {
return
}
const trimmedName = name.trim()
const trimmedName = `${firstName.trim()} ${lastName.trim()}`.trim()
const trimmedEmail = email.trim()
const trimmedMessage = message.trim()
const normalizedMessageType = normalizeMessageType(messageType)
@@ -1126,35 +1278,7 @@ app.post('/api/contact', contactRateLimit, async (req, res) => {
const resend = new Resend(process.env.RESEND_API_KEY)
if (subscribe === true) {
const { firstName, lastName } = splitName(trimmedName)
const contactResend = new Resend(process.env.RESEND_CONTACTS_API_KEY ?? process.env.RESEND_API_KEY)
try {
const { error: contactError } = await contactResend.contacts.create({
email: trimmedEmail,
firstName,
lastName,
unsubscribed: false,
...(process.env.RESEND_SEGMENT_ID
? { segments: [{ id: process.env.RESEND_SEGMENT_ID }] }
: {}),
})
if (contactError) {
const { error: updateError } = await contactResend.contacts.update({
email: trimmedEmail,
firstName,
lastName,
unsubscribed: false,
})
if (updateError) {
console.error('[contact] contact sync error:', updateError)
}
}
} catch (contactSyncErr) {
console.error('[contact] contact sync exception:', contactSyncErr)
}
await syncContactToResend(trimmedName, trimmedEmail)
}
const { error } = await resend.emails.send({