···
// Skip Polar sync in test mode
178
-
if (process.env.NODE_ENV === "test" || process.env.SKIP_POLAR_SYNC === "true") {
179
+
process.env.NODE_ENV === "test" ||
180
+
process.env.SKIP_POLAR_SYNC === "true"
···
const server = Bun.serve({
308
-
port: process.env.NODE_ENV === "test"
310
-
: (process.env.PORT ? Number.parseInt(process.env.PORT, 10) : 3000),
312
+
process.env.NODE_ENV === "test"
315
+
? Number.parseInt(process.env.PORT, 10)
idleTimeout: 120, // 120 seconds for SSE connections
···
has_subscription: !!subscription,
email_verified: isEmailVerified(user.id),
898
-
email_notifications_enabled: prefs?.email_notifications_enabled === 1,
904
+
email_notifications_enabled:
905
+
prefs?.email_notifications_enabled === 1,
···
const sessionId = getSessionFromRequest(req);
1095
-
return Response.json({ error: "Not authenticated" }, { status: 401 });
1102
+
return Response.json(
1103
+
{ error: "Not authenticated" },
const user = getUserBySession(sessionId);
···
const currentSessionId = getSessionFromRequest(req);
1120
-
return Response.json({ error: "Not authenticated" }, { status: 401 });
1130
+
return Response.json(
1131
+
{ error: "Not authenticated" },
const user = getUserBySession(currentSessionId);
···
const body = await req.json();
const { password } = body;
1304
-
return Response.json({ error: "Password required" }, { status: 400 });
1317
+
return Response.json(
1318
+
{ error: "Password required" },
// Validate password format (client-side hashed PBKDF2)
const passwordValidation = validatePasswordHash(password);
···
// Allow access if: owner, admin, or enrolled in the class
if (!isOwner && !isAdmin && !isClassMember) {
1649
-
return Response.json(
1650
-
{ error: "Forbidden" },
1665
+
return Response.json({ error: "Forbidden" }, { status: 403 });
// Require subscription only if accessing own transcription (not class)
···
// Allow access if: owner, admin, or enrolled in the class
if (!isOwner && !isAdmin && !isClassMember) {
1892
-
return Response.json(
1893
-
{ error: "Forbidden" },
1905
+
return Response.json({ error: "Forbidden" }, { status: 403 });
// Require subscription only if accessing own transcription (not class)
···
// Allow access if: owner, admin, or enrolled in the class
if (!isOwner && !isAdmin && !isClassMember) {
2000
-
return Response.json(
2001
-
{ error: "Forbidden" },
2010
+
return Response.json({ error: "Forbidden" }, { status: 403 });
// Require subscription only if accessing own transcription (not class)
···
const existingMeeting = getMeetingById(meetingId);
3362
-
return Response.json({ error: "Meeting not found" }, { status: 404 });
3369
+
return Response.json(
3370
+
{ error: "Meeting not found" },
updateMeetingTime(meetingId, label);
···
const existingMeeting = getMeetingById(meetingId);
3379
-
return Response.json({ error: "Meeting not found" }, { status: 404 });
3389
+
return Response.json(
3390
+
{ error: "Meeting not found" },
deleteMeetingTime(meetingId);
···
3451
+
development: process.env.NODE_ENV === "dev",
const response = server.fetch(req);
// Add security headers to all responses
if (response instanceof Response) {
const headers = new Headers(response.headers);
···
headers.set("X-Content-Type-Options", "nosniff");
headers.set("X-Frame-Options", "DENY");
headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
// Set CSP that allows inline styles with unsafe-inline (needed for Lit components)
// and script-src 'self' for bundled scripts
"Content-Security-Policy",
3457
-
"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://hostedboringavatars.vercel.app; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none';"
3467
+
"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://hostedboringavatars.vercel.app; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none';",
return new Response(response.body, {
statusText: response.statusText,
dunkirk.sh