feat(privat/CV): sync to latest upstream (cv-upstream/main, 30f9608b)

2026-07-07 15:20:55 +02:00
parent 8ac664d33d
commit a4efabbc60
417 changed files with 48564 additions and 712 deletions
@@ -0,0 +1,36 @@
+import { Router } from 'express'
+import { contactLimiter } from '../middleware/rateLimiter.js'
+import { antiSpam } from '../middleware/antiSpam.js'
+import { createToken, verifyToken } from '../services/confirmationToken.js'
+import { sendConfirmationEmail, sendStakeholderNotification } from '../services/mailer.js'
+
+const router = Router()
+
+router.post('/', contactLimiter, antiSpam, async (req, res) => {
+  const { name, email, message } = req.body
+  const errors = {}
+  if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
+  if (name && name.length > 100) errors.name = 'Max. 100 Zeichen.'
+  if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gültige E-Mail erforderlich.'
+  if (!message || message.trim().length === 0) errors.message = 'Nachricht ist erforderlich.'
+  if (message && message.length > 2000) errors.message = 'Max. 2000 Zeichen.'
+
+  if (Object.keys(errors).length > 0) {
+    return res.status(400).json({ errors })
+  }
+
+  const token = createToken('contact', { name, email, message }, 24)
+  await sendConfirmationEmail(email, 'contact', token)
+  res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
+})
+
+router.post('/confirm/:token', async (req, res) => {
+  const entry = verifyToken(req.params.token)
+  if (!entry) {
+    return res.status(410).json({ error: 'Link abgelaufen oder ungültig.' })
+  }
+  await sendStakeholderNotification('contact', entry.data)
+  res.json({ ok: true, message: 'Nachricht wurde weitergeleitet.' })
+})
+
+export default router
@@ -0,0 +1,59 @@
+import { Router } from 'express'
+import { readFileSync, writeFileSync, existsSync } from 'fs'
+import { join, dirname } from 'path'
+import { fileURLToPath } from 'url'
+import { newsletterLimiter } from '../middleware/rateLimiter.js'
+import { antiSpam } from '../middleware/antiSpam.js'
+import { createToken, verifyToken } from '../services/confirmationToken.js'
+import { sendConfirmationEmail } from '../services/mailer.js'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const SUBS_FILE = join(__dirname, '..', 'data', 'subscribers.json')
+
+function loadSubscribers() {
+  if (!existsSync(SUBS_FILE)) return []
+  try { return JSON.parse(readFileSync(SUBS_FILE, 'utf-8')) }
+  catch { return [] }
+}
+
+function saveSubscribers(subs) {
+  writeFileSync(SUBS_FILE, JSON.stringify(subs, null, 2), 'utf-8')
+}
+
+const router = Router()
+
+router.post('/', newsletterLimiter, antiSpam, async (req, res) => {
+  const { email } = req.body
+  if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+    return res.status(400).json({ errors: { email: 'Gültige E-Mail erforderlich.' } })
+  }
+
+  // Check for existing subscription
+  const subs = loadSubscribers()
+  if (subs.find(s => s.email === email && s.active)) {
+    return res.status(409).json({ error: 'Diese E-Mail ist bereits abonniert.' })
+  }
+
+  const token = createToken('newsletter', { email }, 48)
+  await sendConfirmationEmail(email, 'newsletter', token)
+  res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
+})
+
+router.get('/confirm/:token', async (req, res) => {
+  const entry = verifyToken(req.params.token)
+  if (!entry) {
+    return res.status(410).json({ error: 'Link abgelaufen oder ungültig.' })
+  }
+
+  const subs = loadSubscribers()
+  subs.push({
+    email: entry.data.email,
+    subscribedAt: new Date().toISOString(),
+    active: true,
+  })
+  saveSubscribers(subs)
+
+  res.json({ ok: true, message: 'Newsletter-Abo bestätigt.' })
+})
+
+export default router
@@ -0,0 +1,55 @@
+import { Router } from 'express'
+import { readFileSync, writeFileSync, existsSync } from 'fs'
+import { join, dirname } from 'path'
+import { fileURLToPath } from 'url'
+import { resourceLimiter } from '../middleware/rateLimiter.js'
+import { antiSpam } from '../middleware/antiSpam.js'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const LEADS_FILE = join(__dirname, '..', 'data', 'leads.json')
+
+// Only alphanumeric + hyphen resource IDs are allowed. This prevents path
+// traversal (e.g. "../../etc/passwd") when building the download URL.
+const RESOURCE_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/
+
+function loadLeads() {
+  if (!existsSync(LEADS_FILE)) return []
+  try { return JSON.parse(readFileSync(LEADS_FILE, 'utf-8')) }
+  catch { return [] }
+}
+
+function saveLeads(leads) {
+  writeFileSync(LEADS_FILE, JSON.stringify(leads, null, 2), 'utf-8')
+}
+
+const router = Router()
+
+router.post('/', resourceLimiter, antiSpam, (req, res) => {
+  const { name, email, company, resource_id } = req.body
+  const errors = {}
+  if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
+  if (name && name.length > 100) errors.name = 'Max. 100 Zeichen.'
+  if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gültige E-Mail erforderlich.'
+  if (!company || company.trim().length === 0) errors.company = 'Unternehmen ist erforderlich.'
+  if (company && company.length > 150) errors.company = 'Max. 150 Zeichen.'
+  if (!resource_id || !RESOURCE_ID_PATTERN.test(resource_id)) errors.resource_id = 'Ungültige Resource-ID.'
+
+  if (Object.keys(errors).length > 0) {
+    return res.status(400).json({ errors })
+  }
+
+  const leads = loadLeads()
+  leads.push({
+    name,
+    email,
+    company,
+    resource_id,
+    timestamp: new Date().toISOString(),
+  })
+  saveLeads(leads)
+
+  // Return download URL (resource files are in public/resources/)
+  res.json({ ok: true, download_url: `/resources/${resource_id}.pdf` })
+})
+
+export default router
@@ -0,0 +1,48 @@
+import { Router } from 'express'
+import { readFileSync, writeFileSync, existsSync } from 'fs'
+import { join, dirname } from 'path'
+import { fileURLToPath } from 'url'
+import { resourceLimiter } from '../middleware/rateLimiter.js'
+import { antiSpam } from '../middleware/antiSpam.js'
+import { sendSpeakerCv } from '../services/mailer.js'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const LEADS_FILE = join(__dirname, '..', 'data', 'speaker-cv-leads.json')
+const PDF_PATH = join(__dirname, '..', '..', 'public', 'resources', 'speaker-cv-andre-knie.pdf')
+
+function loadLeads() {
+  if (!existsSync(LEADS_FILE)) return []
+  try { return JSON.parse(readFileSync(LEADS_FILE, 'utf-8')) }
+  catch { return [] }
+}
+
+function saveLeads(leads) {
+  writeFileSync(LEADS_FILE, JSON.stringify(leads, null, 2), 'utf-8')
+}
+
+const router = Router()
+
+router.post('/', resourceLimiter, antiSpam, async (req, res) => {
+  const { name, email, message } = req.body
+  const errors = {}
+  if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
+  if (name && name.length > 100) errors.name = 'Max. 100 Zeichen.'
+  if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gültige E-Mail erforderlich.'
+  if (!message || message.trim().length === 0) errors.message = 'Bitte sag kurz, wer du bist.'
+  if (message && message.length > 2000) errors.message = 'Max. 2000 Zeichen.'
+
+  if (Object.keys(errors).length > 0) {
+    return res.status(400).json({ errors })
+  }
+
+  const lead = { name, email, message, timestamp: new Date().toISOString() }
+  const leads = loadLeads()
+  leads.push(lead)
+  saveLeads(leads)
+
+  await sendSpeakerCv(email, lead, PDF_PATH)
+
+  res.status(201).json({ ok: true, message: 'Danke! Der Speaker CV ist auf dem Weg in dein Postfach.' })
+})
+
+export default router
@@ -0,0 +1,37 @@
+import { Router } from 'express'
+import { talkRequestLimiter } from '../middleware/rateLimiter.js'
+import { antiSpam } from '../middleware/antiSpam.js'
+import { createToken, verifyToken } from '../services/confirmationToken.js'
+import { sendConfirmationEmail, sendStakeholderNotification } from '../services/mailer.js'
+
+const router = Router()
+
+router.post('/', talkRequestLimiter, antiSpam, async (req, res) => {
+  const { name, email, event_name, topic, message } = req.body
+  const errors = {}
+  if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
+  if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gültige E-Mail erforderlich.'
+  if (!event_name || event_name.trim().length === 0) errors.event_name = 'Eventname ist erforderlich.'
+  if (!topic || topic.trim().length === 0) errors.topic = 'Thema ist erforderlich.'
+  if (!message || message.trim().length === 0) errors.message = 'Nachricht ist erforderlich.'
+  if (message && message.length > 2000) errors.message = 'Max. 2000 Zeichen.'
+
+  if (Object.keys(errors).length > 0) {
+    return res.status(400).json({ errors })
+  }
+
+  const token = createToken('talk-request', { name, email, event_name, topic, message }, 48)
+  await sendConfirmationEmail(email, 'talk-request', token)
+  res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
+})
+
+router.post('/confirm/:token', async (req, res) => {
+  const entry = verifyToken(req.params.token)
+  if (!entry) {
+    return res.status(410).json({ error: 'Link abgelaufen oder ungültig.' })
+  }
+  await sendStakeholderNotification('talk-request', entry.data)
+  res.json({ ok: true, message: 'Vortragsanfrage wurde weitergeleitet.' })
+})
+
+export default router