hacklab/OASIS_MOBILE
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 1

[0.9.1] FORK_IA_UX: review pass — remove dead code + Karvan security hardening

Browse source 
Dead code (from the abandoned thumb-zone/Explore-sheet nav experiment):
- OasisMobile.css: removed ~90 lines of orphaned CSS (.oasis-bottombar-fork/.bb-fab-*,
  .hive-sheet*/.fork-sheet*/.hsq-*, .omt-spacer, .hive-sheet-seg/.hs-seg, dead
  .oasis-bottombar-fixed) — no element emits any of them.
- main_views.js: removed renderHiveSheet() (never called; sole emitter of that CSS).
- karvan_view.js: dropped dead export karvanShortId + unused karvanView param.
- Added a style for .karvan-msg-live (client emitted it with no rule).

Karvan security (from the review):
- GET /karvan/:id only adopts a mirror room on a real navigation (sec-fetch-dest
  document / Accept text/html), not on <img>/subresources → fixes a CSRF that could
  spam/evict the user's ephemeral rooms.
- Cap room.members at 50 (was unbounded; each poll echoed it back).
- Reject signal payloads >16KB (SDP/ICE are tiny) — anti memory-DoS.
- karvan.js: guard malformed {kind:desc} signals so one bad signal can't abort a poll batch.
Tests: 15/15 (added members-cap + oversized-payload). Verified: CSRF fix (nav=200,
subresource=302), pages unchanged after CSS removal, boot clean.
This commit is contained in:
s1to 2026-08-07 20:42:53 +02:00
parent af160dbd26
commit 2c2c8f241d
7 changed files with 34 additions and 131 deletions
Download patch file Download diff file Expand all files Collapse all files

101
src/client/assets/themes/OasisMobile.css
View file

@ -1042,107 +1042,9 @@ button, input[type="submit"], input[type="button"],
/* --- hive ahora global en el header (debajo de los 2 botones) --- */
.header .hive-nav { margin: 34px auto 10px; }
/* --- bottombar FIJA de 6 (Inbox·PM·Write·Search·Graphos·Peers): que quepan --- */
.oasis-bottombar-fixed .bb-item { padding: 2px 0; gap: 2px; }
.oasis-bottombar-fixed .bb-ico { font-size: 17px; }
.oasis-bottombar-fixed .bb-lbl { font-size: 8.5px; }
/* ==========================================================================
FORK_IA_UX — navegación thumb-zone: hive en HOJA INFERIOR + FAB de publicar + barra reordenada.
Respaldo real: Hoober 2013 (49% una mano), Bergstrom-Lehtovirta CHI 2011 (área del pulgar = arco),
Parhi 2006 (diana ≥9mm → ≥48px), NN/g 2016 (nav visible > oculta), Von Restorff (FAB destacado).
Sin JS (checkbox-hack), gateado por OASIS_MOBILE.
========================================================================== */
/* hive de vuelta en el header: holgura bajo la topbar fija (como en la versión que gustaba) */
/* holgura bajo la topbar fija (el hive va en el header, solo en la home) */
body { padding-top: 84px; }
/* --- barra inferior FORK (thumb-zone): 5 huecos con FAB central elevado --- */
.oasis-bottombar-fork { align-items: flex-end; gap: 2px; }
.oasis-bottombar-fork .bb-item,
.oasis-bottombar-fork .bb-explore {
min-height: 52px; /* diana táctil holgada (≥48px, Parhi 2006 / Material 48dp) */
justify-content: center;
cursor: pointer; text-decoration: none;
}
/* FAB central de publicar: círculo dorado destacado y elevado (Von Restorff + Jakob) */
.oasis-bottombar-fork .bb-fab-btn {
flex: 0 0 auto;
display: flex; align-items: center; justify-content: center;
width: 58px; height: 58px; margin: 0 4px;
border-radius: 50%;
background: #FFD700; color: #121212;
box-shadow: 0 3px 10px rgba(0,0,0,.55);
text-decoration: none;
transform: translateY(-16px); /* lo levanta por encima de la barra */
}
.oasis-bottombar-fork .bb-fab-glyph { font-size: 32px; font-weight: 700; line-height: 1; }
.oasis-bottombar-fork .bb-fab-btn:active { filter: brightness(.9); }
/* --- HOJA INFERIOR del hive (bottom-sheet, sin JS) --- */
.fork-sheet-wrap { display: contents; } /* no genera caja: el checkbox y la hoja quedan hermanos */
.fork-sheet-toggle { position: absolute; width: 1px; height: 1px; opacity: 0; pointer-events: none; margin: 0; }
.hive-sheet {
position: fixed; inset: 0; z-index: 1200;
visibility: hidden; /* CERRADA: fuera del hit-testing → el topbar y el contenido de abajo SIEMPRE reciben taps (fix del bug de "botones de arriba no funcionan") */
transition: visibility 0s linear .3s; /* al cerrar, mantiene visible durante la animación de bajada */
background-color: transparent; box-shadow: none; border-radius: 0; /* anula el div{#222} global */
}
.hive-sheet-backdrop { position: absolute; inset: 0; background: rgba(0,0,0,.6); opacity: 0; transition: opacity .25s ease; }
.hive-sheet-panel {
position: absolute; left: 0; right: 0; bottom: 0; margin: 0;
max-height: 82vh; overflow-y: auto;
background: #121212; border-top: 1px solid #333; border-radius: 18px 18px 0 0;
padding: 6px 10px calc(20px + env(safe-area-inset-bottom, 0px));
transform: translateY(100%); transition: transform .28s ease;
box-shadow: 0 -6px 24px rgba(0,0,0,.5);
}
/* abierto */
.fork-sheet-toggle:checked ~ .hive-sheet { visibility: visible; transition: visibility 0s; }
.fork-sheet-toggle:checked ~ .hive-sheet .hive-sheet-backdrop { opacity: 1; }
.fork-sheet-toggle:checked ~ .hive-sheet .hive-sheet-panel { transform: translateY(0); }
/* asa/grip para cerrar */
.hive-sheet-grip { display: block; width: 44px; height: 5px; margin: 4px auto 10px; border-radius: 3px; background: #444; cursor: pointer; }
/* fila de accesos que NO están en el hive (red y estado) */
.hive-sheet-quick {
display: grid; grid-template-columns: repeat(4, 1fr); gap: 8px;
margin: 2px 0 10px; padding: 0 0 8px; border-bottom: 1px solid #262626;
background-color: transparent; box-shadow: none; border-radius: 0; /* anula div{#222} */
}
.hive-sheet-quick .hsq-item {
display: flex; flex-direction: column; align-items: center; gap: 4px;
min-height: 48px; justify-content: center;
text-decoration: none; color: #FFD700;
background: #161616; border: 1px solid #333; border-radius: 12px; padding: 6px 2px;
}
.hive-sheet-quick .hsq-ico { font-size: 20px; line-height: 1; }
.hive-sheet-quick .hsq-lbl { font-size: 10px; }
/* el hive dentro de la hoja */
.hive-sheet .hive-nav { margin: 2px auto 0; max-width: 360px; }
.hive-sheet .hive-mods { background-color: transparent; box-shadow: none; border-radius: 0; } /* por si el div{#222} lo alcanza */
/* topbar v2: solo identidad (logo … avatar); el spacer empuja el avatar a la derecha */
.oasis-mobile-topbar .omt-spacer {
flex: 1 1 auto; min-width: 0;
background-color: transparent; box-shadow: none; border-radius: 0; padding: 0; margin: 0; /* anula div{#222} */
}
/* control segmentado Personal/Community/Todo dentro de la hoja (movido desde el topbar) */
.hive-sheet-seg {
display: flex; gap: 6px; margin: 2px 0 10px;
background-color: transparent; box-shadow: none; border-radius: 0; /* anula div{#222} */
}
.hive-sheet-seg .hs-seg {
flex: 1 1 0; text-align: center;
min-height: 40px; display: flex; align-items: center; justify-content: center;
border: 1px solid #FFD700; border-radius: 10px;
background: #161616; color: #FFD700; font-weight: 600; font-size: 13px;
text-decoration: none;
}
.hive-sheet-seg .hs-seg.active { background: #FFD700; color: #121212; }
/* ==========================================================================
FORK_IA_UX · Módulo KARVAN (mensajes temporales + WebRTC) — chat estilo burbujas
========================================================================== */
@ -1179,6 +1081,7 @@ body { padding-top: 84px; }
.karvan-msg { max-width: 82%; align-self: flex-start; background: #1c1c1c; border: 1px solid #333;
border-radius: 14px; padding: 7px 11px; box-sizing: border-box; }
.karvan-msg-self { align-self: flex-end; background: #2a2412; border-color: #FFD700; }
.karvan-msg-live { border-left: 2px solid #35d07f; } /* recibido al instante por WebRTC (P2P) */
.karvan-msg .km-from { display: block; font-size: 10px; color: #FFDD44; margin-bottom: 2px; }
.karvan-msg .km-text { color: #FFD700; word-break: break-word; }
.karvan-compose { display: flex; gap: 8px; margin-top: 10px; }

1
src/client/public/js/karvan.js
View file

@ -255,6 +255,7 @@
var pc = peer.pc;
if (payload.kind === "desc") {
var desc = payload.desc;
if (!desc) return; // señal malformada (sin desc) — no reventar el lote de sondeo
var collision = desc.type === "offer" && (peer.makingOffer || pc.signalingState !== "stable");
peer.ignoreOffer = !peer.polite && collision;
if (peer.ignoreOffer) return;