mirror of
https://github.com/Memo-2023/mana-monorepo.git
synced 2026-05-23 13:26:42 +02:00
This commit bundles two unrelated changes that were swept together by an
accidental `git add -A` in another working session. Documented here so the
history reflects what's actually inside.
═══════════════════════════════════════════════════════════════════════
1. fix(mana-auth): /api/v1/auth/login mints JWT via auth.handler instead
of api.signInEmail
═══════════════════════════════════════════════════════════════════════
Previous attempt (commit 55cc75e7d) tried to fix the broken JWT mint in
/api/v1/auth/login by switching the cookie name from `mana.session_token`
to `__Secure-mana.session_token` for production. That was necessary but
not sufficient: Better Auth's session cookie value isn't just the raw
session token, it's `<token>.<HMAC>` where the HMAC is derived from the
better-auth secret. Reconstructing the cookie from auth.api.signInEmail's
JSON response only gave us the raw token, so /api/auth/token's
get-session middleware still couldn't validate it and the JWT mint kept
silently failing.
Real fix: do the sign-in via auth.handler (the HTTP path) rather than
auth.api.signInEmail (the SDK path). The handler returns a real fetch
Response with a Set-Cookie header containing the fully signed cookie
envelope. We capture that header verbatim and forward it as the cookie
on the /api/auth/token request, which now passes validation and mints
the JWT correctly.
Verified end-to-end on auth.mana.how:
$ curl -X POST https://auth.mana.how/api/v1/auth/login \
-d '{"email":"...","password":"..."}'
{
"user": {...},
"token": "<session token>",
"accessToken": "eyJhbGciOiJFZERTQSI...", ← real JWT now
"refreshToken": "<session token>"
}
Side benefits:
- Email-not-verified path is now handled by checking
signInResponse.status === 403 directly, no more catching APIError
with the comment-noted async-stream footgun.
- X-Forwarded-For is forwarded explicitly so Better Auth's rate limiter
and our security log see the real client IP.
- The leftover catch block now only handles unexpected exceptions
(network errors etc); the FORBIDDEN-checking logic in it is dead but
harmless and left in for defense in depth.
═══════════════════════════════════════════════════════════════════════
2. chore: remove the entire self-hosted Matrix stack (Synapse, Element,
Manalink, mana-matrix-bot)
═══════════════════════════════════════════════════════════════════════
The Matrix subsystem ran parallel to the main Mana product without any
load-bearing integration: the unified web app never imported matrix-js-sdk,
the chat module uses mana-sync (local-first), and mana-matrix-bot's
plugins duplicated features the unified app already ships natively.
Keeping it alive cost a Synapse + Element + matrix-web + bot container
quartet, three Cloudflare routes, an OIDC provider plugin in mana-auth,
and a steady drip of devlog/dependency churn.
Removed:
- apps/matrix (Manalink web + mobile, ~150 files)
- services/mana-matrix-bot (Go bot with ~20 plugins)
- docker/matrix configs (Synapse + Element)
- synapse/element-web/matrix-web/mana-matrix-bot services in
docker-compose.macmini.yml
- matrix.mana.how/element.mana.how/link.mana.how Cloudflare tunnel routes
- OIDC provider plugin + matrix-synapse trustedClient + matrixUserLinks
table from mana-auth (oauth_* schema definitions also removed)
- MatrixService import path in mana-media (importFromMatrix endpoint)
- Matrix notification channel in mana-notify (worker, metrics, config,
channel_type enum, MatrixOptions handler)
- Matrix entries from shared-branding (mana-apps + app-icons),
notify-client, the i18n bundle, the observatory map, the credits
app-label list, the landing footer/apps page, the prometheus + alerts
+ promtail tier mappings, and the matrix-related deploy paths in
cd-macmini.yml + ci.yml
Devlog/manascore/blueprint entries that mention Matrix are left intact
as historical record. The oauth_* + matrix_user_links Postgres tables
stay on existing prod databases — code can no longer write to them, drop
them in a follow-up migration if you want them gone for real.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
163 lines
4.9 KiB
TypeScript
163 lines
4.9 KiB
TypeScript
import { Hono } from 'hono';
|
|
import { cors } from 'hono/cors';
|
|
import { Queue, Worker, Job } from 'bullmq';
|
|
import { collectDefaultMetrics, Registry, Counter, Histogram } from 'prom-client';
|
|
import { getDb, closeConnection } from './db';
|
|
import { StorageService } from './services/storage';
|
|
import { UploadService } from './services/upload';
|
|
import { ProcessService } from './services/process';
|
|
import { ExifService } from './services/exif';
|
|
import { uploadRoutes } from './routes/upload';
|
|
import { deliveryRoutes } from './routes/delivery';
|
|
import { PROCESS_QUEUE, SUPPORTED_IMAGE_TYPES } from './constants';
|
|
|
|
const port = parseInt(process.env.PORT || '3015');
|
|
|
|
// Database
|
|
const databaseUrl = process.env.DATABASE_URL;
|
|
if (!databaseUrl) throw new Error('DATABASE_URL is required');
|
|
const db = getDb(databaseUrl);
|
|
|
|
// Services
|
|
const storage = new StorageService();
|
|
await storage.init();
|
|
|
|
const exifService = new ExifService();
|
|
const processService = new ProcessService(storage, exifService);
|
|
|
|
const processQueue = new Queue(PROCESS_QUEUE, {
|
|
connection: {
|
|
host: process.env.REDIS_HOST || 'localhost',
|
|
port: parseInt(process.env.REDIS_PORT || '6379'),
|
|
password: process.env.REDIS_PASSWORD || undefined,
|
|
},
|
|
});
|
|
|
|
const uploadService = new UploadService(db, storage, processQueue);
|
|
|
|
// BullMQ Worker
|
|
const worker = new Worker(
|
|
PROCESS_QUEUE,
|
|
async (job: Job<{ mediaId: string; mimeType: string; originalKey: string }>) => {
|
|
const { mediaId, mimeType, originalKey } = job.data;
|
|
console.log(`Processing media ${mediaId} (${mimeType})`);
|
|
|
|
try {
|
|
if (SUPPORTED_IMAGE_TYPES.includes(mimeType)) {
|
|
const result = await processService.processImage(mediaId, originalKey, mimeType);
|
|
await uploadService.update(mediaId, {
|
|
status: 'ready',
|
|
thumbnailKey: result.thumbnail,
|
|
mediumKey: result.medium,
|
|
largeKey: result.large,
|
|
width: result.metadata?.width,
|
|
height: result.metadata?.height,
|
|
format: result.metadata?.format,
|
|
hasAlpha: result.metadata?.hasAlpha,
|
|
exifData: result.exif?.raw,
|
|
dateTaken: result.exif?.dateTaken,
|
|
cameraMake: result.exif?.cameraMake,
|
|
cameraModel: result.exif?.cameraModel,
|
|
focalLength: result.exif?.focalLength,
|
|
aperture: result.exif?.aperture,
|
|
iso: result.exif?.iso,
|
|
exposureTime: result.exif?.exposureTime,
|
|
gpsLatitude: result.exif?.gpsLatitude,
|
|
gpsLongitude: result.exif?.gpsLongitude,
|
|
});
|
|
console.log(
|
|
`Processed image ${mediaId}: thumbnail=${!!result.thumbnail}, medium=${!!result.medium}, large=${!!result.large}, exif=${!!result.exif}`
|
|
);
|
|
} else {
|
|
await uploadService.update(mediaId, { status: 'ready' });
|
|
}
|
|
} catch (error) {
|
|
console.error(`Failed to process media ${mediaId}:`, error);
|
|
await uploadService.update(mediaId, { status: 'failed' });
|
|
throw error;
|
|
}
|
|
},
|
|
{
|
|
connection: {
|
|
host: process.env.REDIS_HOST || 'localhost',
|
|
port: parseInt(process.env.REDIS_PORT || '6379'),
|
|
password: process.env.REDIS_PASSWORD || undefined,
|
|
},
|
|
}
|
|
);
|
|
|
|
// Prometheus metrics
|
|
const register = new Registry();
|
|
register.setDefaultLabels({ service: 'mana-media' });
|
|
collectDefaultMetrics({ register, prefix: 'media_' });
|
|
|
|
const httpRequestsTotal = new Counter({
|
|
name: 'media_http_requests_total',
|
|
help: 'Total HTTP requests',
|
|
labelNames: ['method', 'path', 'status'] as const,
|
|
registers: [register],
|
|
});
|
|
|
|
const httpRequestDuration = new Histogram({
|
|
name: 'media_http_request_duration_seconds',
|
|
help: 'HTTP request duration in seconds',
|
|
labelNames: ['method', 'path', 'status'] as const,
|
|
buckets: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10],
|
|
registers: [register],
|
|
});
|
|
|
|
// Hono app
|
|
const app = new Hono();
|
|
|
|
// CORS
|
|
app.use(
|
|
'*',
|
|
cors({
|
|
origin: process.env.CORS_ORIGINS?.split(',') || '*',
|
|
credentials: true,
|
|
})
|
|
);
|
|
|
|
// Metrics middleware
|
|
app.use('*', async (c, next) => {
|
|
const start = Date.now();
|
|
await next();
|
|
const duration = (Date.now() - start) / 1000;
|
|
const path = c.req.routePath || c.req.path;
|
|
httpRequestsTotal.inc({ method: c.req.method, path, status: c.res.status });
|
|
httpRequestDuration.observe({ method: c.req.method, path, status: c.res.status }, duration);
|
|
});
|
|
|
|
// Health
|
|
app.get('/health', (c) =>
|
|
c.json({ status: 'ok', service: 'mana-media', timestamp: new Date().toISOString() })
|
|
);
|
|
|
|
// Metrics
|
|
app.get('/metrics', async (c) => {
|
|
c.header('Content-Type', register.contentType);
|
|
return c.text(await register.metrics());
|
|
});
|
|
|
|
// API routes
|
|
const api = new Hono();
|
|
api.route('/media', uploadRoutes(uploadService));
|
|
api.route('/media', deliveryRoutes(uploadService, processService, storage));
|
|
app.route('/api/v1', api);
|
|
|
|
// Graceful shutdown
|
|
process.on('SIGTERM', async () => {
|
|
console.log('Shutting down...');
|
|
await worker.close();
|
|
await processQueue.close();
|
|
await closeConnection();
|
|
process.exit(0);
|
|
});
|
|
|
|
console.log(`Mana Media service running on port ${port}`);
|
|
console.log(`Health check: http://localhost:${port}/health`);
|
|
|
|
export default {
|
|
port,
|
|
fetch: app.fetch,
|
|
};
|