Merge pull request #379 from fccview/develop

fccview · web-flow · commit 0c234dd17d1e · 2026-01-26T21:28:56.000Z
Stable 1.19.1 - SECURITY UPDATE
diff --git a/app/_components/FeatureComponents/Profile/Parts/LinksTab.tsx b/app/_components/FeatureComponents/Profile/Parts/LinksTab.tsx
@@ -319,7 +319,7 @@ export const LinksTab = ({ linkIndex }: LinksTabProps) => {
 
         <div className="bg-card border border-border rounded-md p-8">
           <div className="text-center space-y-4">
-            <div className="text-6xl">🔗</div>
+            <div className="text-6xl"><Link04Icon className="h-12 w-12" /></div>
             <div className="space-y-2">
               <h3 className="text-lg font-semibold">{t('profile.noLinksFound')}</h3>
               <p className="text-muted-foreground max-w-md mx-auto">
diff --git a/app/_server/actions/export/index.ts b/app/_server/actions/export/index.ts
@@ -9,6 +9,7 @@ import { DATA_DIR, USERS_FILE, EXPORT_TEMP_DIR } from "@/app/_consts/files";
 import { getAllLists } from "@/app/_server/actions/checklist";
 import { getAllNotes } from "@/app/_server/actions/note";
 import { readJsonFile, ensureDir } from "@/app/_server/actions/file";
+import { getCurrentUser, canAccessAllContent } from "@/app/_server/actions/users";
 import { User } from "@/app/_types";
 import { Modes } from "@/app/_types/enums";
 
@@ -73,6 +74,14 @@ const zipDirectory = async (
 };
 
 export const exportAllChecklistsNotes = async (): Promise<ExportResult> => {
+  const hasAccess = await canAccessAllContent();
+  if (!hasAccess) {
+    return {
+      success: false,
+      error: "Forbidden: Admin access with content permissions required",
+    };
+  }
+
   updateProgress(0, "Preparing all checklists and notes for export...");
   try {
     const tempExportPath = path.join(
@@ -146,6 +155,18 @@ export const exportAllChecklistsNotes = async (): Promise<ExportResult> => {
 export const exportUserChecklistsNotes = async (
   username: string
 ): Promise<ExportResult> => {
+  const currentUser = await getCurrentUser();
+  if (!currentUser) {
+    return { success: false, error: "Not authenticated" };
+  }
+
+  if (username !== currentUser.username) {
+    const hasAccess = await canAccessAllContent();
+    if (!hasAccess) {
+      return { success: false, error: "Forbidden: You can only export your own data" };
+    }
+  }
+
   updateProgress(
     0,
     `Preparing ${username}'s checklists and notes for export...`
@@ -226,6 +247,14 @@ export const exportUserChecklistsNotes = async (
 };
 
 export const exportAllUsersData = async (): Promise<ExportResult> => {
+  const hasAccess = await canAccessAllContent();
+  if (!hasAccess) {
+    return {
+      success: false,
+      error: "Forbidden: Admin access with content permissions required",
+    };
+  }
+
   updateProgress(0, "Preparing all user data for export...");
   try {
     const tempExportPath = path.join(
@@ -267,6 +296,14 @@ export const exportAllUsersData = async (): Promise<ExportResult> => {
 };
 
 export const exportWholeDataFolder = async (): Promise<ExportResult> => {
+  const hasAccess = await canAccessAllContent();
+  if (!hasAccess) {
+    return {
+      success: false,
+      error: "Forbidden: Admin access with content permissions required",
+    };
+  }
+
   updateProgress(0, "Preparing the whole data folder for export...");
   try {
     const dataFolderPath = path.join(process.cwd(), DATA_DIR);
diff --git a/app/_translations/de.json b/app/_translations/de.json
@@ -578,7 +578,7 @@
     "visualizeRelationships": "Beziehungen zwischen deinen Notizen und Aufgabenlisten visualisieren",
     "connectedItems": "Verbundene Inhalte",
     "noLinksFound": "Keine Verbindungen gefunden",
-    "startCreatingInternalLinks": "Benutze interne Verknüfungen in deinen Notizen und Aufgabenlisten, um das Netzwerk der Verknüpfungen hier zu sehen. Benutzer das Format",
+    "startCreatingInternalLinks": "Beginnen Sie mit der Erstellung interner Links, indem Sie „@“ in Ihre Notizen eingeben, um das Beziehungsnetzwerk hier anzuzeigen.",
     "orFormat": "oder",
     "inYourContent": "in deinen Inhalten.",
     "highlyConnected": "stark verknüpft",
@@ -1471,4 +1471,4 @@
     "actionInit": "Initialisiert",
     "actionUnknown": "Geändert"
   }
-}
+}
diff --git a/app/_translations/en.json b/app/_translations/en.json
@@ -620,7 +620,7 @@
     "visualizeRelationships": "Visualize relationships between your notes and checklists",
     "connectedItems": "Connected Items",
     "noLinksFound": "No Links Found",
-    "startCreatingInternalLinks": "Start creating internal links in your notes and checklists to see the relationship network here. Use the format",
+    "startCreatingInternalLinks": "Start creating internal links by typing `@` in your notes to see the relationship network here.",
     "orFormat": "or",
     "inYourContent": "in your content.",
     "highlyConnected": "highly connected",
@@ -1511,4 +1511,4 @@
     "seenCount": "You've seen {count} {count, plural, one {haiku} other {haikus}}",
     "imNoPoet": "I am no poet, and nor is Jotty. These are random words in sequence."
   }
-}
+}
diff --git a/app/_translations/es.json b/app/_translations/es.json
@@ -591,7 +591,7 @@
     "visualizeRelationships": "Visualiza las relaciones entre sus notas y listas de verificación",
     "connectedItems": "Elementos conectados",
     "noLinksFound": "No se encontraron enlaces",
-    "startCreatingInternalLinks": "Comience a crear enlaces internos en sus notas y listas de verificación para ver la red de relaciones aquí. Use el formato",
+    "startCreatingInternalLinks": "Comience a crear enlaces internos escribiendo `@` en sus notas para ver la red de relaciones aquí.",
     "orFormat": "o",
     "inYourContent": "en su contenido.",
     "highlyConnected": "altamente conectado",
@@ -1494,4 +1494,4 @@
     "actionInit": "Inicializado",
     "actionUnknown": "Cambiado"
   }
-}
+}
diff --git a/app/_translations/fr.json b/app/_translations/fr.json
@@ -591,7 +591,7 @@
     "visualizeRelationships": "Visualisez les relations entre vos notes et listes",
     "connectedItems": "Éléments connectés",
     "noLinksFound": "Aucun lien trouvé",
-    "startCreatingInternalLinks": "Commencez à créer des liens internes dans vos notes et listes pour voir le réseau de relations ici. Utilisez le format",
+    "startCreatingInternalLinks": "Commencez à créer des liens internes en tapant « @ » dans vos notes pour voir le réseau relationnel ici.",
     "orFormat": "ou",
     "inYourContent": "dans votre contenu.",
     "highlyConnected": "très connecté",
@@ -1494,4 +1494,4 @@
     "actionInit": "Initialisé",
     "actionUnknown": "Modifié"
   }
-}
+}
diff --git a/app/_translations/it.json b/app/_translations/it.json
@@ -591,7 +591,7 @@
     "visualizeRelationships": "Visualizza le relazioni tra le tue note e checklist",
     "connectedItems": "Elementi Connessi",
     "noLinksFound": "Nessun Link Trovato",
-    "startCreatingInternalLinks": "Inizia a creare link interni nelle tue note e checklist per vedere la rete di relazioni qui. Usa il formato",
+    "startCreatingInternalLinks": "Inizia a creare collegamenti interni digitando \"@\" nelle tue note per vedere la rete di relazioni qui.",
     "orFormat": "o",
     "inYourContent": "nel tuo contenuto.",
     "highlyConnected": "altamente connesso",
@@ -1495,4 +1495,4 @@
     "actionInit": "Inizializzato",
     "actionUnknown": "Modificato"
   }
-}
+}
diff --git a/app/_translations/klingon.json b/app/_translations/klingon.json
@@ -620,7 +620,7 @@
     "visualizeRelationships": "ghItlhmey 'ej tetlhmey rar yIlegh",
     "connectedItems": "Dochmey rar",
     "noLinksFound": "lI'mey tu'be'lu'",
-    "startCreatingInternalLinks": "ghItlhDaq 'ej tetlhDaq lI'mey yIchenmoH. mIwvam yIlo':",
+    "startCreatingInternalLinks": "Start creating internal links by typing `@` in your notes to see the relationship network here.",
     "orFormat": "pagh",
     "inYourContent": "De'lIjDaq.",
     "highlyConnected": "rarqu'",
@@ -1515,4 +1515,4 @@
     "seenCount": "{count} haiku Dalegh",
     "imNoPoet": "bomwI' jIHbe'. mu'mey neH."
   }
-}
+}
diff --git a/app/_translations/ko.json b/app/_translations/ko.json
@@ -612,7 +612,7 @@
     "visualizeRelationships": "노트와 체크리스트 간의 관계를 시각화합니다",
     "connectedItems": "연결된 항목",
     "noLinksFound": "링크를 찾을 수 없습니다",
-    "startCreatingInternalLinks": "이곳에서 관계 네트워크를 확인하려면 노트와 체크리스트에 내부 링크를 추가하세요. 다음 형식을 사용하세요",
+    "startCreatingInternalLinks": "여기에서 관계 네트워크를 보려면 노트에 `@`를 입력하여 내부 링크 만들기를 시작하세요.",
     "orFormat": "또는",
     "inYourContent": "콘텐츠에서.",
     "highlyConnected": "연결 많음",
@@ -1500,4 +1500,4 @@
     "seenCount": "{count} {count, plural, one {하이쿠} other {하이쿠}} 를 보았습니다",
     "imNoPoet": "저는 시인이 아니며 Jotty도 마찬가지입니다. 이는 무작위로 나열된 단어들입니다."
   }
-}
+}
diff --git a/app/_translations/nl.json b/app/_translations/nl.json
@@ -591,7 +591,7 @@
     "visualizeRelationships": "Visualiseer relaties tussen uw notities en checklists",
     "connectedItems": "Verbonden items",
     "noLinksFound": "Geen links gevonden",
-    "startCreatingInternalLinks": "Begin met het maken van interne links in uw notities en checklists om het relatienetwerk hier te zien. Gebruik het formaat",
+    "startCreatingInternalLinks": "Begin met het maken van interne links door `@` in uw notities te typen om het relatienetwerk hier te zien.",
     "orFormat": "of",
     "inYourContent": "in uw inhoud.",
     "highlyConnected": "sterk verbonden",
@@ -1470,4 +1470,4 @@
     "seenCount": "U heeft {count} {count, plural, one {haiku} other {haiku's}} gezien",
     "imNoPoet": "Ik ben geen dichter, en Jotty ook niet. Dit zijn willekeurige woorden op een rij."
   }
-}
+}
diff --git a/app/_translations/pirate.json b/app/_translations/pirate.json
@@ -620,7 +620,7 @@
     "visualizeRelationships": "Spy the web",
     "connectedItems": "Tied Items",
     "noLinksFound": "No lines found",
-    "startCreatingInternalLinks": "Start throwing lines to connect yer logs.",
+    "startCreatingInternalLinks": "Start creating internal links by typing `@` in your notes to see the relationship network here.",
     "orFormat": "or",
     "inYourContent": "in yer yarn.",
     "highlyConnected": "tightly bound",
@@ -1512,4 +1512,4 @@
     "seenCount": "Ye've heard {count} shanties",
     "imNoPoet": "I ain't no bard, just a pirate."
   }
-}
+}
diff --git a/app/_translations/pl.json b/app/_translations/pl.json
@@ -592,7 +592,7 @@
     "visualizeRelationships": "Wizualizuj relacje między notatkami i listami kontrolnymi",
     "connectedItems": "Połączone elementy",
     "noLinksFound": "Nie znaleziono linków",
-    "startCreatingInternalLinks": "Rozpocznij tworzenie wewnętrznych linków w swoich notatkach i listach kontrolnych, aby zobaczyć sieć relacji tutaj. Użyj formatu",
+    "startCreatingInternalLinks": "Zacznij tworzyć linki wewnętrzne, wpisując `@` w swoich notatkach, aby zobaczyć tutaj sieć relacji.",
     "orFormat": "lub",
     "inYourContent": "w Twojej zawartości.",
     "highlyConnected": "wysoko połączone",
@@ -1498,4 +1498,4 @@
     "actionInit": "Zainicjowano",
     "actionUnknown": "Zmieniono"
   }
-}
+}
diff --git a/app/_translations/zh.json b/app/_translations/zh.json
@@ -620,7 +620,7 @@
     "visualizeRelationships": "可视化笔记和清单之间的关系",
     "connectedItems": "关联项目",
     "noLinksFound": "未找到链接",
-    "startCreatingInternalLinks": "在笔记和清单中创建内部链接，即可在此处查看关系网络。使用格式",
+    "startCreatingInternalLinks": "通过在笔记中输入“@”开始创建内部链接，以在此处查看关系网络。",
     "orFormat": "或",
     "inYourContent": "在您的内容中。",
     "highlyConnected": "高度关联",
@@ -1515,4 +1515,4 @@
     "seenCount": "您已看过 {count} {count, plural, one {首俳句} other {首俳句}}",
     "imNoPoet": "我非诗人，Jotty 亦非。此乃随机词序。"
   }
-}
+}
diff --git a/app/api/exports/route.ts b/app/api/exports/route.ts
@@ -7,10 +7,23 @@ import {
   exportWholeDataFolder,
   getExportProgress,
 } from "@/app/_server/actions/export";
-import { ExportType } from "@/app/_types";
+import { getAppSettings } from "@/app/_server/actions/config";
+import { ExportType, User } from "@/app/_types";
 
 export const dynamic = "force-dynamic";
 
+const canAccessOtherUsersContent = async (user: User): Promise<boolean> => {
+  if (user.isSuperAdmin) return true;
+  if (!user.isAdmin) return false;
+
+  const settingsResult = await getAppSettings();
+  if (!settingsResult.success || !settingsResult.data) {
+    return true;
+  }
+
+  return settingsResult.data.adminContentAccess !== "no";
+};
+
 export async function POST(
   request: NextRequest,
   { params }: { params: { filename: string } }
@@ -27,9 +40,17 @@ export async function POST(
         );
       }
 
+      const hasContentAccess = await canAccessOtherUsersContent(user);
+
       let result;
       switch (type as ExportType) {
         case "all_checklists_notes":
+          if (!hasContentAccess) {
+            return NextResponse.json(
+              { error: "Forbidden: Admin access with content permissions required" },
+              { status: 403 }
+            );
+          }
           result = await exportAllChecklistsNotes();
           break;
         case "user_checklists_notes":
@@ -39,12 +60,30 @@ export async function POST(
               { status: 400 }
             );
           }
+          if (username !== user.username && !hasContentAccess) {
+            return NextResponse.json(
+              { error: "Forbidden: You can only export your own data" },
+              { status: 403 }
+            );
+          }
           result = await exportUserChecklistsNotes(username);
           break;
         case "all_users_data":
+          if (!hasContentAccess) {
+            return NextResponse.json(
+              { error: "Forbidden: Admin access with content permissions required" },
+              { status: 403 }
+            );
+          }
           result = await exportAllUsersData();
           break;
         case "whole_data_folder":
+          if (!hasContentAccess) {
+            return NextResponse.json(
+              { error: "Forbidden: Admin access with content permissions required" },
+              { status: 403 }
+            );
+          }
           result = await exportWholeDataFolder();
           break;
         default:
diff --git a/app/api/summary/route.ts b/app/api/summary/route.ts
@@ -3,7 +3,6 @@ import { withApiAuth } from "@/app/_utils/api-utils";
 import { getUserNotes } from "@/app/_server/actions/note";
 import { getUserChecklists } from "@/app/_server/actions/checklist";
 import { Checklist, Result } from "@/app/_types";
-import { isAdmin } from "@/app/_server/actions/users";
 import { TaskStatus } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
@@ -15,8 +14,7 @@ export async function GET(request: NextRequest) {
       const requestedUsername = searchParams.get("username");
 
       if (requestedUsername && requestedUsername !== user.username) {
-        const isAdminUser = await isAdmin();
-        if (!isAdminUser) {
+        if (!user.isAdmin) {
           return NextResponse.json(
             {
               error: "Only administrators can query other users' summary data",
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "jotty.page",
-    "version": "1.19.0",
+    "version": "1.19.1",
     "private": true,
     "scripts": {
         "dev": "next dev",
diff --git a/tests/api/exports.test.ts b/tests/api/exports.test.ts
diff --git a/tests/api/setup.ts b/tests/api/setup.ts
diff --git a/tests/api/user-summary.test.ts b/tests/api/user-summary.test.ts
