Harden sync and security; add IQ Bible, templates, password reset, backups

Sync and data safety
- Autosave flushes on leaving a study or the tab; storage-full errors are reported
- Unsynced studies, deletes and ink are queued and retried when back online
- Deletes propagate across devices (with a "Keep it" undo) and no longer resurrect
- Server assigns study versions (no client-clock conflicts); "Combine both"
  merges a conflicted study chunk by chunk
- Reading-plan progress made offline is merged, not overwritten; plans, ink and
  marks are cleared from the device on sign-out

Security
- Block SSRF through the ntfy reminder URL; failure-only rate limiting per IP and
  account; constant-time login; TOTP replay protection; input validation;
  SESSION_SECRET required in production; admin user delete fixed
- Forgot password: one-time code sent to the account's ntfy topic

Features
- IQ Bible proxy (route allow-list, text-only caching per its terms): more
  commentaries, lexicons, study aids, daily verse and devotional, plan calendar
  export, narrations, podcast background
- Study templates, reading-plan catch-up, account export, daily database snapshots

Tests and tooling
- ESLint config; App tests split into src/test; tests for sync queues, library
  hook, merge, templates, IQ Bible UI and reset form

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

server/reminders.js

@@ -2,12 +2,48 @@
 // a free pub/sub push service: POST a message to a topic URL, anyone
 // subscribed to that topic (via the ntfy app or a browser) gets notified.
 // No API keys or push-subscription plumbing needed.
+import { lookup } from 'dns/promises';
+import { isIP } from 'net';
 import { getUsersWithRemindersEnabled, setLastReminderDate, getReadingProgress } from './db.js';
 
 // A reminder still goes out if the server was briefly down (or restarting) at the
 // exact minute — as long as it's within this window after the chosen time.
 const GRACE_MINUTES = 180;
 const SEND_TIMEOUT_MS = 10_000;
+// A failed send is retried at most this often, so a dead ntfy server isn't hit every minute for hours.
+const RETRY_AFTER_MS = 15 * 60 * 1000;
+const _lastAttempt = new Map(); // userId -> timestamp of the last failed send
+
+// True for loopback, private, link-local and other non-public addresses (IPv4 and IPv6).
+export function isPrivateAddress(addr) {
+  const v = isIP(addr);
+  if (v === 4) {
+    const [a, b] = addr.split('.').map(Number);
+    return a === 0 || a === 10 || a === 127 || (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31)
+      || (a === 192 && b === 168) || (a === 100 && b >= 64 && b <= 127) || a >= 224;
+  }
+  if (v === 6) {
+    const l = addr.toLowerCase();
+    if (l === '::' || l === '::1') return true;
+    if (l.startsWith('::ffff:')) return isPrivateAddress(l.slice(7));
+    return /^f[cd]/.test(l) || /^fe[89ab]/.test(l);
+  }
+  return true;
+}
+
+// Rejects server URLs that would make this server call itself or its private network.
+// A self-hosted ntfy on the LAN can be allowed by the server's admin with ALLOW_PRIVATE_NTFY=1.
+export async function assertPublicUrl(raw) {
+  if (process.env.ALLOW_PRIVATE_NTFY === '1') return;
+  let u;
+  try { u = new URL(raw); } catch { throw new Error('Server URL is not valid.'); }
+  if (!/^https?:$/.test(u.protocol)) throw new Error('Server URL must start with http:// or https://.');
+  const host = u.hostname.replace(/^\[|\]$/g, '');
+  if (/^localhost$|\.localhost$|\.local$|\.internal$/i.test(host)) throw new Error('Server URL must be a public address.');
+  const addrs = isIP(host) ? [host] : (await lookup(host, { all: true }).catch(() => [])).map((a) => a.address);
+  if (addrs.length === 0) throw new Error(`Could not find ${host}.`);
+  if (addrs.some(isPrivateAddress)) throw new Error('Server URL must be a public address.');
+}
 
 export function isValidTimeZone(tz) {
   if (!tz) return false;
@@ -40,17 +76,23 @@ export function isDue(user, now = new Date()) {
 export async function sendNtfy(user, { title, body, tags = 'open_book' }) {
   const base = (user.ntfyUrl || 'https://ntfy.sh').replace(/\/+$/, '');
   const url = `${base}/${encodeURIComponent(user.ntfyTopic)}`;
+  await assertPublicUrl(url);
   const headers = { Title: title, Tags: tags };
   if (process.env.APP_URL) headers.Click = process.env.APP_URL; // tapping the notification opens the app
   let res;
   try {
-    res = await fetch(url, { method: 'POST', headers, body, signal: AbortSignal.timeout(SEND_TIMEOUT_MS) });
+    res = await fetch(url, { method: 'POST', headers, body, redirect: 'error', signal: AbortSignal.timeout(SEND_TIMEOUT_MS) });
   } catch (err) {
-    throw new Error(err.name === 'TimeoutError' ? `Timed out reaching ${base}` : `Could not reach ${base} (${err.cause?.code ?? err.message})`);
+    throw new Error(err.name === 'TimeoutError' ? `Timed out reaching ${base}` : `Could not reach ${base} (${err.cause?.code ?? err.message})`, { cause: err });
   }
   if (!res.ok) throw new Error(`ntfy responded ${res.status}`);
 }
 
+// Has the user already finished a reading day on `date` ("YYYY-MM-DD", in their timezone)?
+export function readToday(progress, date) {
+  return Array.isArray(progress?.activity) && progress.activity.includes(date);
+}
+
 export function reminderBody(progress) {
   const active = (Array.isArray(progress?.progress) ? progress.progress : []).filter((p) => !p.completedAt).length;
   return active > 1 ? `Don't forget today's reading! You have ${active} plans in progress.` : "Don't forget today's reading!";
@@ -67,7 +109,11 @@ export async function checkReminders(now = new Date()) {
       const progress = getReadingProgress(user.id);
       const hasActivePlan = Array.isArray(progress?.progress) && progress.progress.some((p) => !p.completedAt);
       if (!hasActivePlan) continue; // nothing to nudge them about
+      if (readToday(progress, zonedNow(now, user.reminderTz).date)) continue; // already read today: no nudge
+      if (now.getTime() - (_lastAttempt.get(user.id) ?? 0) < RETRY_AFTER_MS) continue;
+      _lastAttempt.set(user.id, now.getTime());
       await sendNtfy(user, { title: 'Reading Plan Reminder', body: reminderBody(progress) });
+      _lastAttempt.delete(user.id);
       setLastReminderDate(user.id, zonedNow(now, user.reminderTz).date);
     } catch (err) {
       console.error(`Reading reminder failed for user ${user.id}:`, err.message);