feat(hobbs-organizer): v1.1.0 password-protected LAN-only admin for calendar links

- /admin: first-visit password setup (scrypt), signed 30-day session cookie, calendars add/remove/reorder/rename/color/hide, masked URLs, per-feed test, history (20) with restore; /photo-admin -> /admin#photos placeholder - settings in local /data (settings.json + auth.json + history/), seeded once from the calendar secret; dashboard + health read from settings - start.mjs drops privileges after reading secrets and runs a front proxy that stamps the real client IP; admin refuses non-LAN and proxied requests - deploy: HOBBS_DATA_DIR=/var/lib/hobbs-organizer/data, image 1.1.0 (1.0.0 kept) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3
2026-11-04 18:55:00 -06:00
parent e9c7e9df1a
commit 8715589cbb
28 changed files with 1532 additions and 380 deletions
@@ -0,0 +1,60 @@
+import { randomUUID } from "node:crypto";
+import { json, readJsonBody, requireAdmin } from "../../../_lib/auth";
+import {
+  CALENDAR_TONES,
+  type CalendarSetting,
+  type CalendarTone,
+  MAX_CALENDARS,
+  maskCalendarUrl,
+  readSettings,
+  saveSettings,
+  validCalendarUrl,
+} from "../../../_lib/store";
+
+export const dynamic = "force-dynamic";
+
+function publicView(calendars: CalendarSetting[]) {
+  return calendars.map(({ id, name, tone, enabled, url }) => ({ id, name, tone, enabled, masked: maskCalendarUrl(url) }));
+}
+
+export async function GET(request: Request) {
+  const denied = await requireAdmin(request);
+  if (denied) return denied;
+  const settings = await readSettings();
+  return json({ calendars: publicView(settings.calendars), updatedAt: settings.updatedAt, tones: CALENDAR_TONES });
+}
+
+type IncomingCalendar = { id?: string; name?: string; tone?: string; enabled?: boolean; url?: string };
+
+export async function PUT(request: Request) {
+  const denied = await requireAdmin(request, { mutating: true });
+  if (denied) return denied;
+  const body = await readJsonBody<{ calendars?: IncomingCalendar[] }>(request);
+  if (!body || !Array.isArray(body.calendars)) return json({ error: "Expected a calendars list." }, 400);
+  if (body.calendars.length > MAX_CALENDARS) return json({ error: `At most ${MAX_CALENDARS} calendars.` }, 400);
+
+  const existing = new Map((await readSettings()).calendars.map((calendar) => [calendar.id, calendar]));
+  const next: CalendarSetting[] = [];
+  for (const [index, entry] of body.calendars.entries()) {
+    const label = entry.name?.trim() || `Calendar ${index + 1}`;
+    const previous = entry.id ? existing.get(entry.id) : undefined;
+    if (entry.id && !previous) return json({ error: `${label}: unknown calendar; reload the page.` }, 409);
+    const suppliedUrl = typeof entry.url === "string" && entry.url.trim() ? entry.url : "";
+    const url = suppliedUrl ? validCalendarUrl(suppliedUrl) : previous?.url;
+    if (!url) {
+      return json({ error: `${label}: paste a Google Calendar "Secret address in iCal format" (https://calendar.google.com/…/basic.ics).` }, 400);
+    }
+    next.push({
+      id: previous?.id ?? randomUUID(),
+      name: typeof entry.name === "string" ? entry.name.trim().slice(0, 50) : "",
+      url,
+      tone: CALENDAR_TONES.includes(entry.tone as CalendarTone) ? (entry.tone as CalendarTone) : "cyan",
+      enabled: entry.enabled !== false,
+    });
+  }
+  if (new Set(next.map((calendar) => calendar.url)).size !== next.length) return json({ error: "The same calendar is listed twice." }, 400);
+
+  const saved = await saveSettings(next, `Saved ${next.length} calendar(s)`);
+  console.log(`[admin] calendars saved (${saved.calendars.length})`);
+  return json({ calendars: publicView(saved.calendars), updatedAt: saved.updatedAt });
+}