OpenVelo Agent
af3c24275d
- Backend: NestJS 10 + TypeORM (better-sqlite3) feature-modular layout.
- Entities: user, setting, category, challenge, challenge_file, solve,
refresh_token, blog_post. Auto-run migrations + idempotent 6-system-
category seed on startup.
- Argon2id password hashing with policy check; JWT access + rotating
refresh tokens (HttpOnly cookie); CSRF middleware (SameSite + custom
X-CSRF-Token header); global JWT auth guard with @Public() opt-out;
per-IP login backoff + per-IP registration rate limit.
- Endpoints: auth (login/refresh/logout/csrf), users (first-admin
registration), system (bootstrap/event status/SSE), admin (guarded
user CRUD with last-admin invariant), frontend module (uploads +
SPA fallback).
- Security: helmet+CSP+HSTS-gated-by-TLS, CORS allowlist, structured
global exception filter, Zod request validation pipes, OpenAPI 3.1
served at /api/docs and /api/docs-json, 10 canonical themes under
backend/themes/.
- Frontend: Angular 17 standalone components, lazy-loaded feature routes,
signals, functional HttpInterceptorFn (csrf + auth), functional
CanActivateFn auth guard, HttpOnly-cookie-based auth service.
- Tests: Jest + supertest, 46 tests across 13 suites covering
migrations, env schema, theme loader, event status, login backoff,
registration rate limit, ApiError shape, bootstrap integration,
auth refresh rotation, admin guard, last-admin invariant, SSE flat
payloads. Single-command runner: `npm test`.
45 lines
1.8 KiB
TypeScript
45 lines
1.8 KiB
TypeScript
import { Injectable } from '@nestjs/common';
|
|
import { InjectRepository } from '@nestjs/typeorm';
|
|
import { Repository } from 'typeorm';
|
|
import { UserEntity } from '../../database/entities/user.entity';
|
|
import { SettingEntity } from '../../database/entities/setting.entity';
|
|
import { ThemeLoaderService } from '../../common/utils/theme-loader.service';
|
|
import { SETTINGS_KEYS } from '../../config/env.schema';
|
|
|
|
export interface BootstrapPayload {
|
|
initialized: boolean;
|
|
pageTitle: string;
|
|
logo: string;
|
|
welcomeMarkdown: string;
|
|
theme: any;
|
|
defaultChallengeIp: string;
|
|
registrationsEnabled: boolean;
|
|
}
|
|
|
|
@Injectable()
|
|
export class SystemService {
|
|
constructor(
|
|
@InjectRepository(UserEntity) private readonly users: Repository<UserEntity>,
|
|
@InjectRepository(SettingEntity) private readonly settings: Repository<SettingEntity>,
|
|
private readonly themes: ThemeLoaderService,
|
|
) {}
|
|
|
|
async bootstrap(): Promise<BootstrapPayload> {
|
|
const adminCount = await this.users.count({ where: { role: 'admin' } });
|
|
const themeKey = await this.getSetting(SETTINGS_KEYS.THEME_KEY, 'classic');
|
|
return {
|
|
initialized: adminCount > 0,
|
|
pageTitle: await this.getSetting(SETTINGS_KEYS.PAGE_TITLE, 'HIPCTF'),
|
|
logo: await this.getSetting(SETTINGS_KEYS.LOGO, ''),
|
|
welcomeMarkdown: await this.getSetting(SETTINGS_KEYS.WELCOME_MARKDOWN, ''),
|
|
theme: this.themes.getTheme(themeKey),
|
|
defaultChallengeIp: await this.getSetting(SETTINGS_KEYS.DEFAULT_CHALLENGE_IP, '127.0.0.1'),
|
|
registrationsEnabled: (await this.getSetting(SETTINGS_KEYS.REGISTRATIONS_ENABLED, 'false')) === 'true',
|
|
};
|
|
}
|
|
|
|
private async getSetting(key: string, fallback: string): Promise<string> {
|
|
const row = await this.settings.findOne({ where: { key } });
|
|
return row?.value ?? fallback;
|
|
}
|
|
} |