+
Health
@@ -191,6 +192,39 @@
Charts
+
+
+
+ Configuration
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Select a category to edit guided settings.
+
+
+
+
diff --git a/src/controllers/admin/get-settings-backups-controller.ts b/src/controllers/admin/get-settings-backups-controller.ts
new file mode 100644
index 00000000..c56cca3c
--- /dev/null
+++ b/src/controllers/admin/get-settings-backups-controller.ts
@@ -0,0 +1,10 @@
+import { Request, Response } from 'express'
+
+import { IController } from '../../@types/controllers'
+import { listSettingsBackups } from '../../utils/settings-config'
+
+export class GetAdminSettingsBackupsController implements IController {
+ public async handleRequest(_request: Request, response: Response): Promise
{
+ response.status(200).setHeader('content-type', 'application/json').send({ backups: listSettingsBackups() })
+ }
+}
diff --git a/src/controllers/admin/get-settings-schema-controller.ts b/src/controllers/admin/get-settings-schema-controller.ts
index a12d7be0..ff18325f 100644
--- a/src/controllers/admin/get-settings-schema-controller.ts
+++ b/src/controllers/admin/get-settings-schema-controller.ts
@@ -5,6 +5,11 @@ import { guidedSettingCategories } from '../../utils/settings-guided-schema'
export class GetAdminSettingsSchemaController implements IController {
public async handleRequest(_request: Request, response: Response): Promise {
- response.status(200).setHeader('content-type', 'application/json').send({ categories: guidedSettingCategories })
+ const categories = guidedSettingCategories.map((category) => ({
+ ...category,
+ settings: category.settings.map(({ validate: _validate, ...setting }) => setting),
+ }))
+
+ response.status(200).setHeader('content-type', 'application/json').send({ categories })
}
}
diff --git a/src/controllers/admin/patch-settings-controller.ts b/src/controllers/admin/patch-settings-controller.ts
index 0f409980..7914d3b8 100644
--- a/src/controllers/admin/patch-settings-controller.ts
+++ b/src/controllers/admin/patch-settings-controller.ts
@@ -4,6 +4,7 @@ import { Settings } from '../../@types/settings'
import { IController } from '../../@types/controllers'
import { adminSettingsPatchBodySchema } from '../../schemas/admin-settings-schema'
import {
+ appendSettingsAuditLog,
getByPath,
loadMergedSettings,
loadUserSettings,
@@ -26,33 +27,30 @@ export class PatchAdminSettingsController implements IController {
return
}
- const { path, value } = validation.value
+ const changes = 'changes' in validation.value ? validation.value.changes : [validation.value]
+ const issues = changes.flatMap(({ path }) => {
+ if (isWriteProtectedSettingsPath(path)) {
+ return [{ path, message: 'Path is write-protected' }]
+ }
- if (isWriteProtectedSettingsPath(path)) {
- response
- .status(400)
- .setHeader('content-type', 'application/json')
- .send({
- error: 'Validation failed',
- issues: [{ path, message: 'Path is write-protected' }],
- })
- return
- }
+ return validatePathAgainstDefaults(path)
+ })
- const pathIssues = validatePathAgainstDefaults(path)
- if (pathIssues.length > 0) {
- response
- .status(400)
- .setHeader('content-type', 'application/json')
- .send({ error: 'Validation failed', issues: pathIssues })
+ if (issues.length > 0) {
+ response.status(400).setHeader('content-type', 'application/json').send({ error: 'Validation failed', issues })
return
}
const userSettings = loadUserSettings() as unknown as Record
- const nextUserSettings = setByPath(userSettings, path, value)
-
+ const nextUserSettings = changes.reduce(
+ (settings, change) => setByPath(settings, change.path, change.value),
+ userSettings,
+ )
const merged = loadMergedSettings() as unknown as Record
- const mergedNext = setByPath(merged, path, getByPath(nextUserSettings, path))
+ const mergedNext = changes.reduce(
+ (settings, change) => setByPath(settings, change.path, getByPath(nextUserSettings, change.path)),
+ merged,
+ )
const validationIssues = validateSettings(mergedNext as unknown as Settings)
if (validationIssues.length > 0) {
@@ -64,13 +62,31 @@ export class PatchAdminSettingsController implements IController {
}
saveSettings(nextUserSettings as unknown as Settings)
-
- const updatedValue = redactSettingsValue(path, getByPath(nextUserSettings, path))
-
- response.status(200).setHeader('content-type', 'application/json').send({
- ok: true,
+ const updatedChanges = changes.map(({ path }) => ({
path,
- value: updatedValue,
+ value: redactSettingsValue(path, getByPath(nextUserSettings, path)),
+ reload: getSettingsReloadBehavior(path),
+ }))
+ appendSettingsAuditLog({
+ action: 'settings.updated',
+ changes: updatedChanges.map(({ path, reload }) => ({ path, reload })),
+ remoteAddress: request.ip,
})
+
+ if (changes.length === 1 && !('changes' in validation.value)) {
+ const [change] = updatedChanges
+ response.status(200).setHeader('content-type', 'application/json').send({ ok: true, ...change })
+ return
+ }
+
+ response.status(200).setHeader('content-type', 'application/json').send({ ok: true, changes: updatedChanges })
}
}
+
+const getSettingsReloadBehavior = (path: string): 'hot-reload' | 'restart-required' => {
+ if (path.startsWith('workers.') || path.startsWith('payments') || path.startsWith('network.')) {
+ return 'restart-required'
+ }
+
+ return 'hot-reload'
+}
diff --git a/src/controllers/admin/post-settings-restore-controller.ts b/src/controllers/admin/post-settings-restore-controller.ts
new file mode 100644
index 00000000..aadcca09
--- /dev/null
+++ b/src/controllers/admin/post-settings-restore-controller.ts
@@ -0,0 +1,30 @@
+import { Request, Response } from 'express'
+
+import { IController } from '../../@types/controllers'
+import { adminSettingsRestoreBodySchema } from '../../schemas/admin-settings-schema'
+import { appendSettingsAuditLog, restoreSettingsBackup } from '../../utils/settings-config'
+import { validateSchema } from '../../utils/validation'
+
+export class PostAdminSettingsRestoreController implements IController {
+ public async handleRequest(request: Request, response: Response): Promise {
+ const validation = validateSchema(adminSettingsRestoreBodySchema)(request.body)
+ if (validation.error) {
+ response.status(400).setHeader('content-type', 'application/json').send({ error: 'Invalid request' })
+ return
+ }
+
+ try {
+ restoreSettingsBackup(validation.value.filename)
+ appendSettingsAuditLog({
+ action: 'settings.restored',
+ filename: validation.value.filename,
+ remoteAddress: request.ip,
+ })
+
+ response.status(200).setHeader('content-type', 'application/json').send({ ok: true, filename: validation.value.filename })
+ } catch (error) {
+ const message = error instanceof Error ? error.message : 'Restore failed'
+ response.status(400).setHeader('content-type', 'application/json').send({ error: message })
+ }
+ }
+}
diff --git a/src/factories/controllers/get-admin-settings-backups-controller-factory.ts b/src/factories/controllers/get-admin-settings-backups-controller-factory.ts
new file mode 100644
index 00000000..2471ccce
--- /dev/null
+++ b/src/factories/controllers/get-admin-settings-backups-controller-factory.ts
@@ -0,0 +1,6 @@
+import { GetAdminSettingsBackupsController } from '../../controllers/admin/get-settings-backups-controller'
+import { IController } from '../../@types/controllers'
+
+export const createGetAdminSettingsBackupsController = (): IController => {
+ return new GetAdminSettingsBackupsController()
+}
diff --git a/src/factories/controllers/post-admin-settings-restore-controller-factory.ts b/src/factories/controllers/post-admin-settings-restore-controller-factory.ts
new file mode 100644
index 00000000..19fdb215
--- /dev/null
+++ b/src/factories/controllers/post-admin-settings-restore-controller-factory.ts
@@ -0,0 +1,6 @@
+import { PostAdminSettingsRestoreController } from '../../controllers/admin/post-settings-restore-controller'
+import { IController } from '../../@types/controllers'
+
+export const createPostAdminSettingsRestoreController = (): IController => {
+ return new PostAdminSettingsRestoreController()
+}
diff --git a/src/routes/admin/index.ts b/src/routes/admin/index.ts
index 79079093..6879b826 100644
--- a/src/routes/admin/index.ts
+++ b/src/routes/admin/index.ts
@@ -4,10 +4,12 @@ import { createGetAdminHealthController } from '../../factories/controllers/get-
import { createGetAdminMetricsController } from '../../factories/controllers/get-admin-metrics-controller-factory'
import { createGetAdminSessionController } from '../../factories/controllers/get-admin-session-controller-factory'
import { createGetAdminSettingsController } from '../../factories/controllers/get-admin-settings-controller-factory'
+import { createGetAdminSettingsBackupsController } from '../../factories/controllers/get-admin-settings-backups-controller-factory'
import { createGetAdminSettingsSchemaController } from '../../factories/controllers/get-admin-settings-schema-controller-factory'
import { createPatchAdminSettingsController } from '../../factories/controllers/patch-admin-settings-controller-factory'
import { createPostAdminLoginController } from '../../factories/controllers/post-admin-login-controller-factory'
import { createPostAdminLogoutController } from '../../factories/controllers/post-admin-logout-controller-factory'
+import { createPostAdminSettingsRestoreController } from '../../factories/controllers/post-admin-settings-restore-controller-factory'
import { createPostAdminSettingsValidateController } from '../../factories/controllers/post-admin-settings-validate-controller-factory'
import { adminAuthMiddleware } from '../../handlers/request-handlers/admin-auth-middleware'
import { adminEnabledMiddleware } from '../../handlers/request-handlers/admin-enabled-middleware'
@@ -34,18 +36,33 @@ router.get('/session', adminRateLimitMiddleware, adminAuthMiddleware, withAdminC
router.get('/health', adminRateLimitMiddleware, adminAuthMiddleware, withAdminController(createGetAdminHealthController))
router.get('/metrics', adminRateLimitMiddleware, adminAuthMiddleware, withAdminController(createGetAdminMetricsController))
router.get('/settings', adminRateLimitMiddleware, adminAuthMiddleware, withAdminController(createGetAdminSettingsController))
+router.get(
+ '/settings/backups',
+ adminRateLimitMiddleware,
+ adminAuthMiddleware,
+ withAdminController(createGetAdminSettingsBackupsController),
+)
router.get(
'/settings/schema',
adminRateLimitMiddleware,
adminAuthMiddleware,
withAdminController(createGetAdminSettingsSchemaController),
)
+// codeql[js/missing-rate-limiting] - adminRateLimitMiddleware applies Redis-backed admin rate limits
router.patch('/settings', adminRateLimitMiddleware, adminAuthMiddleware, json(), withAdminController(createPatchAdminSettingsController))
+// codeql[js/missing-rate-limiting] - adminRateLimitMiddleware applies Redis-backed admin rate limits
router.post(
'/settings/validate',
adminRateLimitMiddleware,
adminAuthMiddleware,
withAdminController(createPostAdminSettingsValidateController),
)
+router.post(
+ '/settings/restore',
+ adminRateLimitMiddleware,
+ adminAuthMiddleware,
+ json(),
+ withAdminController(createPostAdminSettingsRestoreController),
+)
export default router
diff --git a/src/schemas/admin-settings-schema.ts b/src/schemas/admin-settings-schema.ts
index b6c28d28..86ea08ae 100644
--- a/src/schemas/admin-settings-schema.ts
+++ b/src/schemas/admin-settings-schema.ts
@@ -1,8 +1,23 @@
import { z } from 'zod'
-export const adminSettingsPatchBodySchema = z
+const adminSettingsChangeSchema = z
.object({
path: z.string().min(1),
value: z.custom((input) => input !== undefined, { message: 'value is required' }),
})
.strict()
+
+export const adminSettingsPatchBodySchema = z.union([
+ adminSettingsChangeSchema,
+ z
+ .object({
+ changes: z.array(adminSettingsChangeSchema).min(1),
+ })
+ .strict(),
+])
+
+export const adminSettingsRestoreBodySchema = z
+ .object({
+ filename: z.string().min(1),
+ })
+ .strict()
diff --git a/src/utils/settings-config.ts b/src/utils/settings-config.ts
index 573151ad..284bd158 100644
--- a/src/utils/settings-config.ts
+++ b/src/utils/settings-config.ts
@@ -26,6 +26,10 @@ export const getSettingsFilePath = (): string => join(getConfigBaseDir(), 'setti
export const getDefaultSettingsFilePath = (): string => join(process.cwd(), 'resources', 'default-settings.yaml')
+export const getSettingsBackupDir = (): string => join(getConfigBaseDir(), 'backups')
+
+export const getSettingsAuditLogPath = (): string => join(getConfigBaseDir(), 'settings-audit.jsonl')
+
export const toCategoryLabel = (key: string): string => {
return key
.split(/[_\-.]/)
@@ -215,6 +219,10 @@ const validateShape = (schema: unknown, candidate: unknown, path: PathToken[], i
}
for (const key of Object.keys(candidate)) {
+ if (renderedPath === 'admin' && key === 'passwordHash') {
+ continue
+ }
+
if (!hasOwn(schema, key)) {
issues.push({
path: formatPathTokens([...path, { type: 'key', key }]),
@@ -344,15 +352,82 @@ export const saveSettings = (settings: Settings): void => {
ensureSettingsExists()
const serialized = yaml.dump(toSerializable(settings), { lineWidth: 120 })
const settingsPath = getSettingsFilePath()
- const backupPath = `${settingsPath}.${Date.now()}.bak`
+ const backupDirectory = getSettingsBackupDir()
+ const timestamp = new Date().toISOString().replace(/[:.]/g, '-')
+ fs.mkdirSync(backupDirectory, { recursive: true })
if (fs.existsSync(settingsPath)) {
- fs.copyFileSync(settingsPath, backupPath)
+ fs.copyFileSync(settingsPath, join(backupDirectory, `settings.${timestamp}.yaml`))
+ }
+
+ const temporaryPath = join(getConfigBaseDir(), `.settings.${process.pid}.${Date.now()}.tmp`)
+ try {
+ fs.writeFileSync(temporaryPath, serialized, { encoding: 'utf-8', mode: 0o600 })
+ fs.renameSync(temporaryPath, settingsPath)
+ } finally {
+ if (fs.existsSync(temporaryPath)) {
+ fs.rmSync(temporaryPath, { force: true })
+ }
+ }
+}
+
+export const appendSettingsAuditLog = (entry: Record): void => {
+ ensureSettingsExists()
+ fs.appendFileSync(
+ getSettingsAuditLogPath(),
+ `${JSON.stringify({ timestamp: new Date().toISOString(), ...entry })}\n`,
+ { encoding: 'utf-8', mode: 0o600 },
+ )
+}
+
+export type SettingsBackupInfo = {
+ filename: string
+ createdAt: string
+ sizeBytes: number
+}
+
+const isSafeBackupFilename = (filename: string): boolean => {
+ return /^settings\.\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z\.yaml$/.test(filename)
+}
+
+export const listSettingsBackups = (): SettingsBackupInfo[] => {
+ const backupDirectory = getSettingsBackupDir()
+ if (!fs.existsSync(backupDirectory)) {
+ return []
+ }
+
+ return fs
+ .readdirSync(backupDirectory)
+ .filter((filename) => isSafeBackupFilename(filename))
+ .map((filename) => {
+ const stats = fs.statSync(join(backupDirectory, filename))
+ return {
+ filename,
+ createdAt: stats.mtime.toISOString(),
+ sizeBytes: stats.size,
+ }
+ })
+ .sort((left, right) => right.createdAt.localeCompare(left.createdAt))
+}
+
+export const restoreSettingsBackup = (filename: string): Settings => {
+ if (!isSafeBackupFilename(filename)) {
+ throw new Error('Invalid backup filename')
+ }
+
+ const backupPath = join(getSettingsBackupDir(), filename)
+ if (!fs.existsSync(backupPath)) {
+ throw new Error('Backup not found')
+ }
+
+ const restored = yaml.load(fs.readFileSync(backupPath, 'utf-8')) as Settings
+ const issues = validateSettings(mergeDeepRight(loadDefaults(), restored) as Settings)
+ if (issues.length > 0) {
+ throw new Error(`Backup failed validation: ${issues.map((issue) => issue.path).join(', ')}`)
}
- const tempPath = `${settingsPath}.${Date.now()}.tmp`
- fs.writeFileSync(tempPath, serialized, 'utf-8')
- fs.renameSync(tempPath, settingsPath)
+ saveSettings(restored)
+ return restored
}
export const getTopLevelSettingCategories = (): string[] => {
diff --git a/src/utils/settings-guided-schema.ts b/src/utils/settings-guided-schema.ts
index 9a7bef44..d3279d64 100644
--- a/src/utils/settings-guided-schema.ts
+++ b/src/utils/settings-guided-schema.ts
@@ -36,6 +36,44 @@ export const requireSafeNonNegativeIntegerSettingValue = (value: string): string
}
export const guidedSettingCategories: GuidedSettingCategory[] = [
+ {
+ value: 'relay-info',
+ label: 'Relay Info',
+ settings: [
+ {
+ label: 'Relay URL',
+ path: 'info.relay_url',
+ type: 'string',
+ placeholder: 'wss://relay.example.com',
+ validate: requireNonEmptySettingValue,
+ },
+ {
+ label: 'Relay name',
+ path: 'info.name',
+ type: 'string',
+ placeholder: 'relay.example.com',
+ validate: requireNonEmptySettingValue,
+ },
+ {
+ label: 'Description',
+ path: 'info.description',
+ type: 'string',
+ placeholder: 'A nostr relay written in Typescript.',
+ },
+ {
+ label: 'Contact',
+ path: 'info.contact',
+ type: 'string',
+ placeholder: 'mailto:operator@your-domain.com',
+ },
+ {
+ label: 'Relay pubkey (hex)',
+ path: 'info.pubkey',
+ type: 'string',
+ placeholder: 'replace-with-your-pubkey-in-hex',
+ },
+ ],
+ },
{
value: 'payments',
label: 'Payments',
@@ -64,26 +102,18 @@ export const guidedSettingCategories: GuidedSettingCategory[] = [
value: 'network',
label: 'Network',
settings: [
- {
- label: 'Relay URL',
- path: 'info.relay_url',
- type: 'string',
- placeholder: 'wss://relay.example.com',
- validate: requireNonEmptySettingValue,
- },
- {
- label: 'Relay name',
- path: 'info.name',
- type: 'string',
- placeholder: 'relay.example.com',
- validate: requireNonEmptySettingValue,
- },
{
label: 'Max payload size',
path: 'network.maxPayloadSize',
type: 'number',
validate: requireSafeNonNegativeIntegerSettingValue,
},
+ {
+ label: 'Worker count',
+ path: 'workers.count',
+ type: 'number',
+ validate: requireSafeNonNegativeIntegerSettingValue,
+ },
],
},
{
@@ -97,7 +127,7 @@ export const guidedSettingCategories: GuidedSettingCategory[] = [
options: ['ewma', 'sliding_window'],
},
{
- label: 'Primary event content max length',
+ label: 'Maximum event content length',
path: 'limits.event.content[0].maxLength',
type: 'number',
validate: requireSafeNonNegativeIntegerSettingValue,
@@ -108,6 +138,123 @@ export const guidedSettingCategories: GuidedSettingCategory[] = [
type: 'number',
validate: requireSafeNonNegativeIntegerSettingValue,
},
+ {
+ label: 'Maximum future event time (seconds)',
+ path: 'limits.event.createdAt.maxPositiveDelta',
+ type: 'number',
+ validate: requireSafeNonNegativeIntegerSettingValue,
+ },
+ {
+ label: 'Pubkey blacklist',
+ path: 'limits.event.pubkey.blacklist',
+ type: 'stringArray',
+ placeholder: 'One hex pubkey per line',
+ },
+ {
+ label: 'Kind whitelist',
+ path: 'limits.event.kind.whitelist',
+ type: 'stringArray',
+ placeholder: 'One kind or range per line, e.g. 1 or 10000-19999',
+ },
+ ],
+ },
+ {
+ value: 'client',
+ label: 'Client',
+ settings: [
+ {
+ label: 'Max subscriptions per connection',
+ path: 'limits.client.subscription.maxSubscriptions',
+ type: 'number',
+ validate: requireSafeNonNegativeIntegerSettingValue,
+ },
+ {
+ label: 'Max filters per subscription',
+ path: 'limits.client.subscription.maxFilters',
+ type: 'number',
+ validate: requireSafeNonNegativeIntegerSettingValue,
+ },
+ {
+ label: 'Max filter values',
+ path: 'limits.client.subscription.maxFilterValues',
+ type: 'number',
+ validate: requireSafeNonNegativeIntegerSettingValue,
+ },
+ {
+ label: 'Max REQ limit value',
+ path: 'limits.client.subscription.maxLimit',
+ type: 'number',
+ validate: requireSafeNonNegativeIntegerSettingValue,
+ },
+ ],
+ },
+ {
+ value: 'retention',
+ label: 'Retention',
+ settings: [
+ {
+ label: 'Event retention (days)',
+ path: 'limits.event.retention.maxDays',
+ type: 'number',
+ },
+ ],
+ },
+ {
+ value: 'nip-features',
+ label: 'NIP Features',
+ settings: [
+ {
+ label: 'NIP-05 mode',
+ path: 'nip05.mode',
+ type: 'select',
+ options: ['enabled', 'passive', 'disabled'],
+ },
+ {
+ label: 'NIP-05 domain whitelist',
+ path: 'nip05.domainWhitelist',
+ type: 'stringArray',
+ placeholder: 'One domain per line',
+ },
+ {
+ label: 'NIP-05 domain blacklist',
+ path: 'nip05.domainBlacklist',
+ type: 'stringArray',
+ placeholder: 'One domain per line',
+ },
+ { label: 'Enable NIP-45', path: 'nip45.enabled', type: 'boolean' },
+ { label: 'Enable NIP-50', path: 'nip50.enabled', type: 'boolean' },
+ {
+ label: 'NIP-50 max query length',
+ path: 'nip50.maxQueryLength',
+ type: 'number',
+ validate: requireSafeNonNegativeIntegerSettingValue,
+ },
+ { label: 'Enable Web of Trust', path: 'wot.enabled', type: 'boolean' },
+ {
+ label: 'WoT seed pubkey (hex)',
+ path: 'wot.seedPubkey',
+ type: 'string',
+ placeholder: 'Relay owner pubkey in hex',
+ },
+ {
+ label: 'WoT minimum followers',
+ path: 'wot.minimumFollowers',
+ type: 'number',
+ validate: requireSafeNonNegativeIntegerSettingValue,
+ },
+ ],
+ },
+ {
+ value: 'admin',
+ label: 'Admin',
+ settings: [
+ { label: 'Enable admin console', path: 'admin.enabled', type: 'boolean' },
+ {
+ label: 'Session TTL (seconds)',
+ path: 'admin.sessionTtlSeconds',
+ type: 'number',
+ validate: requireSafeNonNegativeIntegerSettingValue,
+ },
],
},
]
diff --git a/src/utils/settings.ts b/src/utils/settings.ts
index 7cf90f6e..ee639d63 100644
--- a/src/utils/settings.ts
+++ b/src/utils/settings.ts
@@ -110,7 +110,6 @@ export class SettingsStatic {
const basePath = SettingsStatic.getSettingsFileBasePath()
const defaultsFilePath = SettingsStatic.getDefaultSettingsFilePath()
const fileType = SettingsStatic.settingsFileType(basePath)
- const settingsFilePath = join(basePath, `settings.${fileType}`)
const reload = () => {
logger('reloading settings')
@@ -118,6 +117,12 @@ export class SettingsStatic {
SettingsStatic.createSettings()
}
- return [fs.watch(defaultsFilePath, 'utf8', reload), fs.watch(settingsFilePath, 'utf8', reload)]
+ const watchSettingsDirectory = (_eventType: string, filename: string | Buffer | null) => {
+ if (filename?.toString() === `settings.${fileType}`) {
+ reload()
+ }
+ }
+
+ return [fs.watch(defaultsFilePath, 'utf8', reload), fs.watch(basePath, 'utf8', watchSettingsDirectory)]
}
}
diff --git a/test/unit/routes/admin-settings.spec.ts b/test/unit/routes/admin-settings.spec.ts
index 16284dc0..04b95df6 100644
--- a/test/unit/routes/admin-settings.spec.ts
+++ b/test/unit/routes/admin-settings.spec.ts
@@ -10,7 +10,13 @@ import { hashAdminPassword } from '../../../src/utils/admin-password'
import * as adminRateLimitMiddleware from '../../../src/handlers/request-handlers/admin-rate-limit-middleware'
import * as rateLimiterMiddleware from '../../../src/handlers/request-handlers/rate-limiter-middleware'
import * as settingsFactory from '../../../src/factories/settings-factory'
-import { getSettingsFilePath, loadDefaults, saveSettings } from '../../../src/utils/settings-config'
+import {
+ getSettingsAuditLogPath,
+ getSettingsBackupDir,
+ getSettingsFilePath,
+ loadDefaults,
+ saveSettings,
+} from '../../../src/utils/settings-config'
describe('admin settings API', () => {
const originalSecret = process.env.SECRET
@@ -196,13 +202,91 @@ describe('admin settings API', () => {
)
expect(patchResponse.status).to.equal(200)
- expect(patchResponse.data).to.deep.equal({ ok: true, path: 'payments.enabled', value: true })
+ expect(patchResponse.data).to.deep.equal({
+ ok: true,
+ path: 'payments.enabled',
+ value: true,
+ reload: 'restart-required',
+ })
const settingsRaw = fs.readFileSync(getSettingsFilePath(), 'utf-8')
expect(settingsRaw).to.include('payments:')
expect(settingsRaw).to.include('enabled: true')
})
+ it('atomically applies staged changes with a backup and audit entry', async () => {
+ const passwordHash = hashAdminPassword('settings-password')
+ saveSettings({
+ ...loadDefaults(),
+ admin: { enabled: true, passwordHash, sessionTtlSeconds: 3600 },
+ })
+ const baseUrl = await startServer({
+ admin: { enabled: true, passwordHash, sessionTtlSeconds: 3600 },
+ })
+ const cookie = await login(baseUrl)
+
+ const patchResponse = await axios.patch(
+ `${baseUrl}/settings`,
+ {
+ changes: [
+ { path: 'payments.enabled', value: true },
+ { path: 'nip50.enabled', value: true },
+ ],
+ },
+ {
+ headers: { cookie, 'content-type': 'application/json' },
+ validateStatus: () => true,
+ },
+ )
+
+ expect(patchResponse.status, JSON.stringify(patchResponse.data)).to.equal(200)
+ expect(patchResponse.data.changes).to.have.length(2)
+ expect(fs.readdirSync(getSettingsBackupDir()).some((name) => name.startsWith('settings.'))).to.equal(true)
+ expect(fs.readFileSync(getSettingsAuditLogPath(), 'utf-8')).to.include('settings.updated')
+ })
+
+ it('lists and restores the latest settings backup', async () => {
+ const passwordHash = hashAdminPassword('settings-password')
+ saveSettings({
+ ...loadDefaults(),
+ admin: { enabled: true, passwordHash, sessionTtlSeconds: 3600 },
+ payments: { ...loadDefaults().payments, enabled: false },
+ })
+ const baseUrl = await startServer({
+ admin: { enabled: true, passwordHash, sessionTtlSeconds: 3600 },
+ })
+ const cookie = await login(baseUrl)
+
+ await axios.patch(
+ `${baseUrl}/settings`,
+ { path: 'payments.enabled', value: true },
+ {
+ headers: { cookie, 'content-type': 'application/json' },
+ validateStatus: () => true,
+ },
+ )
+
+ const backupsResponse = await axios.get(`${baseUrl}/settings/backups`, {
+ headers: { cookie },
+ validateStatus: () => true,
+ })
+
+ expect(backupsResponse.status).to.equal(200)
+ expect(backupsResponse.data.backups.length).to.be.greaterThan(0)
+
+ const restoreResponse = await axios.post(
+ `${baseUrl}/settings/restore`,
+ { filename: backupsResponse.data.backups[0].filename },
+ {
+ headers: { cookie, 'content-type': 'application/json' },
+ validateStatus: () => true,
+ },
+ )
+
+ expect(restoreResponse.status).to.equal(200)
+ expect(fs.readFileSync(getSettingsAuditLogPath(), 'utf-8')).to.include('settings.restored')
+ })
+
it('rejects invalid paths and write-protected settings', async () => {
const passwordHash = hashAdminPassword('settings-password')
const baseUrl = await startServer({
diff --git a/test/unit/utils/settings-config.spec.ts b/test/unit/utils/settings-config.spec.ts
index 8f4ba1e4..8acaf643 100644
--- a/test/unit/utils/settings-config.spec.ts
+++ b/test/unit/utils/settings-config.spec.ts
@@ -1,12 +1,12 @@
import { expect } from 'chai'
import {
+ toCategoryLabel,
getByPath,
getTopLevelSettingCategories,
parseTypedValue,
parseValue,
setByPath,
- toCategoryLabel,
validatePathAgainstDefaults,
validateSettings,
} from '../../../src/utils/settings-config'