813bc46640
A WordPress-inspired CMS whose entire backend is PiCloud Rhai scripts deployed with pic apply, plus a SvelteKit frontend. Built to dogfood the project tool, CLI, and SDK; exercises docs/kv/files/users, docs+queue+cron +pubsub triggers, the transactional-outbox notification chain, a docs before-interceptor, set_if CAS, SSE, per-app CORS, env overlays, and a durable Workflow (validate -> enrich || seo -> publish -> finalize) started with workflow::start and polled with workflow::run_status, visualized live with Svelte Flow. FINDINGS.md / SECURITY.md capture every gap, surprise, and security issue found (each tagged [PiCloud] vs [CMS]); the platform fixes for the actionable ones ship in the preceding commit. Also folds in the read-only `pic` allowlist entries added to .claude/settings.json during the session (fewer-permission-prompts). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
45 lines
1.6 KiB
Plaintext
45 lines
1.6 KiB
Plaintext
// POST /cms/auth/register — reader self-signup (public).
|
|
// Rate-limited by client IP + email to blunt enumeration/abuse (the only
|
|
// primitive PiCloud gives us for this is a kv counter).
|
|
let b = ctx.request.body;
|
|
if b == () || type_of(b) != "map" {
|
|
return #{ statusCode: 400, body: #{ error: "expected JSON body" } };
|
|
}
|
|
let email = b.email;
|
|
let password = b.password;
|
|
let name = if b.display_name == () { () } else { b.display_name };
|
|
|
|
if email == () || password == () {
|
|
return #{ statusCode: 400, body: #{ error: "email and password required" } };
|
|
}
|
|
if vars::get("signups-open") != "true" {
|
|
return #{ statusCode: 403, body: #{ error: "signups are closed" } };
|
|
}
|
|
|
|
// --- basic rate limit: max 5 registration attempts / hour / IP ---
|
|
let ip = ctx.request.headers["x-forwarded-for"];
|
|
if ip == () { ip = "local"; }
|
|
let rl = kv::collection("ratelimit");
|
|
let bucket = "register:" + ip;
|
|
let cur = rl.get(bucket);
|
|
let count = if cur == () { 0 } else { cur.count };
|
|
if count >= 5 {
|
|
return #{ statusCode: 429, body: #{ error: "too many attempts, try later" } };
|
|
}
|
|
rl.set(bucket, #{ count: count + 1, at: time::now() });
|
|
|
|
// email_available is the anon-safe probe (find_by_email requires a principal).
|
|
if !users::email_available(email) {
|
|
return #{ statusCode: 409, body: #{ error: "email already registered" } };
|
|
}
|
|
|
|
let u = ();
|
|
try {
|
|
u = users::create(#{ email: email, password: password, display_name: name });
|
|
} catch(e) {
|
|
return #{ statusCode: 400, body: #{ error: "could not create user: " + e } };
|
|
}
|
|
users::add_role(u.id, "reader");
|
|
|
|
#{ statusCode: 201, body: #{ id: u.id, email: u.email, roles: ["reader"] } }
|