From 525bc4ee3ebcef26e7e34569d3adb40373a8249d Mon Sep 17 00:00:00 2001 From: "nekomimi.pet" Date: Fri, 6 Mar 2026 07:30:55 -0500 Subject: [PATCH] fix directory hits having / removed --- apps/hosting-service/src/server.ts | 3 ++- apps/main-app/src/routes/domain.ts | 16 +++++++++++++++- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/apps/hosting-service/src/server.ts b/apps/hosting-service/src/server.ts index db799d1..14d0f56 100644 --- a/apps/hosting-service/src/server.ts +++ b/apps/hosting-service/src/server.ts @@ -51,7 +51,8 @@ app.get('/*', async (c) => { const hostname = c.req.header('host') || ''; const hostnameWithoutPort = hostname.split(':')[0] || ''; const rawPath = url.pathname.replace(/^\//, ''); - const path = sanitizePath(rawPath); + const hasTrailingSlash = rawPath.endsWith('/'); + const path = hasTrailingSlash ? sanitizePath(rawPath) + '/' : sanitizePath(rawPath); logger.debug(`Request: host=${hostname} hostnameWithoutPort=${hostnameWithoutPort} path=${path}`, { BASE_HOST }); diff --git a/apps/main-app/src/routes/domain.ts b/apps/main-app/src/routes/domain.ts index 6fd0084..79a60ba 100644 --- a/apps/main-app/src/routes/domain.ts +++ b/apps/main-app/src/routes/domain.ts @@ -327,8 +327,22 @@ export const domainRoutes = (client: NodeOAuthClient, cookieSecret: string) => throw new Error('Domain parameter required'); } + // Verify domain belongs to user + const domainLower = normalizeDomain(domain); + const info = await isDomainRegistered(domainLower); + + if (!info.registered || info.type !== 'wisp') { + set.status = 404 + throw new Error('Domain not found'); + } + + if (info.did !== auth.did) { + set.status = 403 + throw new Error('Unauthorized: You do not own this domain'); + } + // Update wisp.place domain to point to this site - await updateWispDomainSite(domain, siteRkey); + await updateWispDomainSite(domainLower, siteRkey); return { success: true }; } catch (err) { -- 2.54.0