Commit Graph

382 Commits

Author SHA1 Message Date
ekzyis fd8510d59f Use payment hash instead of invoice id as proof of payment
Our invoice IDs can be enumerated.
So there is a - even though very rare - chance that an attacker could find a paid invoice which is not used yet and use it for himself.
Random payment hashes prevent this.

Also, since we delete invoices after use, using database IDs as proof of payments are not suitable.
If a user tells us an invoice ID after we deleted it, we can no longer tell if the invoice was paid or not since the LN node only knows about payment hashes but nothing about the database IDs.
2023-07-30 23:45:07 +02:00
ekzyis 74893b09dd Add anon comments and posts (link, discussion, poll) 2023-07-30 23:45:07 +02:00
ekzyis 5415c6b0f6 Add anon zaps 2023-07-30 23:45:07 +02:00
keyan 9745b82d63 fix viewing stacker's bookmarks 2023-07-29 18:27:32 -05:00
keyan 5232b59625 upgrade to next-auth 4 (bonus: improve error pages) 2023-07-29 14:38:20 -05:00
keyan 7542dd6cc4 upgrade to prisma 4 2023-07-26 19:18:42 -05:00
keyan 672853a7ea upgrade to prisma 3 2023-07-26 11:01:31 -05:00
keyan 8ab018af88 fix nested comment sorting 2023-07-25 19:45:35 -05:00
keyan ab2046ab0b fix issues with new linting 2023-07-25 09:14:45 -05:00
keyan e87610c45b update packages and reduce bundle size 2023-07-24 17:50:12 -05:00
keyan 54d69489b9 Revert "Revert "try to store slashtags in cwd""
This reverts commit bbedec853f.
2023-07-23 10:09:00 -05:00
keyan 437faca197 Revert "Revert "prevent slashtags from accessing disk""
This reverts commit 391773be5e.
2023-07-23 10:08:56 -05:00
keyan 59f7b6ff26 Revert "Revert "shield your eyes; massive, squashed refactor; nextjs/react/react-dom/apollo upgrades""
This reverts commit 18910fa2ed.
2023-07-23 10:08:43 -05:00
keyan 18910fa2ed Revert "shield your eyes; massive, squashed refactor; nextjs/react/react-dom/apollo upgrades"
This reverts commit d0314ab73c.
2023-07-23 09:16:12 -05:00
keyan 391773be5e Revert "prevent slashtags from accessing disk"
This reverts commit 3c6c2a72b2.
2023-07-23 09:16:02 -05:00
keyan bbedec853f Revert "try to store slashtags in cwd"
This reverts commit 589d1ec190.
2023-07-23 09:15:40 -05:00
keyan 589d1ec190 try to store slashtags in cwd 2023-07-21 20:14:37 -05:00
keyan 3c6c2a72b2 prevent slashtags from accessing disk 2023-07-21 20:05:04 -05:00
keyan d0314ab73c shield your eyes; massive, squashed refactor; nextjs/react/react-dom/apollo upgrades 2023-07-21 17:33:11 -05:00
ekzyis 8536660580
Fix maxStreak for users with running best streak (#356)
Co-authored-by: ekzyis <ek@stacker.news>
2023-07-14 10:49:16 -05:00
keyan 3c711b6083 enhance image detection and proxy 2023-07-13 15:18:04 -05:00
ekzyis 0d3328e509
Show longest cowboy streak in profile (#353)
* Show longest cowboy streak in profile

* Fix image offset

* Initialize maxStreak for every user

* Use resolver instead of denormalization for maxStreak

---------

Co-authored-by: ekzyis <ek@stacker.news>
2023-07-12 19:10:29 -05:00
Jo Wo bf4b8714fe
Render images without markdown and use image proxy (#245)
* Parse image links during markdown rendering

* Use imgproxy to replace links

* Add healthcheck

See https://docs.imgproxy.net/healthcheck

* Enable WebP and animation support

* Only replace image URLs

* Replace all occurrences

* Fix creating posts with no text

* Embed image on link posts where link is image

---------

Co-authored-by: ekzyis <ek@stacker.news>
2023-07-12 19:10:01 -05:00
keyan 4e9138dfdc show more info on where zap rewards came from 2023-07-09 12:21:11 -05:00
ekzyis 5e4dedad28
Add nym in reply notification (#349)
Co-authored-by: ekzyis <ek@stacker.news>
2023-07-07 08:45:44 -05:00
ekzyis 46014d0de4
Fix query for items with less than 11 parents (#346)
Co-authored-by: ekzyis <ek@stacker.news>
2023-07-06 20:17:12 -05:00
keyan 0c51309520 enhance pwa presentation 2023-07-06 16:53:48 -05:00
ekzyis 37e70f9791
Scroll to items on push notification click (#345)
* Scroll from root item in reach on notification click

Instead of going directly to the item of the notification, we now scroll from the root item which is still in reach to the comment.

This should provide more context to the user in most cases.

* Also scroll from root item in reach in /notifications

---------

Co-authored-by: ekzyis <ek@stacker.news>
2023-07-06 10:00:38 -05:00
keyan a17b4d1f1a refine push notification ui and catch promises 2023-07-04 17:19:59 -05:00
ekzyis 388e00dd04
Service worker rework, Web Target Share API & Web Push API (#324)
* npm uninstall next-pwa

next-pwa was last updated in August 2022.
There is also an issue which mentions that next-pwa is abandoned (?): https://github.com/shadowwalker/next-pwa/issues/482

But the main reason for me uninstalling it is that it adds a lot of preconfigured stuff which is not necessary for us.
It even lead to a bug since pages were cached without our knowledge.

So I will go with a different PWA approach. This different approach should do the following:
- make it more transparent what the service worker is doing
- gives us more control to configure the service worker and thus making it easier

* Use workbox-webpack-plugin

Every other plugin (`next-offline`, `next-workbox-webpack-plugin`, `next-with-workbox`, ...) added unnecessary configuration which felt contrary to how PWAs should be built.
(PWAs should progressivly enhance the website in small steps, see https://web.dev/learn/pwa/getting-started/#focus-on-a-feature)

These default configurations even lead to worse UX since they made invalid assumptions about stacker.news:
We _do not_ want to cache our start url and we _do not_ want to cache anything unless explicitly told to.
Almost every page on SN should be fresh for the best UX.

To achieve this, by default, the service worker falls back to the network (as if the service worker wasn't there).

Therefore, this should be the simplest configuration with a valid precache and cache busting support.

In the future, we can try to use prefetching to improve performance of navigation requests.

* Add support for Web Share Target API

See https://developer.chrome.com/articles/web-share-target/

* Use Web Push API for push notifications

I followed this (very good!) guide: https://web.dev/notifications/

* Refactor code related to Web Push

* Send push notification to users on events

* Merge notifications

* Send notification to author of every parent recursively

* Remove unused userId param in savePushSubscription

As it should be, the user id is retrieved from the authenticated user in the backend.

* Resubscribe user if push subscription changed

* Update old subscription if oldEndpoint was given

* Allow users to unsubscribe

* Use LTREE operator instead of recursive query

* Always show checkbox for push notifications

* Justify checkbox to end

* Update title of first push notification

* Fix warning from uncontrolled to controlled

* Add comment about Notification.requestPermission

* Fix timestamp

* Catch error on push subscription toggle

* Wrap function bodies in try/catch

* Use Promise.allSettled

* Filter subscriptions by user notification settings

* Fix user notification filter

* Use skipWaiting

---------

Co-authored-by: ekzyis <ek@stacker.news>
2023-07-04 14:36:07 -05:00
keyan 747371a4e4 snl live banner 2023-06-20 09:57:06 -05:00
keyan 3e4161ae8c tip -> zap 2023-06-19 13:21:55 -05:00
keyan f0f51438c4 add top posts/comments to subs 2023-06-12 19:40:18 -05:00
keyan 369bd82a84 make freebie comments visible case by case 2023-06-03 20:01:50 -05:00
keyan d815cae715 add 'stacking since' to profile 2023-06-02 19:55:45 -05:00
keyan 8ac570d403 fixing subscribe and child reply duplicates 2023-06-02 16:48:39 -05:00
keyan c93ae90578 remove extra note checking condition 2023-06-01 14:54:44 -05:00
ekzyis ace2a4df3b
Match any port in dupe check (#297)
Co-authored-by: ekzyis <ek@stacker.news>
2023-05-31 19:49:28 -05:00
ekzyis 36d5478e74
Redirect to /login on /settings 401 (#295)
Co-authored-by: ekzyis <ek@stacker.news>
2023-05-31 19:47:03 -05:00
ekzyis 0c251ca376
Add thread subscriptions (#293)
* Add thread subscriptions

* remove dead code: reply only notifications

* break out thread subscription queries to reduce search space

* one db dip for item lists/threads re:meSubscription

---------

Co-authored-by: ekzyis <ek@stacker.news>
Co-authored-by: keyan <keyan.kousha+huumn@gmail.com>
2023-05-31 19:44:06 -05:00
keyan 0de134309c improve perf of rank view perf 2023-05-24 02:35:39 -05:00
keyan 28263bc6c7 rank views 2023-05-23 09:21:04 -05:00
ekzyis a4e6ec0fba Add docs for local LND setup 2023-05-19 18:28:46 -05:00
keyan 31ce8cec93 truncate time to proper interval 2023-05-19 18:22:28 -05:00
keyan 4aee2c745f stats are averages now 2023-05-19 18:12:48 -05:00
keyan f6ab939bcc use mat views (tm) for historicals (tm) 2023-05-19 17:38:39 -05:00
keyan 0a3f5fd201 materialize dashboard in views 2023-05-19 17:38:39 -05:00
keyan 236dcae13b remove user analytics dos vector 2023-05-17 17:56:34 -05:00
keyan df1f1a483a require sub selection, allow editting 2023-05-10 19:30:51 -05:00
keyan 2579a6b51c fix ranking function order operation in wild west mode 2023-05-09 15:07:23 -05:00