v26.3

Structures/DashboardBranding.js

@@ -0,0 +1,168 @@
+const fs = require('fs');
+const path = require('path');
+
+const BRANDING_DIR = path.join(__dirname, '../Data/branding');
+const BRANDING_FILE = path.join(BRANDING_DIR, 'branding.json');
+const FAVICON_BASENAME = 'favicon';
+
+const DEFAULTS = {
+    title: 'SupportBot',
+    pageTitle: 'SupportBot Dashboard',
+    faviconFile: null,
+    faviconMime: null,
+    updatedAt: null,
+};
+
+const ALLOWED_MIME = new Set([
+    'image/png',
+    'image/jpeg',
+    'image/x-icon',
+    'image/vnd.microsoft.icon',
+    'image/svg+xml',
+    'image/webp',
+]);
+
+const MIME_EXT = {
+    'image/png': '.png',
+    'image/jpeg': '.jpg',
+    'image/x-icon': '.ico',
+    'image/vnd.microsoft.icon': '.ico',
+    'image/svg+xml': '.svg',
+    'image/webp': '.webp',
+};
+
+function ensureDir() {
+    if (!fs.existsSync(BRANDING_DIR)) {
+        fs.mkdirSync(BRANDING_DIR, { recursive: true });
+    }
+}
+
+function readBranding() {
+    ensureDir();
+    if (!fs.existsSync(BRANDING_FILE)) {
+        return { ...DEFAULTS };
+    }
+    try {
+        const raw = JSON.parse(fs.readFileSync(BRANDING_FILE, 'utf8'));
+        return {
+            title: String(raw.title || DEFAULTS.title).slice(0, 64),
+            pageTitle: String(raw.pageTitle || DEFAULTS.pageTitle).slice(0, 80),
+            faviconFile: raw.faviconFile || null,
+            faviconMime: raw.faviconMime || null,
+            updatedAt: raw.updatedAt || null,
+        };
+    } catch {
+        return { ...DEFAULTS };
+    }
+}
+
+function writeBranding(data) {
+    ensureDir();
+    const next = {
+        title: String(data.title || DEFAULTS.title).slice(0, 64),
+        pageTitle: String(data.pageTitle || DEFAULTS.pageTitle).slice(0, 80),
+        faviconFile: data.faviconFile ?? null,
+        faviconMime: data.faviconMime ?? null,
+        updatedAt: Date.now(),
+    };
+    fs.writeFileSync(BRANDING_FILE, JSON.stringify(next, null, 2), 'utf8');
+    return next;
+}
+
+function publicPayload(branding) {
+    const hasFavicon = Boolean(branding.faviconFile);
+    return {
+        title: branding.title,
+        pageTitle: branding.pageTitle,
+        hasFavicon,
+        faviconUrl: hasFavicon ? '/api/branding/favicon' : null,
+        updatedAt: branding.updatedAt,
+    };
+}
+
+function updateBranding({ title, pageTitle }) {
+    const current = readBranding();
+    return writeBranding({
+        ...current,
+        title: title !== undefined ? title : current.title,
+        pageTitle: pageTitle !== undefined ? pageTitle : current.pageTitle,
+    });
+}
+
+function removeExistingFavicons() {
+    if (!fs.existsSync(BRANDING_DIR)) return;
+    for (const file of fs.readdirSync(BRANDING_DIR)) {
+        if (file.startsWith(`${FAVICON_BASENAME}.`)) {
+            fs.unlinkSync(path.join(BRANDING_DIR, file));
+        }
+    }
+}
+
+function saveFaviconFromBase64(dataUrl) {
+    const match = String(dataUrl || '').match(
+        /^data:([\w/+.-]+);base64,([A-Za-z0-9+/=]+)$/,
+    );
+    if (!match) {
+        throw new Error('Invalid image data. Upload a PNG, ICO, SVG, or WebP file.');
+    }
+
+    const mime = match[1];
+    if (!ALLOWED_MIME.has(mime)) {
+        throw new Error('Unsupported image type. Use PNG, ICO, SVG, JPEG, or WebP.');
+    }
+
+    const buffer = Buffer.from(match[2], 'base64');
+    if (buffer.length > 512 * 1024) {
+        throw new Error('Favicon must be 512 KB or smaller.');
+    }
+
+    ensureDir();
+    removeExistingFavicons();
+
+    const ext = MIME_EXT[mime] || '.png';
+    const filename = `${FAVICON_BASENAME}${ext}`;
+    const filePath = path.join(BRANDING_DIR, filename);
+    fs.writeFileSync(filePath, buffer);
+
+    const current = readBranding();
+    return writeBranding({
+        ...current,
+        faviconFile: filename,
+        faviconMime: mime,
+    });
+}
+
+function clearFavicon() {
+    removeExistingFavicons();
+    const current = readBranding();
+    return writeBranding({
+        ...current,
+        faviconFile: null,
+        faviconMime: null,
+    });
+}
+
+function getFaviconPath() {
+    const branding = readBranding();
+    if (!branding.faviconFile) return null;
+    const filePath = path.join(BRANDING_DIR, branding.faviconFile);
+    if (!fs.existsSync(filePath)) return null;
+    return { filePath, mime: branding.faviconMime || 'image/png' };
+}
+
+function resetBranding() {
+    clearFavicon();
+    return writeBranding({ ...DEFAULTS });
+}
+
+module.exports = {
+    readBranding,
+    writeBranding,
+    publicPayload,
+    updateBranding,
+    saveFaviconFromBase64,
+    clearFavicon,
+    getFaviconPath,
+    resetBranding,
+    DEFAULTS,
+};

Structures/DashboardSession.js

@@ -51,10 +51,14 @@ function createSessionPayload(user) {
   };
 }
 
-function sessionCookieOptions(maxAgeMs = SESSION_MAX_AGE_MS) {
+function sessionCookieOptions(maxAgeMs = SESSION_MAX_AGE_MS, opts = {}) {
+  const secure =
+    opts.secure !== undefined
+      ? Boolean(opts.secure)
+      : process.env.NODE_ENV === "production";
   return {
     httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
+    secure,
     sameSite: "lax",
     maxAge: maxAgeMs,
     path: "/",

Structures/DiscordOAuth.js

@@ -3,7 +3,9 @@ const axios = require("axios");
 
 const DISCORD_API = "https://discord.com/api";
 const OAUTH_STATE_COOKIE = "sb_oauth_state";
+const OAUTH_REDIRECT_COOKIE = "sb_oauth_redirect";
 const OAUTH_STATE_MAX_AGE_MS = 10 * 60 * 1000;
+const CALLBACK_PATH = "/api/auth/discord/callback";
 
 function discordAvatarUrl(user) {
   if (user.avatar) {
@@ -14,10 +16,125 @@ function discordAvatarUrl(user) {
   return `https://cdn.discordapp.com/embed/avatars/${index}.png`;
 }
 
-function buildAuthorizeUrl(oauth, state) {
+function getTrustProxySetting(apiConfig) {
+  if (apiConfig?.TrustProxy === false) return false;
+  if (typeof apiConfig?.TrustProxy === "number") return apiConfig.TrustProxy;
+  if (apiConfig?.TrustProxy === true) return 1;
+  return false;
+}
+
+function getRequestProto(req, apiConfig) {
+  if (apiConfig?.TrustProxy !== false) {
+    const forwarded = req.get("x-forwarded-proto");
+    if (forwarded) {
+      return forwarded.split(",")[0].trim().toLowerCase();
+    }
+  }
+  return (req.protocol || "http").toLowerCase();
+}
+
+function getRequestHost(req) {
+  const forwarded = req.get("x-forwarded-host");
+  if (forwarded) {
+    return forwarded.split(",")[0].trim();
+  }
+  return req.get("host") || "";
+}
+
+function getRequestOrigin(req, apiConfig) {
+  const proto = getRequestProto(req, apiConfig);
+  const host = getRequestHost(req);
+  if (!host) return null;
+  return `${proto}://${host}`;
+}
+
+function normalizeRedirectUri(uri) {
+  try {
+    const u = new URL(uri);
+    u.hash = "";
+    u.search = "";
+    return u.toString();
+  } catch {
+    return null;
+  }
+}
+
+function redirectUriMatchesHostPath(a, b) {
+  try {
+    const ua = new URL(a);
+    const ub = new URL(b);
+    return ua.host === ub.host && ua.pathname === ub.pathname;
+  } catch {
+    return false;
+  }
+}
+
+function collectConfiguredRedirectUris(oauth) {
+  const list = [];
+  if (oauth?.RedirectUri) {
+    const normalized = normalizeRedirectUri(oauth.RedirectUri);
+    if (normalized) list.push(normalized);
+  }
+  if (Array.isArray(oauth?.RedirectUris)) {
+    for (const entry of oauth.RedirectUris) {
+      const normalized = normalizeRedirectUri(entry);
+      if (normalized && !list.includes(normalized)) {
+        list.push(normalized);
+      }
+    }
+  }
+  return list;
+}
+
+/**
+ * Pick the OAuth redirect_uri for this request. When UseRequestOrigin is enabled
+ * (default), uses the same host/path as RedirectUri but the protocol the user
+ * actually used (http vs https). Register every variant in the Discord portal.
+ */
+function resolveOAuthRedirectUri(req, oauth, apiConfig) {
+  const configured = collectConfiguredRedirectUris(oauth);
+  const fallback = configured[0] || oauth?.RedirectUri || "";
+
+  const useRequestOrigin = oauth?.UseRequestOrigin !== false;
+  if (!useRequestOrigin || !req) {
+    return fallback;
+  }
+
+  const origin = getRequestOrigin(req, apiConfig);
+  if (!origin) return fallback;
+
+  const dynamic = `${origin}${CALLBACK_PATH}`;
+  const normalizedDynamic = normalizeRedirectUri(dynamic);
+  if (!normalizedDynamic) return fallback;
+
+  if (configured.includes(normalizedDynamic)) {
+    return normalizedDynamic;
+  }
+
+  const matchesConfigured = configured.some((uri) =>
+    redirectUriMatchesHostPath(uri, normalizedDynamic),
+  );
+  if (matchesConfigured) {
+    return normalizedDynamic;
+  }
+
+  return fallback;
+}
+
+function isSecureRequest(req, oauth, apiConfig) {
+  if (oauth?.CookieSecure === true) return true;
+  if (oauth?.CookieSecure === false) return false;
+  if (req) {
+    if (typeof req.secure === "boolean") return req.secure;
+    return getRequestProto(req, apiConfig) === "https";
+  }
+  return process.env.NODE_ENV === "production";
+}
+
+function buildAuthorizeUrl(oauth, state, redirectUri) {
   const params = new URLSearchParams({
     client_id: oauth.ClientId,
-    redirect_uri: oauth.RedirectUri,
+    redirect_uri: redirectUri,
     response_type: "code",
     scope: "identify",
     state,
@@ -26,13 +143,13 @@ function buildAuthorizeUrl(oauth, state) {
   return `${DISCORD_API}/oauth2/authorize?${params.toString()}`;
 }
 
-async function exchangeCode(oauth, code) {
+async function exchangeCode(oauth, code, redirectUri) {
   const body = new URLSearchParams({
     client_id: oauth.ClientId,
     client_secret: oauth.ClientSecret,
     grant_type: "authorization_code",
     code,
-    redirect_uri: oauth.RedirectUri,
+    redirect_uri: redirectUri,
   });
 
   const { data } = await axios.post(`${DISCORD_API}/oauth2/token`, body, {
@@ -55,16 +172,20 @@ function createOAuthState() {
   return crypto.randomBytes(24).toString("hex");
 }
 
-function oauthStateCookieOptions() {
+function oauthStateCookieOptions(req, oauth, apiConfig) {
   return {
     httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
+    secure: isSecureRequest(req, oauth, apiConfig),
     sameSite: "lax",
     maxAge: OAUTH_STATE_MAX_AGE_MS,
     path: "/",
   };
 }
 
+function oauthRedirectCookieOptions(req, oauth, apiConfig) {
+  return oauthStateCookieOptions(req, oauth, apiConfig);
+}
+
 function isOAuthConfigured(oauth) {
   return Boolean(
     oauth?.Enabled &&
@@ -93,12 +214,18 @@ function formatPublicUser(user) {
 
 module.exports = {
   OAUTH_STATE_COOKIE,
+  OAUTH_REDIRECT_COOKIE,
   OAUTH_STATE_MAX_AGE_MS,
+  CALLBACK_PATH,
+  getTrustProxySetting,
+  resolveOAuthRedirectUri,
+  isSecureRequest,
   buildAuthorizeUrl,
   exchangeCode,
   fetchDiscordUser,
   createOAuthState,
   oauthStateCookieOptions,
+  oauthRedirectCookieOptions,
   isOAuthConfigured,
   isUserAllowed,
   formatPublicUser,

Structures/TranscriptStore.js

@@ -0,0 +1,223 @@
+const fs = require('fs');
+const path = require('path');
+
+const TRANSCRIPT_DIR = path.join(__dirname, '../Data/Transcripts');
+const SETTINGS_FILE = path.join(__dirname, '../Data/transcript-settings.json');
+
+const DEFAULT_SETTINGS = {
+    autoDelete: {
+        enabled: false,
+        afterDays: 30,
+    },
+    publicAccess: {
+        enabled: false,
+    },
+};
+
+let purgeTimer = null;
+
+function ensureTranscriptDir() {
+    if (!fs.existsSync(TRANSCRIPT_DIR)) {
+        fs.mkdirSync(TRANSCRIPT_DIR, { recursive: true });
+    }
+}
+
+function getSettings() {
+    try {
+        if (!fs.existsSync(SETTINGS_FILE)) {
+            return JSON.parse(JSON.stringify(DEFAULT_SETTINGS));
+        }
+        const raw = JSON.parse(fs.readFileSync(SETTINGS_FILE, 'utf8'));
+        const days = Number(raw?.autoDelete?.afterDays);
+        return {
+            autoDelete: {
+                enabled: Boolean(raw?.autoDelete?.enabled),
+                afterDays:
+                    Number.isFinite(days) && days >= 1
+                        ? Math.min(Math.floor(days), 3650)
+                        : DEFAULT_SETTINGS.autoDelete.afterDays,
+            },
+            publicAccess: {
+                enabled: Boolean(raw?.publicAccess?.enabled),
+            },
+        };
+    } catch {
+        return JSON.parse(JSON.stringify(DEFAULT_SETTINGS));
+    }
+}
+
+function saveSettings(patch) {
+    const current = getSettings();
+    const next = {
+        autoDelete: {
+            enabled:
+                patch?.autoDelete?.enabled !== undefined
+                    ? Boolean(patch.autoDelete.enabled)
+                    : current.autoDelete.enabled,
+            afterDays:
+                patch?.autoDelete?.afterDays !== undefined
+                    ? Math.min(
+                          Math.max(Math.floor(Number(patch.autoDelete.afterDays) || 1), 1),
+                          3650,
+                      )
+                    : current.autoDelete.afterDays,
+        },
+        publicAccess: {
+            enabled:
+                patch?.publicAccess?.enabled !== undefined
+                    ? Boolean(patch.publicAccess.enabled)
+                    : current.publicAccess.enabled,
+        },
+    };
+
+    const dir = path.dirname(SETTINGS_FILE);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.writeFileSync(SETTINGS_FILE, JSON.stringify(next, null, 2), 'utf8');
+    return next;
+}
+
+function normalizeId(rawId) {
+    return String(rawId).replace(/[^0-9]/g, '');
+}
+
+function readTranscriptFile(rawId) {
+    const id = normalizeId(rawId);
+    if (!id) return null;
+    ensureTranscriptDir();
+    const filePath = path.join(TRANSCRIPT_DIR, `${id}-transcript.html`);
+    if (!fs.existsSync(filePath)) return null;
+    const content = fs.readFileSync(filePath, 'utf8');
+    const titleMatch = content.match(/<title>\s*Transcript\s*-\s*([^<]+)\s*<\/title>/i);
+    return {
+        id,
+        filePath,
+        filename: `${id}-transcript.html`,
+        content,
+        ticketName: titleMatch ? titleMatch[1].trim() : null,
+    };
+}
+
+function listTranscripts() {
+    ensureTranscriptDir();
+    if (!fs.existsSync(TRANSCRIPT_DIR)) {
+        return [];
+    }
+    return fs
+        .readdirSync(TRANSCRIPT_DIR)
+        .filter((f) => f.endsWith('-transcript.html'))
+        .map((f) => {
+            const id = f.replace('-transcript.html', '');
+            const stats = fs.statSync(path.join(TRANSCRIPT_DIR, f));
+            const parsed = readTranscriptFile(id);
+            return {
+                id,
+                filename: f,
+                createdAt: stats.mtime.toISOString(),
+                size: stats.size,
+                ticketName: parsed?.ticketName ?? null,
+            };
+        })
+        .sort((a, b) => new Date(b.createdAt) - new Date(a.createdAt));
+}
+
+function deleteTranscript(rawId) {
+    const id = normalizeId(rawId);
+    if (!id) return false;
+    const filePath = path.join(TRANSCRIPT_DIR, `${id}-transcript.html`);
+    if (!fs.existsSync(filePath)) return false;
+    fs.unlinkSync(filePath);
+    return true;
+}
+
+function purgeExpiredTranscripts() {
+    const settings = getSettings();
+    if (!settings.autoDelete.enabled) {
+        return { deleted: 0, skipped: true };
+    }
+
+    ensureTranscriptDir();
+    const maxAgeMs = settings.autoDelete.afterDays * 24 * 60 * 60 * 1000;
+    const cutoff = Date.now() - maxAgeMs;
+    let deleted = 0;
+
+    for (const f of fs.readdirSync(TRANSCRIPT_DIR)) {
+        if (!f.endsWith('-transcript.html')) continue;
+        const filePath = path.join(TRANSCRIPT_DIR, f);
+        const stats = fs.statSync(filePath);
+        if (stats.mtime.getTime() < cutoff) {
+            fs.unlinkSync(filePath);
+            deleted += 1;
+        }
+    }
+
+    return { deleted, skipped: false };
+}
+
+function notFoundHtml(message = 'Transcript not found') {
+    return `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Transcript</title>
+<style>body{font-family:system-ui,sans-serif;padding:2rem;background:#0b0f14;color:#e6edf3;margin:0}</style></head>
+<body><h1>${message}</h1></body></html>`;
+}
+
+function servePublicTranscript(req, res) {
+    const settings = getSettings();
+    if (!settings.publicAccess.enabled) {
+        return res.status(404).type('html').send(notFoundHtml('Transcript not found'));
+    }
+
+    const transcript = readTranscriptFile(req.params.id);
+    if (!transcript) {
+        return res.status(404).type('html').send(notFoundHtml('Transcript not found'));
+    }
+
+    res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    res.setHeader('Cache-Control', 'public, max-age=120');
+    return res.send(transcript.content);
+}
+
+function startAutoDeleteScheduler(intervalMs = 60 * 60 * 1000) {
+    if (purgeTimer) return;
+
+    const run = () => {
+        try {
+            const result = purgeExpiredTranscripts();
+            if (result.deleted > 0) {
+                console.log(
+                    `[Transcripts] Auto-deleted ${result.deleted} transcript(s) older than ${getSettings().autoDelete.afterDays} day(s)`,
+                );
+            }
+        } catch (err) {
+            console.error('[Transcripts] Auto-delete failed:', err.message);
+        }
+    };
+
+    run();
+    purgeTimer = setInterval(run, intervalMs);
+    if (typeof purgeTimer.unref === 'function') {
+        purgeTimer.unref();
+    }
+}
+
+function getPublicUrl(req, id) {
+    const settings = getSettings();
+    if (!settings.publicAccess.enabled) return null;
+    const host = req.get('host');
+    const proto = req.get('x-forwarded-proto') || req.protocol || 'http';
+    return `${proto}://${host}/transcripts/${id}`;
+}
+
+module.exports = {
+    TRANSCRIPT_DIR,
+    DEFAULT_SETTINGS,
+    getSettings,
+    saveSettings,
+    readTranscriptFile,
+    listTranscripts,
+    deleteTranscript,
+    purgeExpiredTranscripts,
+    servePublicTranscript,
+    startAutoDeleteScheduler,
+    getPublicUrl,
+};