ankn/Orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(andreknie.de): improve mobile dock and resource requests

Browse Source
This commit is contained in:
ankn
2026-07-28 20:54:08 +02:00
parent 0459daa074
commit 8236cce85c
12 changed files with 219 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
privat/CV/andreknie.de/server/routes/resource-download.js
+18 -34
View File
@@ -1,27 +1,19 @@
import { Router } from 'express'
import { readFileSync, writeFileSync, existsSync } from 'fs'
import { existsSync, readdirSync } from 'fs'
import { join, dirname } from 'path'
import { fileURLToPath } from 'url'
import { Mutex } from 'async-mutex'
import { resourceLimiter } from '../middleware/rateLimiter.js'
import { antiSpam } from '../middleware/antiSpam.js'
import { sendStakeholderNotification, MailerNotReadyError } from '../services/mailer.js'
const __dirname = dirname(fileURLToPath(import.meta.url))
const LEADS_FILE = join(__dirname, '..', 'data', 'leads.json')
const leadsMutex = new Mutex()
const RESOURCES_DIR = join(__dirname, '..', '..', 'public', 'resources')
// Only alphanumeric + hyphen resource IDs are allowed. This prevents path
// traversal (e.g. "../../etc/passwd") when building the download URL.
const RESOURCE_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/
function loadLeads() {
if (!existsSync(LEADS_FILE)) return []
try { return JSON.parse(readFileSync(LEADS_FILE, 'utf-8')) }
catch { return [] }
}
function saveLeads(leads) {
writeFileSync(LEADS_FILE, JSON.stringify(leads, null, 2), 'utf-8')
export function getAvailableResourceIds() {
if (!existsSync(RESOURCES_DIR)) return []
return readdirSync(RESOURCES_DIR, { withFileTypes: true })
.filter(entry => entry.isFile() && entry.name.endsWith('.pdf') && entry.name !== 'speaker-cv-andre-knie.pdf')
.map(entry => entry.name.slice(0, -4))
}
const router = Router()
@@ -31,29 +23,21 @@ router.post('/', resourceLimiter, antiSpam, async (req, res) => {
const errors = {}
if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
if (name && name.length > 100) errors.name = 'Max. 100 Zeichen.'
if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gültige E-Mail erforderlich.'
if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gueltige E-Mail erforderlich.'
if (!company || company.trim().length === 0) errors.company = 'Unternehmen ist erforderlich.'
if (company && company.length > 150) errors.company = 'Max. 150 Zeichen.'
if (!resource_id || !RESOURCE_ID_PATTERN.test(resource_id)) errors.resource_id = 'Ungültige Resource-ID.'
if (Object.keys(errors).length > 0) {
return res.status(400).json({ errors })
if (!resource_id || !getAvailableResourceIds().includes(resource_id)) {
errors.resource_id = 'Diese Ressource ist derzeit nicht verfügbar.'
}
await leadsMutex.runExclusive(async () => {
const leads = loadLeads()
leads.push({
name,
email,
company,
resource_id,
timestamp: new Date().toISOString(),
})
saveLeads(leads)
})
if (Object.keys(errors).length > 0) return res.status(400).json({ errors })
// Return download URL (resource files are in public/resources/)
res.json({ ok: true, download_url: `/resources/${resource_id}.pdf` })
try {
await sendStakeholderNotification('resource-download', { name, email, company, resource_id })
res.status(202).json({ ok: true, message: 'Danke! Wir prüfen die Anfrage und melden uns bei dir.' })
} catch (error) {
res.status(error instanceof MailerNotReadyError ? 503 : 502).json({ error: 'Die Anfrage konnte derzeit nicht übermittelt werden.' })
}
})
export default router