hetzner-radar/src/lib/server/ at main · else42.tngl.sh/hetzner-radar · Tangled

else42.tngl.sh / hetzner-radar

0

[READ-ONLY] Mirror of https://github.com/elsbrock/hetzner-radar. 🕵️Track prices of the Hetzner dedicated server auction radar.iodev.org/

cloudflare cloudflare-d1 cloudflare-workers duckdb hetzner sqlite sveltekit tailwind wasm

0

hetzner-radar / src / lib / server /

at main 1 folder 1 file

Simon Elsbrock refactor(snapshot): share the KV snapshot types instead of hand-mirroring them 13d ago

refactor(snapshot): share the KV snapshot types instead of hand-mirroring them Both auction-snapshot.ts (producer) and mcp/snapshot.ts (reader) declared the same 32-field SnapshotAuction, SnapshotPricing and AuctionSnapshot, each citing 'this repo does not share code across the worker/app workspace boundary'. That stopped being true when packages/filter-spec landed — the worker already imports it. The comments outlived the constraint and were being cited as precedent for new duplication. Types now live in @server-radar/filter-spec/snapshot, taken verbatim from the producer, with field parity verified against both former copies. Both modules re-export them so existing importers are unaffected. SNAPSHOT_VERSION stays, but its job changes: it now guards a stale deployment reading a newer payload rather than detecting drift between two copies. Verified: worker check + 252 tests, app check (0 errors) + 179 tests, and a wrangler dry-run bundle for the new package subpath.

1 week ago

fix(mcp): require explicit consent, and stop building inverted filter ranges Two fixes. 1. Consent. Better Auth's mcp plugin only asks for consent when the request carries prompt=consent (requireConsent: query.prompt === "consent"), otherwise it issues an authorization code the instant a signed-in user hits /authorize. Clients do not send it. Combined with open client registration that let anyone register a client pointing at their own redirect_uri, lure a signed-in user to a URL, and receive a working code with no interaction — PKCE is no defence when the attacker is the client. forceConsentHandle now injects prompt=consent, and /auth/consent shows who is asking and what for. The client name comes from open registration, so it is presented as unverified. 2. Inverted ranges. A minimum above the UI slider's default ceiling produced e.g. hddInternalSize [128, 44] for a 64 TB request, and MATCH_ALERTS_SQL then evaluates `hdd_size >= 64000 AND hdd_size <= 22000` — never true, so the alert silently never fired. The ceiling is now raised to at least the floor. Caught by a spot-check of a filter echoed back from create_alert. Consent verified end to end: authorize -> prompt injected -> consent page -> approve -> callback with code and state intact.

2 weeks ago