feat(privat/CV): sync to latest upstream (cv-upstream/main, 30f9608b)

privat/CV/andreknie.de/server/index.js

@@ -0,0 +1,50 @@
+import express from 'express'
+import cors from 'cors'
+import helmet from 'helmet'
+import { dirname } from 'path'
+import { fileURLToPath } from 'url'
+import contactRouter from './routes/contact.js'
+import talkRequestRouter from './routes/talk-request.js'
+import newsletterRouter from './routes/newsletter.js'
+import resourceDownloadRouter from './routes/resource-download.js'
+import speakerCvRouter from './routes/speaker-cv.js'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const PORT = process.env.PORT || 3003
+
+const app = express()
+
+// Behind Caddy reverse proxy — trust the first proxy hop so rate limiting
+// and IP logging use the real client IP.
+app.set('trust proxy', 1)
+app.disable('x-powered-by')
+
+app.use(helmet())
+app.use(cors({
+  origin: process.env.NODE_ENV === 'production'
+    ? 'https://andreknie.de'
+    : 'http://localhost:5173',
+  credentials: true,
+}))
+app.use(express.json({ limit: '10kb' }))
+
+// Routes
+app.get('/api/health', (_req, res) => {
+  res.json({ status: 'ok', time: new Date().toISOString() })
+})
+
+app.use('/api/contact', contactRouter)
+app.use('/api/talk-request', talkRequestRouter)
+app.use('/api/newsletter', newsletterRouter)
+app.use('/api/resource-download', resourceDownloadRouter)
+app.use('/api/speaker-cv', speakerCvRouter)
+
+// Error handler
+app.use((err, _req, res, _next) => {
+  console.error('[Server Error]', err.message)
+  res.status(500).json({ error: 'Interner Serverfehler.' })
+})
+
+app.listen(PORT, () => {
+  console.log(`[andreknie.de Backend] Running on port ${PORT}`)
+})

privat/CV/andreknie.de/server/middleware/antiSpam.js

@@ -0,0 +1,38 @@
+/**
+ * Anti-spam middleware for public forms.
+ *
+ * Two complementary checks:
+ *  1. Honeypot — a hidden field (`company_website`) that real users never see.
+ *     If it is filled, the request is a bot. We respond with a fake success
+ *     so the bot does not learn it was detected.
+ *  2. Time trap — a `form_started_at` timestamp set by the client when the form
+ *     is rendered. Submissions faster than MIN_FILL_MS are almost certainly bots.
+ *
+ * Both fields are stripped from req.body before reaching route handlers.
+ */
+const MIN_FILL_MS = 2000 // 2 seconds
+
+export function antiSpam(req, res, next) {
+  const { company_website, form_started_at } = req.body || {}
+
+  // Honeypot filled → silently pretend success
+  if (company_website) {
+    return res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
+  }
+
+  // Time trap → too fast to be human
+  if (form_started_at) {
+    const elapsed = Date.now() - Number(form_started_at)
+    if (Number.isFinite(elapsed) && elapsed >= 0 && elapsed < MIN_FILL_MS) {
+      return res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
+    }
+  }
+
+  // Clean up internal fields before route handlers use req.body
+  if (req.body) {
+    delete req.body.company_website
+    delete req.body.form_started_at
+  }
+
+  next()
+}

privat/CV/andreknie.de/server/middleware/rateLimiter.js

@@ -0,0 +1,21 @@
+import rateLimit from 'express-rate-limit'
+
+/**
+ * Per-endpoint rate limiters. Limits are per IP per hour.
+ * Behind a reverse proxy (Caddy), `app.set('trust proxy', 1)` must be set
+ * so the real client IP is used instead of the proxy IP.
+ */
+function makeLimiter(max, message) {
+  return rateLimit({
+    windowMs: 60 * 60 * 1000, // 1 hour
+    max,
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: { error: message },
+  })
+}
+
+export const contactLimiter = makeLimiter(3, 'Zu viele Anfragen. Bitte versuche es später erneut.')
+export const talkRequestLimiter = makeLimiter(3, 'Zu viele Anfragen. Bitte versuche es später erneut.')
+export const newsletterLimiter = makeLimiter(5, 'Zu viele Anfragen. Bitte versuche es später erneut.')
+export const resourceLimiter = makeLimiter(10, 'Zu viele Anfragen. Bitte versuche es später erneut.')

privat/CV/andreknie.de/server/routes/contact.js

@@ -0,0 +1,36 @@
+import { Router } from 'express'
+import { contactLimiter } from '../middleware/rateLimiter.js'
+import { antiSpam } from '../middleware/antiSpam.js'
+import { createToken, verifyToken } from '../services/confirmationToken.js'
+import { sendConfirmationEmail, sendStakeholderNotification } from '../services/mailer.js'
+
+const router = Router()
+
+router.post('/', contactLimiter, antiSpam, async (req, res) => {
+  const { name, email, message } = req.body
+  const errors = {}
+  if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
+  if (name && name.length > 100) errors.name = 'Max. 100 Zeichen.'
+  if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gültige E-Mail erforderlich.'
+  if (!message || message.trim().length === 0) errors.message = 'Nachricht ist erforderlich.'
+  if (message && message.length > 2000) errors.message = 'Max. 2000 Zeichen.'
+
+  if (Object.keys(errors).length > 0) {
+    return res.status(400).json({ errors })
+  }
+
+  const token = createToken('contact', { name, email, message }, 24)
+  await sendConfirmationEmail(email, 'contact', token)
+  res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
+})
+
+router.post('/confirm/:token', async (req, res) => {
+  const entry = verifyToken(req.params.token)
+  if (!entry) {
+    return res.status(410).json({ error: 'Link abgelaufen oder ungültig.' })
+  }
+  await sendStakeholderNotification('contact', entry.data)
+  res.json({ ok: true, message: 'Nachricht wurde weitergeleitet.' })
+})
+
+export default router

privat/CV/andreknie.de/server/routes/newsletter.js

@@ -0,0 +1,59 @@
+import { Router } from 'express'
+import { readFileSync, writeFileSync, existsSync } from 'fs'
+import { join, dirname } from 'path'
+import { fileURLToPath } from 'url'
+import { newsletterLimiter } from '../middleware/rateLimiter.js'
+import { antiSpam } from '../middleware/antiSpam.js'
+import { createToken, verifyToken } from '../services/confirmationToken.js'
+import { sendConfirmationEmail } from '../services/mailer.js'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const SUBS_FILE = join(__dirname, '..', 'data', 'subscribers.json')
+
+function loadSubscribers() {
+  if (!existsSync(SUBS_FILE)) return []
+  try { return JSON.parse(readFileSync(SUBS_FILE, 'utf-8')) }
+  catch { return [] }
+}
+
+function saveSubscribers(subs) {
+  writeFileSync(SUBS_FILE, JSON.stringify(subs, null, 2), 'utf-8')
+}
+
+const router = Router()
+
+router.post('/', newsletterLimiter, antiSpam, async (req, res) => {
+  const { email } = req.body
+  if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+    return res.status(400).json({ errors: { email: 'Gültige E-Mail erforderlich.' } })
+  }
+
+  // Check for existing subscription
+  const subs = loadSubscribers()
+  if (subs.find(s => s.email === email && s.active)) {
+    return res.status(409).json({ error: 'Diese E-Mail ist bereits abonniert.' })
+  }
+
+  const token = createToken('newsletter', { email }, 48)
+  await sendConfirmationEmail(email, 'newsletter', token)
+  res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
+})
+
+router.get('/confirm/:token', async (req, res) => {
+  const entry = verifyToken(req.params.token)
+  if (!entry) {
+    return res.status(410).json({ error: 'Link abgelaufen oder ungültig.' })
+  }
+
+  const subs = loadSubscribers()
+  subs.push({
+    email: entry.data.email,
+    subscribedAt: new Date().toISOString(),
+    active: true,
+  })
+  saveSubscribers(subs)
+
+  res.json({ ok: true, message: 'Newsletter-Abo bestätigt.' })
+})
+
+export default router

privat/CV/andreknie.de/server/routes/resource-download.js

@@ -0,0 +1,55 @@
+import { Router } from 'express'
+import { readFileSync, writeFileSync, existsSync } from 'fs'
+import { join, dirname } from 'path'
+import { fileURLToPath } from 'url'
+import { resourceLimiter } from '../middleware/rateLimiter.js'
+import { antiSpam } from '../middleware/antiSpam.js'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const LEADS_FILE = join(__dirname, '..', 'data', 'leads.json')
+
+// Only alphanumeric + hyphen resource IDs are allowed. This prevents path
+// traversal (e.g. "../../etc/passwd") when building the download URL.
+const RESOURCE_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/
+
+function loadLeads() {
+  if (!existsSync(LEADS_FILE)) return []
+  try { return JSON.parse(readFileSync(LEADS_FILE, 'utf-8')) }
+  catch { return [] }
+}
+
+function saveLeads(leads) {
+  writeFileSync(LEADS_FILE, JSON.stringify(leads, null, 2), 'utf-8')
+}
+
+const router = Router()
+
+router.post('/', resourceLimiter, antiSpam, (req, res) => {
+  const { name, email, company, resource_id } = req.body
+  const errors = {}
+  if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
+  if (name && name.length > 100) errors.name = 'Max. 100 Zeichen.'
+  if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gültige E-Mail erforderlich.'
+  if (!company || company.trim().length === 0) errors.company = 'Unternehmen ist erforderlich.'
+  if (company && company.length > 150) errors.company = 'Max. 150 Zeichen.'
+  if (!resource_id || !RESOURCE_ID_PATTERN.test(resource_id)) errors.resource_id = 'Ungültige Resource-ID.'
+
+  if (Object.keys(errors).length > 0) {
+    return res.status(400).json({ errors })
+  }
+
+  const leads = loadLeads()
+  leads.push({
+    name,
+    email,
+    company,
+    resource_id,
+    timestamp: new Date().toISOString(),
+  })
+  saveLeads(leads)
+
+  // Return download URL (resource files are in public/resources/)
+  res.json({ ok: true, download_url: `/resources/${resource_id}.pdf` })
+})
+
+export default router

privat/CV/andreknie.de/server/routes/speaker-cv.js

@@ -0,0 +1,48 @@
+import { Router } from 'express'
+import { readFileSync, writeFileSync, existsSync } from 'fs'
+import { join, dirname } from 'path'
+import { fileURLToPath } from 'url'
+import { resourceLimiter } from '../middleware/rateLimiter.js'
+import { antiSpam } from '../middleware/antiSpam.js'
+import { sendSpeakerCv } from '../services/mailer.js'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const LEADS_FILE = join(__dirname, '..', 'data', 'speaker-cv-leads.json')
+const PDF_PATH = join(__dirname, '..', '..', 'public', 'resources', 'speaker-cv-andre-knie.pdf')
+
+function loadLeads() {
+  if (!existsSync(LEADS_FILE)) return []
+  try { return JSON.parse(readFileSync(LEADS_FILE, 'utf-8')) }
+  catch { return [] }
+}
+
+function saveLeads(leads) {
+  writeFileSync(LEADS_FILE, JSON.stringify(leads, null, 2), 'utf-8')
+}
+
+const router = Router()
+
+router.post('/', resourceLimiter, antiSpam, async (req, res) => {
+  const { name, email, message } = req.body
+  const errors = {}
+  if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
+  if (name && name.length > 100) errors.name = 'Max. 100 Zeichen.'
+  if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gültige E-Mail erforderlich.'
+  if (!message || message.trim().length === 0) errors.message = 'Bitte sag kurz, wer du bist.'
+  if (message && message.length > 2000) errors.message = 'Max. 2000 Zeichen.'
+
+  if (Object.keys(errors).length > 0) {
+    return res.status(400).json({ errors })
+  }
+
+  const lead = { name, email, message, timestamp: new Date().toISOString() }
+  const leads = loadLeads()
+  leads.push(lead)
+  saveLeads(leads)
+
+  await sendSpeakerCv(email, lead, PDF_PATH)
+
+  res.status(201).json({ ok: true, message: 'Danke! Der Speaker CV ist auf dem Weg in dein Postfach.' })
+})
+
+export default router

privat/CV/andreknie.de/server/routes/talk-request.js

@@ -0,0 +1,37 @@
+import { Router } from 'express'
+import { talkRequestLimiter } from '../middleware/rateLimiter.js'
+import { antiSpam } from '../middleware/antiSpam.js'
+import { createToken, verifyToken } from '../services/confirmationToken.js'
+import { sendConfirmationEmail, sendStakeholderNotification } from '../services/mailer.js'
+
+const router = Router()
+
+router.post('/', talkRequestLimiter, antiSpam, async (req, res) => {
+  const { name, email, event_name, topic, message } = req.body
+  const errors = {}
+  if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
+  if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gültige E-Mail erforderlich.'
+  if (!event_name || event_name.trim().length === 0) errors.event_name = 'Eventname ist erforderlich.'
+  if (!topic || topic.trim().length === 0) errors.topic = 'Thema ist erforderlich.'
+  if (!message || message.trim().length === 0) errors.message = 'Nachricht ist erforderlich.'
+  if (message && message.length > 2000) errors.message = 'Max. 2000 Zeichen.'
+
+  if (Object.keys(errors).length > 0) {
+    return res.status(400).json({ errors })
+  }
+
+  const token = createToken('talk-request', { name, email, event_name, topic, message }, 48)
+  await sendConfirmationEmail(email, 'talk-request', token)
+  res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
+})
+
+router.post('/confirm/:token', async (req, res) => {
+  const entry = verifyToken(req.params.token)
+  if (!entry) {
+    return res.status(410).json({ error: 'Link abgelaufen oder ungültig.' })
+  }
+  await sendStakeholderNotification('talk-request', entry.data)
+  res.json({ ok: true, message: 'Vortragsanfrage wurde weitergeleitet.' })
+})
+
+export default router

privat/CV/andreknie.de/server/services/confirmationToken.js

@@ -0,0 +1,81 @@
+import crypto from 'crypto'
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs'
+import { join, dirname } from 'path'
+import { fileURLToPath } from 'url'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const DATA_DIR = join(__dirname, '..', 'data')
+const TOKENS_FILE = join(DATA_DIR, 'pending-tokens.json')
+
+// Ensure data directory exists
+mkdirSync(DATA_DIR, { recursive: true })
+
+function loadTokens() {
+  if (!existsSync(TOKENS_FILE)) return []
+  try { return JSON.parse(readFileSync(TOKENS_FILE, 'utf-8')) }
+  catch { return [] }
+}
+
+function saveTokens(tokens) {
+  writeFileSync(TOKENS_FILE, JSON.stringify(tokens, null, 2), 'utf-8')
+}
+
+/**
+ * Create a confirmation token.
+ * @param {string} type - 'contact' | 'talk-request' | 'newsletter'
+ * @param {object} data - The form data to store
+ * @param {number} expiresInHours - Token expiration (default: 48h)
+ * @returns {string} The generated token
+ */
+export function createToken(type, data, expiresInHours = 48) {
+  const token = crypto.randomUUID()
+  const tokens = loadTokens()
+  tokens.push({
+    token,
+    type,
+    data,
+    createdAt: new Date().toISOString(),
+    expiresAt: new Date(Date.now() + expiresInHours * 60 * 60 * 1000).toISOString(),
+    confirmed: false,
+  })
+  saveTokens(tokens)
+  return token
+}
+
+/**
+ * Verify and consume a token.
+ * @returns {object|null} The stored data if valid, null if expired/invalid
+ */
+export function verifyToken(token) {
+  const tokens = loadTokens()
+  const idx = tokens.findIndex(t => t.token === token && !t.confirmed)
+  if (idx === -1) return null
+
+  const entry = tokens[idx]
+  if (new Date(entry.expiresAt) < new Date()) {
+    // Expired — remove it
+    tokens.splice(idx, 1)
+    saveTokens(tokens)
+    return null
+  }
+
+  // Mark as confirmed
+  tokens[idx].confirmed = true
+  saveTokens(tokens)
+  return entry
+}
+
+/**
+ * Clean up expired tokens (run periodically).
+ */
+export function cleanupExpiredTokens() {
+  const tokens = loadTokens()
+  const now = new Date()
+  const valid = tokens.filter(t => new Date(t.expiresAt) > now || t.confirmed)
+  if (valid.length !== tokens.length) {
+    saveTokens(valid)
+  }
+}
+
+// Run cleanup every hour
+setInterval(cleanupExpiredTokens, 60 * 60 * 1000)

privat/CV/andreknie.de/server/services/mailer.js

@@ -0,0 +1,126 @@
+import nodemailer from 'nodemailer'
+
+const SMTP_HOST = process.env.SMTP_HOST
+const SMTP_PORT = parseInt(process.env.SMTP_PORT || '587', 10)
+const SMTP_USER = process.env.SMTP_USER
+const SMTP_PASS = process.env.SMTP_PASS
+const STAKEHOLDER_EMAIL = process.env.STAKEHOLDER_EMAIL || 'knie@d-hive.de'
+const BASE_URL = process.env.BASE_URL || 'https://andreknie.de'
+
+let transporter = null
+
+function getTransporter() {
+  if (!transporter && SMTP_HOST && SMTP_USER && SMTP_PASS) {
+    transporter = nodemailer.createTransport({
+      host: SMTP_HOST,
+      port: SMTP_PORT,
+      secure: SMTP_PORT === 465,
+      auth: { user: SMTP_USER, pass: SMTP_PASS },
+    })
+  }
+  return transporter
+}
+
+export async function sendConfirmationEmail(to, type, token) {
+  const t = getTransporter()
+  if (!t) {
+    console.log(`[Mailer] SMTP not configured. Would send ${type} confirmation to ${to}`)
+    return
+  }
+
+  const confirmUrl = `${BASE_URL}/api/${type}/confirm/${token}`
+  const subjects = {
+    contact: 'Bitte bestätige deine Kontaktanfrage',
+    'talk-request': 'Bitte bestätige deine Vortragsanfrage',
+    newsletter: 'Bitte bestätige dein Newsletter-Abo',
+  }
+
+  await t.sendMail({
+    from: SMTP_USER,
+    to,
+    subject: subjects[type] || 'Bestätigung erforderlich',
+    text: `Bitte bestätige deine Anfrage:\n\n${confirmUrl}\n\nDieser Link ist 48 Stunden gültig.`,
+  })
+}
+
+export async function sendStakeholderNotification(type, data) {
+  const t = getTransporter()
+  if (!t) {
+    console.log(`[Mailer] SMTP not configured. Would notify stakeholder about ${type}`)
+    return
+  }
+
+  const subjects = {
+    contact: `Neue Kontaktanfrage von ${data.name}`,
+    'talk-request': `Neue Vortragsanfrage von ${data.name}`,
+  }
+
+  const body = Object.entries(data)
+    .map(([key, val]) => `${key}: ${val}`)
+    .join('\n')
+
+  await t.sendMail({
+    from: SMTP_USER,
+    to: STAKEHOLDER_EMAIL,
+    subject: subjects[type] || `Neue Anfrage (${type})`,
+    text: body,
+  })
+}
+
+export { STAKEHOLDER_EMAIL, BASE_URL }
+
+/**
+ * Send the speaker CV PDF as an attachment to the requester, and notify the
+ * stakeholder about the lead. If the PDF is missing, the stakeholder is still
+ * notified so the CV can be sent manually.
+ * @returns {{ sent: boolean, pdfMissing: boolean }}
+ */
+export async function sendSpeakerCv(to, lead, pdfPath) {
+  const { existsSync } = await import('fs')
+  const t = getTransporter()
+  const pdfMissing = !pdfPath || !existsSync(pdfPath)
+
+  if (!t) {
+    console.log(`[Mailer] SMTP not configured. Would send speaker CV to ${to} (pdfMissing=${pdfMissing})`)
+    await notifyStakeholderSpeakerCv(lead, pdfMissing)
+    return { sent: false, pdfMissing }
+  }
+
+  if (!pdfMissing) {
+    await t.sendMail({
+      from: SMTP_USER,
+      to,
+      subject: 'Dein Speaker CV von Dr. Andre Knie',
+      text: `Hallo ${lead.name},\n\nvielen Dank für dein Interesse. Im Anhang findest du meinen Speaker CV.\n\nBeste Grüße\nAndre Knie`,
+      attachments: [{ filename: 'Speaker-CV-Andre-Knie.pdf', path: pdfPath }],
+    })
+  }
+
+  await notifyStakeholderSpeakerCv(lead, pdfMissing)
+  return { sent: !pdfMissing, pdfMissing }
+}
+
+async function notifyStakeholderSpeakerCv(lead, pdfMissing) {
+  const t = getTransporter()
+  const body = [
+    `Name: ${lead.name}`,
+    `E-Mail: ${lead.email}`,
+    `Nachricht: ${lead.message}`,
+    `Zeitpunkt: ${lead.timestamp}`,
+    pdfMissing
+      ? 'ACHTUNG: PDF fehlte — CV wurde NICHT automatisch versandt, bitte manuell senden.'
+      : 'CV wurde automatisch an den Anfragenden gesendet.',
+  ].join('\n')
+
+  if (!t) {
+    console.log(`[Mailer] SMTP not configured. Would notify stakeholder about speaker-cv lead:\n${body}`)
+    return
+  }
+
+  await t.sendMail({
+    from: SMTP_USER,
+    to: STAKEHOLDER_EMAIL,
+    subject: `Speaker-CV-Anfrage von ${lead.name}`,
+    text: body,
+  })
+}