diff --git a/src/backend/backend.js b/src/backend/backend.js index 94d658b..6e5c372 100644 --- a/src/backend/backend.js +++ b/src/backend/backend.js @@ -3655,7 +3655,13 @@ router .get('/karvan/:id', async (ctx) => { if (!checkMod(ctx, 'karvanMod')) { ctx.redirect('/modules'); return; } let room = karvanModel.getRoom(ctx.params.id); - if (!room) room = karvanModel.adoptRoom({ id: ctx.params.id }); // unirse por enlace/invitación (espejo local) + // unirse por enlace/invitación crea un espejo local, pero SOLO en una navegación real (documento): + // un /subrecurso de una web maliciosa NO debe poder crear/expulsar salas por GET (CSRF). El navegador + // controla sec-fetch-dest/accept, así que son señales fiables. + if (!room) { + const isNav = ctx.get('sec-fetch-dest') === 'document' || (ctx.get('accept') || '').includes('text/html'); + if (isNav) room = karvanModel.adoptRoom({ id: ctx.params.id }); + } if (!room) { ctx.redirect('/karvan'); return; } let selfId = ''; try { selfId = getViewerId(); } catch (e) {} const msgs = karvanModel.listMessages(room.id, 0) || []; diff --git a/src/client/assets/themes/OasisMobile.css b/src/client/assets/themes/OasisMobile.css index e015b8c..4e93351 100644 --- a/src/client/assets/themes/OasisMobile.css +++ b/src/client/assets/themes/OasisMobile.css @@ -1042,107 +1042,9 @@ button, input[type="submit"], input[type="button"], /* --- hive ahora global en el header (debajo de los 2 botones) --- */ .header .hive-nav { margin: 34px auto 10px; } -/* --- bottombar FIJA de 6 (Inbox·PM·Write·Search·Graphos·Peers): que quepan --- */ -.oasis-bottombar-fixed .bb-item { padding: 2px 0; gap: 2px; } -.oasis-bottombar-fixed .bb-ico { font-size: 17px; } -.oasis-bottombar-fixed .bb-lbl { font-size: 8.5px; } - -/* ========================================================================== - FORK_IA_UX — navegación thumb-zone: hive en HOJA INFERIOR + FAB de publicar + barra reordenada. - Respaldo real: Hoober 2013 (49% una mano), Bergstrom-Lehtovirta CHI 2011 (área del pulgar = arco), - Parhi 2006 (diana ≥9mm → ≥48px), NN/g 2016 (nav visible > oculta), Von Restorff (FAB destacado). - Sin JS (checkbox-hack), gateado por OASIS_MOBILE. - ========================================================================== */ - -/* hive de vuelta en el header: holgura bajo la topbar fija (como en la versión que gustaba) */ +/* holgura bajo la topbar fija (el hive va en el header, solo en la home) */ body { padding-top: 84px; } -/* --- barra inferior FORK (thumb-zone): 5 huecos con FAB central elevado --- */ -.oasis-bottombar-fork { align-items: flex-end; gap: 2px; } -.oasis-bottombar-fork .bb-item, -.oasis-bottombar-fork .bb-explore { - min-height: 52px; /* diana táctil holgada (≥48px, Parhi 2006 / Material 48dp) */ - justify-content: center; - cursor: pointer; text-decoration: none; -} -/* FAB central de publicar: círculo dorado destacado y elevado (Von Restorff + Jakob) */ -.oasis-bottombar-fork .bb-fab-btn { - flex: 0 0 auto; - display: flex; align-items: center; justify-content: center; - width: 58px; height: 58px; margin: 0 4px; - border-radius: 50%; - background: #FFD700; color: #121212; - box-shadow: 0 3px 10px rgba(0,0,0,.55); - text-decoration: none; - transform: translateY(-16px); /* lo levanta por encima de la barra */ -} -.oasis-bottombar-fork .bb-fab-glyph { font-size: 32px; font-weight: 700; line-height: 1; } -.oasis-bottombar-fork .bb-fab-btn:active { filter: brightness(.9); } - -/* --- HOJA INFERIOR del hive (bottom-sheet, sin JS) --- */ -.fork-sheet-wrap { display: contents; } /* no genera caja: el checkbox y la hoja quedan hermanos */ -.fork-sheet-toggle { position: absolute; width: 1px; height: 1px; opacity: 0; pointer-events: none; margin: 0; } - -.hive-sheet { - position: fixed; inset: 0; z-index: 1200; - visibility: hidden; /* CERRADA: fuera del hit-testing → el topbar y el contenido de abajo SIEMPRE reciben taps (fix del bug de "botones de arriba no funcionan") */ - transition: visibility 0s linear .3s; /* al cerrar, mantiene visible durante la animación de bajada */ - background-color: transparent; box-shadow: none; border-radius: 0; /* anula el div{#222} global */ -} -.hive-sheet-backdrop { position: absolute; inset: 0; background: rgba(0,0,0,.6); opacity: 0; transition: opacity .25s ease; } -.hive-sheet-panel { - position: absolute; left: 0; right: 0; bottom: 0; margin: 0; - max-height: 82vh; overflow-y: auto; - background: #121212; border-top: 1px solid #333; border-radius: 18px 18px 0 0; - padding: 6px 10px calc(20px + env(safe-area-inset-bottom, 0px)); - transform: translateY(100%); transition: transform .28s ease; - box-shadow: 0 -6px 24px rgba(0,0,0,.5); -} -/* abierto */ -.fork-sheet-toggle:checked ~ .hive-sheet { visibility: visible; transition: visibility 0s; } -.fork-sheet-toggle:checked ~ .hive-sheet .hive-sheet-backdrop { opacity: 1; } -.fork-sheet-toggle:checked ~ .hive-sheet .hive-sheet-panel { transform: translateY(0); } - -/* asa/grip para cerrar */ -.hive-sheet-grip { display: block; width: 44px; height: 5px; margin: 4px auto 10px; border-radius: 3px; background: #444; cursor: pointer; } -/* fila de accesos que NO están en el hive (red y estado) */ -.hive-sheet-quick { - display: grid; grid-template-columns: repeat(4, 1fr); gap: 8px; - margin: 2px 0 10px; padding: 0 0 8px; border-bottom: 1px solid #262626; - background-color: transparent; box-shadow: none; border-radius: 0; /* anula div{#222} */ -} -.hive-sheet-quick .hsq-item { - display: flex; flex-direction: column; align-items: center; gap: 4px; - min-height: 48px; justify-content: center; - text-decoration: none; color: #FFD700; - background: #161616; border: 1px solid #333; border-radius: 12px; padding: 6px 2px; -} -.hive-sheet-quick .hsq-ico { font-size: 20px; line-height: 1; } -.hive-sheet-quick .hsq-lbl { font-size: 10px; } -/* el hive dentro de la hoja */ -.hive-sheet .hive-nav { margin: 2px auto 0; max-width: 360px; } -.hive-sheet .hive-mods { background-color: transparent; box-shadow: none; border-radius: 0; } /* por si el div{#222} lo alcanza */ - -/* topbar v2: solo identidad (logo … avatar); el spacer empuja el avatar a la derecha */ -.oasis-mobile-topbar .omt-spacer { - flex: 1 1 auto; min-width: 0; - background-color: transparent; box-shadow: none; border-radius: 0; padding: 0; margin: 0; /* anula div{#222} */ -} - -/* control segmentado Personal/Community/Todo dentro de la hoja (movido desde el topbar) */ -.hive-sheet-seg { - display: flex; gap: 6px; margin: 2px 0 10px; - background-color: transparent; box-shadow: none; border-radius: 0; /* anula div{#222} */ -} -.hive-sheet-seg .hs-seg { - flex: 1 1 0; text-align: center; - min-height: 40px; display: flex; align-items: center; justify-content: center; - border: 1px solid #FFD700; border-radius: 10px; - background: #161616; color: #FFD700; font-weight: 600; font-size: 13px; - text-decoration: none; -} -.hive-sheet-seg .hs-seg.active { background: #FFD700; color: #121212; } - /* ========================================================================== FORK_IA_UX · Módulo KARVAN (mensajes temporales + WebRTC) — chat estilo burbujas ========================================================================== */ @@ -1179,6 +1081,7 @@ body { padding-top: 84px; } .karvan-msg { max-width: 82%; align-self: flex-start; background: #1c1c1c; border: 1px solid #333; border-radius: 14px; padding: 7px 11px; box-sizing: border-box; } .karvan-msg-self { align-self: flex-end; background: #2a2412; border-color: #FFD700; } +.karvan-msg-live { border-left: 2px solid #35d07f; } /* recibido al instante por WebRTC (P2P) */ .karvan-msg .km-from { display: block; font-size: 10px; color: #FFDD44; margin-bottom: 2px; } .karvan-msg .km-text { color: #FFD700; word-break: break-word; } .karvan-compose { display: flex; gap: 8px; margin-top: 10px; } diff --git a/src/client/public/js/karvan.js b/src/client/public/js/karvan.js index a57c896..c2c900d 100644 --- a/src/client/public/js/karvan.js +++ b/src/client/public/js/karvan.js @@ -255,6 +255,7 @@ var pc = peer.pc; if (payload.kind === "desc") { var desc = payload.desc; + if (!desc) return; // señal malformada (sin desc) — no reventar el lote de sondeo var collision = desc.type === "offer" && (peer.makingOffer || pc.signalingState !== "stable"); peer.ignoreOffer = !peer.polite && collision; if (peer.ignoreOffer) return; diff --git a/src/models/karvan_model.js b/src/models/karvan_model.js index 2aa4c74..23f26e7 100644 --- a/src/models/karvan_model.js +++ b/src/models/karvan_model.js @@ -14,6 +14,8 @@ const MAX_ABS_TTL_MS = 24 * 60 * 60 * 1000; // nunca más de 24 h const MAX_MSGS = 250; // anillo: solo los últimos N en RAM const MAX_SIGNALS = 500; const MAX_ROOMS = 100; +const MAX_MEMBERS = 50; // tope de miembros por sala (evita crecimiento sin límite del Set) +const MAX_SIGNAL_BYTES = 16384; // SDP/ICE son pequeños; rechaza payloads gigantes (anti-DoS de memoria) module.exports = ({ idleTtlMs = DEFAULT_IDLE_TTL_MS, absTtlMs = DEFAULT_ABS_TTL_MS } = {}) => { const rooms = new Map(); // id -> room @@ -120,7 +122,7 @@ module.exports = ({ idleTtlMs = DEFAULT_IDLE_TTL_MS, absTtlMs = DEFAULT_ABS_TTL_ }; room.messages.push(msg); if (room.messages.length > MAX_MSGS) room.messages.shift(); - room.members.add(msg.from); + if (room.members.has(msg.from) || room.members.size < MAX_MEMBERS) room.members.add(msg.from); resetIdle(room); return msg; }; @@ -136,6 +138,10 @@ module.exports = ({ idleTtlMs = DEFAULT_IDLE_TTL_MS, absTtlMs = DEFAULT_ABS_TTL_ const postSignal = (id, { from = "", to = "", payload = null } = {}) => { const room = rooms.get(id); if (!room) return null; + if (payload != null) { // rechaza payloads gigantes (SDP/ICE son pequeños) + try { if (JSON.stringify(payload).length > MAX_SIGNAL_BYTES) return null; } + catch (e) { return null; } + } const sig = { seq: ++room.sigSeq, from: String(from || "").slice(0, 80), @@ -145,7 +151,7 @@ module.exports = ({ idleTtlMs = DEFAULT_IDLE_TTL_MS, absTtlMs = DEFAULT_ABS_TTL_ }; room.signals.push(sig); if (room.signals.length > MAX_SIGNALS) room.signals.shift(); - if (sig.from) room.members.add(sig.from); + if (sig.from && (room.members.has(sig.from) || room.members.size < MAX_MEMBERS)) room.members.add(sig.from); resetIdle(room); return sig; }; diff --git a/src/views/karvan_view.js b/src/views/karvan_view.js index 73afd90..f2b7fc8 100644 --- a/src/views/karvan_view.js +++ b/src/views/karvan_view.js @@ -17,7 +17,6 @@ const shortId = (id) => { id = String(id || "?"); return id.startsWith("@") ? id.slice(1, 7) : id.slice(0, 6); }; -exports.karvanShortId = shortId; const renderMsg = (m) => li({ class: "karvan-msg", "data-seq": String(m.seq), "data-mid": m.mid || "" }, @@ -31,7 +30,7 @@ const ttlOpt = (val, lbl, checked) => span(lbl) ); -exports.karvanView = (rooms, params = {}) => +exports.karvanView = (rooms) => template( i18n.karvanTitle || "Karvan", section({ class: "karvan-intro" }, diff --git a/src/views/main_views.js b/src/views/main_views.js index 1e54b17..4298afb 100644 --- a/src/views/main_views.js +++ b/src/views/main_views.js @@ -1272,33 +1272,6 @@ const renderHiveNav = () => { }; exports.renderHiveNav = renderHiveNav; -// FORK_IA_UX: el hive vive en una HOJA INFERIOR (bottom-sheet) alcanzable con el pulgar; sin JS (checkbox-hack). -// Un checkbox oculto (#fork-explore-toggle) y la hoja son hermanos dentro de .fork-sheet-wrap (display:contents), -// así `#fork-explore-toggle:checked ~ .hive-sheet` la despliega; el botón "Explore" de la barra es su