pinto/TransferTribe
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add TransferTribe app and fix critical transfer security flaws

Browse Source 
The application source was untracked, so this commit brings it under
version control together with fixes for the issues found while auditing
it. Notable fixes:

Authorization
- Require a session and scope to senderEmail on /api/transfers/[id]
  (GET, DELETE) and .../resend. These were unauthenticated over an
  autoincrement id, so the ids could be walked to soft-delete any
  transfer, read sender/recipient metadata, or make the app mail
  arbitrary recipients.
- Require a session on the legacy /api/send and /api/chunk-upload
  endpoints, and take the sender from the session rather than a request
  field so transfers cannot be posted as another user.

Encryption
- Replace the chunk encryption scheme. Every chunk was encrypted under
  one shared session IV with its auth tag discarded, which reuses the
  AES-GCM keystream (XORing two ciphertexts recovers plaintext without
  the key) and left the stored file undecryptable, surfacing to users as
  a wrong-password error. Chunks are now self-contained frames carrying
  their own random IV and auth tag, behind a magic+salt header.
- Files written by the previous format now report UNSUPPORTED_FORMAT
  instead of a misleading password error.

Download
- Verify the password against the stored bcrypt hash before serving a
  file, and enforce expiresAt and DELETED/EXPIRED status.
- Move the password from the query string into a POST body so it stays
  out of access logs and Referer headers.
- Record a download only after successful authentication.
- Decrypt frame by frame through a stream instead of buffering the whole
  file, and encode the Content-Disposition filename per RFC 5987.

Data exposure
- /api/download ran before the password prompt and returned the full
  transfer row, including absolute server file paths. It now returns
  only what the pre-password screen renders; filenames, message and
  recipient are withheld until /api/verify succeeds.

Correctness
- Fix BigInt handling that made /api/transfers and /api/transfers/[id]
  fail unconditionally (JSON.stringify cannot serialize BigInt, and
  seeding a BigInt reduce with 0 throws).
- Fail loudly on a missing chunk during reassembly rather than silently
  writing a corrupt file.
- Meter plan usage in plaintext bytes rather than on-disk encrypted size.

Ignore /uploads: it holds runtime transfer payloads, not source.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
twotalesanimation
2026-08-08 08:48:22 +02:00
parent 95a4bc74fa
commit 2e688c8e52
64 changed files with 9268 additions and 169 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/app/page.tsx
+271 -96
View File
@@ -1,103 +1,278 @@
import Image from "next/image";
'use client';
import { useSession } from 'next-auth/react';
import { useRouter } from 'next/navigation';
import { useEffect } from 'react';
import { Header } from '@/components/header';
import { HeroSection } from '@/components/hero-section';
import { Stats } from '@/components/stats';
import { Button } from '@/components/ui/button';
import { Card, CardContent } from '@/components/ui/card';
import {
ArrowRight,
Shield,
Zap,
Globe,
Mail,
Lock,
Clock,
Users,
Star,
CheckCircle
} from 'lucide-react';
import Link from 'next/link';
export default function Home() {
return (
<div className="grid grid-rows-[20px_1fr_20px] items-center justify-items-center min-h-screen p-8 pb-20 gap-16 sm:p-20 font-[family-name:var(--font-geist-sans)]">
<main className="flex flex-col gap-[32px] row-start-2 items-center sm:items-start">
<Image
className="dark:invert"
src="/next.svg"
alt="Next.js logo"
width={180}
height={38}
priority
/>
<ol className="list-inside list-decimal text-sm/6 text-center sm:text-left font-[family-name:var(--font-geist-mono)]">
<li className="mb-2 tracking-[-.01em]">
Get started by editing{" "}
<code className="bg-black/[.05] dark:bg-white/[.06] px-1 py-0.5 rounded font-[family-name:var(--font-geist-mono)] font-semibold">
src/app/page.tsx
</code>
.
</li>
<li className="tracking-[-.01em]">
Save and see your changes instantly.
</li>
</ol>
const { data: session, status } = useSession();
const router = useRouter();
<div className="flex gap-4 items-center flex-col sm:flex-row">
<a
className="rounded-full border border-solid border-transparent transition-colors flex items-center justify-center bg-foreground text-background gap-2 hover:bg-[#383838] dark:hover:bg-[#ccc] font-medium text-sm sm:text-base h-10 sm:h-12 px-4 sm:px-5 sm:w-auto"
href="https://vercel.com/new?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
target="_blank"
rel="noopener noreferrer"
>
<Image
className="dark:invert"
src="/vercel.svg"
alt="Vercel logomark"
width={20}
height={20}
/>
Deploy now
</a>
<a
className="rounded-full border border-solid border-black/[.08] dark:border-white/[.145] transition-colors flex items-center justify-center hover:bg-[#f2f2f2] dark:hover:bg-[#1a1a1a] hover:border-transparent font-medium text-sm sm:text-base h-10 sm:h-12 px-4 sm:px-5 w-full sm:w-auto md:w-[158px]"
href="https://nextjs.org/docs?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
target="_blank"
rel="noopener noreferrer"
>
Read our docs
</a>
useEffect(() => {
// Redirect logged-in users to dashboard
if (session) {
router.push('/send');
}
}, [session, router]);
if (status === 'loading') {
return (
<div className="min-h-screen bg-gradient-to-br from-slate-50 via-blue-50 to-indigo-100 dark:from-slate-900 dark:via-slate-800 dark:to-slate-900 flex items-center justify-center">
<div className="text-center">
<div className="w-16 h-16 bg-gradient-to-br from-blue-500 to-indigo-600 rounded-full flex items-center justify-center mx-auto mb-4 animate-pulse">
<Mail className="w-8 h-8 text-white" />
</div>
<p className="text-slate-600 dark:text-slate-400">Loading...</p>
</div>
</div>
);
}
if (session) {
return null; // Will redirect to dashboard
}
return (
<div className="min-h-screen bg-gradient-to-br from-slate-50 via-blue-50 to-indigo-100 dark:from-slate-900 dark:via-slate-800 dark:to-slate-900">
<Header />
<main className="container mx-auto px-4 py-8">
<HeroSection />
<div className="max-w-6xl mx-auto space-y-16">
<Stats />
{/* Features Section */}
<section id="features" className="space-y-12">
<div className="text-center">
<h2 className="text-3xl md:text-4xl font-bold text-slate-900 dark:text-slate-100 mb-4">
Why Choose Transfer Tribe?
</h2>
<p className="text-xl text-slate-600 dark:text-slate-400 max-w-2xl mx-auto">
Built for security, designed for simplicity. Share files with confidence.
</p>
</div>
<div className="grid grid-cols-1 md:grid-cols-3 gap-8">
<Card className="bg-white/80 dark:bg-slate-800/80 backdrop-blur-sm border-white/20 dark:border-slate-700/20 hover:bg-white/90 dark:hover:bg-slate-800/90 transition-all">
<CardContent className="p-8 text-center">
<div className="w-16 h-16 bg-gradient-to-br from-green-400 to-emerald-600 rounded-full flex items-center justify-center mx-auto mb-6">
<Shield className="w-8 h-8 text-white" />
</div>
<h3 className="text-xl font-semibold text-slate-900 dark:text-slate-100 mb-4">
Enterprise Security
</h3>
<p className="text-slate-600 dark:text-slate-400 leading-relaxed">
Bank-level encryption, password protection, and automatic expiration ensure your files stay secure.
</p>
</CardContent>
</Card>
<Card className="bg-white/80 dark:bg-slate-800/80 backdrop-blur-sm border-white/20 dark:border-slate-700/20 hover:bg-white/90 dark:hover:bg-slate-800/90 transition-all">
<CardContent className="p-8 text-center">
<div className="w-16 h-16 bg-gradient-to-br from-blue-400 to-blue-600 rounded-full flex items-center justify-center mx-auto mb-6">
<Zap className="w-8 h-8 text-white" />
</div>
<h3 className="text-xl font-semibold text-slate-900 dark:text-slate-100 mb-4">
Lightning Fast
</h3>
<p className="text-slate-600 dark:text-slate-400 leading-relaxed">
Powered by Google Cloud Storage for maximum speed and reliability. Upload and share in seconds.
</p>
</CardContent>
</Card>
<Card className="bg-white/80 dark:bg-slate-800/80 backdrop-blur-sm border-white/20 dark:border-slate-700/20 hover:bg-white/90 dark:hover:bg-slate-800/90 transition-all">
<CardContent className="p-8 text-center">
<div className="w-16 h-16 bg-gradient-to-br from-purple-400 to-purple-600 rounded-full flex items-center justify-center mx-auto mb-6">
<Mail className="w-8 h-8 text-white" />
</div>
<h3 className="text-xl font-semibold text-slate-900 dark:text-slate-100 mb-4">
Email Integration
</h3>
<p className="text-slate-600 dark:text-slate-400 leading-relaxed">
Recipients get secure download links directly in their inbox. No accounts required to download.
</p>
</CardContent>
</Card>
</div>
</section>
{/* How It Works */}
<section className="space-y-12">
<div className="text-center">
<h2 className="text-3xl md:text-4xl font-bold text-slate-900 dark:text-slate-100 mb-4">
How It Works
</h2>
<p className="text-xl text-slate-600 dark:text-slate-400 max-w-2xl mx-auto">
Share files in three simple steps
</p>
</div>
<div className="grid grid-cols-1 md:grid-cols-3 gap-8">
<div className="text-center space-y-4">
<div className="w-16 h-16 bg-gradient-to-br from-blue-500 to-indigo-600 rounded-full flex items-center justify-center mx-auto text-white font-bold text-xl">
1
</div>
<h3 className="text-xl font-semibold text-slate-900 dark:text-slate-100">
Upload Files
</h3>
<p className="text-slate-600 dark:text-slate-400">
Drag and drop your files or click to select. Files up to 2GB are supported on the free plan.
</p>
</div>
<div className="text-center space-y-4">
<div className="w-16 h-16 bg-gradient-to-br from-green-500 to-emerald-600 rounded-full flex items-center justify-center mx-auto text-white font-bold text-xl">
2
</div>
<h3 className="text-xl font-semibold text-slate-900 dark:text-slate-100">
Add Recipients
</h3>
<p className="text-slate-600 dark:text-slate-400">
Enter recipient email addresses and add an optional personal message.
</p>
</div>
<div className="text-center space-y-4">
<div className="w-16 h-16 bg-gradient-to-br from-purple-500 to-pink-600 rounded-full flex items-center justify-center mx-auto text-white font-bold text-xl">
3
</div>
<h3 className="text-xl font-semibold text-slate-900 dark:text-slate-100">
Send Securely
</h3>
<p className="text-slate-600 dark:text-slate-400">
Recipients receive an email with a secure download link and password.
</p>
</div>
</div>
</section>
{/* Testimonials */}
<section className="space-y-12">
<div className="text-center">
<h2 className="text-3xl md:text-4xl font-bold text-slate-900 dark:text-slate-100 mb-4">
Trusted by Thousands
</h2>
<p className="text-xl text-slate-600 dark:text-slate-400 max-w-2xl mx-auto">
See what our users are saying about Transfer Tribe
</p>
</div>
<div className="grid grid-cols-1 md:grid-cols-3 gap-8">
<Card className="bg-white/80 dark:bg-slate-800/80 backdrop-blur-sm border-white/20 dark:border-slate-700/20">
<CardContent className="p-6">
<div className="flex items-center space-x-1 mb-4">
{[...Array(5)].map((_, i) => (
<Star key={i} className="w-4 h-4 fill-yellow-400 text-yellow-400" />
))}
</div>
<p className="text-slate-600 dark:text-slate-400 mb-4">
"Transfer Tribe has revolutionized how we share large design files with clients. The security features give us peace of mind."
</p>
<div className="flex items-center space-x-3">
<div className="w-10 h-10 bg-gradient-to-br from-blue-500 to-indigo-600 rounded-full flex items-center justify-center text-white font-semibold">
S
</div>
<div>
<p className="font-semibold text-slate-900 dark:text-slate-100">Sarah Chen</p>
<p className="text-sm text-slate-500 dark:text-slate-400">Creative Director</p>
</div>
</div>
</CardContent>
</Card>
<Card className="bg-white/80 dark:bg-slate-800/80 backdrop-blur-sm border-white/20 dark:border-slate-700/20">
<CardContent className="p-6">
<div className="flex items-center space-x-1 mb-4">
{[...Array(5)].map((_, i) => (
<Star key={i} className="w-4 h-4 fill-yellow-400 text-yellow-400" />
))}
</div>
<p className="text-slate-600 dark:text-slate-400 mb-4">
"Simple, fast, and secure. Exactly what we needed for sharing confidential documents with our legal team."
</p>
<div className="flex items-center space-x-3">
<div className="w-10 h-10 bg-gradient-to-br from-green-500 to-emerald-600 rounded-full flex items-center justify-center text-white font-semibold">
M
</div>
<div>
<p className="font-semibold text-slate-900 dark:text-slate-100">Michael Rodriguez</p>
<p className="text-sm text-slate-500 dark:text-slate-400">Business Owner</p>
</div>
</div>
</CardContent>
</Card>
<Card className="bg-white/80 dark:bg-slate-800/80 backdrop-blur-sm border-white/20 dark:border-slate-700/20">
<CardContent className="p-6">
<div className="flex items-center space-x-1 mb-4">
{[...Array(5)].map((_, i) => (
<Star key={i} className="w-4 h-4 fill-yellow-400 text-yellow-400" />
))}
</div>
<p className="text-slate-600 dark:text-slate-400 mb-4">
"The email integration is brilliant. Our clients love how easy it is to receive and download files."
</p>
<div className="flex items-center space-x-3">
<div className="w-10 h-10 bg-gradient-to-br from-purple-500 to-pink-600 rounded-full flex items-center justify-center text-white font-semibold">
A
</div>
<div>
<p className="font-semibold text-slate-900 dark:text-slate-100">Alex Thompson</p>
<p className="text-sm text-slate-500 dark:text-slate-400">Freelancer</p>
</div>
</div>
</CardContent>
</Card>
</div>
</section>
{/* CTA Section */}
<section className="text-center space-y-8">
<div className="bg-gradient-to-r from-blue-500 to-indigo-600 rounded-2xl p-12 text-white">
<h2 className="text-3xl md:text-4xl font-bold mb-4">
Ready to Start Sharing?
</h2>
<p className="text-xl text-blue-100 mb-8 max-w-2xl mx-auto">
Join thousands of users who trust Transfer Tribe for secure file sharing.
Get started with our free plan today.
</p>
<div className="flex flex-col sm:flex-row gap-4 justify-center">
<Link href="/auth/signup">
<Button size="lg" className="bg-white text-blue-600 hover:bg-blue-50 px-8 py-3 rounded-full shadow-lg hover:shadow-xl transition-all">
Get Started Free
<ArrowRight className="ml-2 h-4 w-4" />
</Button>
</Link>
<Link href="/pricing">
<Button variant="outline" size="lg" className="border-white text-white hover:bg-white/10 px-8 py-3 rounded-full">
View Pricing
</Button>
</Link>
</div>
</div>
</section>
</div>
</main>
<footer className="row-start-3 flex gap-[24px] flex-wrap items-center justify-center">
<a
className="flex items-center gap-2 hover:underline hover:underline-offset-4"
href="https://nextjs.org/learn?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
target="_blank"
rel="noopener noreferrer"
>
<Image
aria-hidden
src="/file.svg"
alt="File icon"
width={16}
height={16}
/>
Learn
</a>
<a
className="flex items-center gap-2 hover:underline hover:underline-offset-4"
href="https://vercel.com/templates?framework=next.js&utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
target="_blank"
rel="noopener noreferrer"
>
<Image
aria-hidden
src="/window.svg"
alt="Window icon"
width={16}
height={16}
/>
Examples
</a>
<a
className="flex items-center gap-2 hover:underline hover:underline-offset-4"
href="https://nextjs.org?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
target="_blank"
rel="noopener noreferrer"
>
<Image
aria-hidden
src="/globe.svg"
alt="Globe icon"
width={16}
height={16}
/>
Go to nextjs.org →
</a>
</footer>
</div>
);
}
}