Powered by
ConvertX{" "}
From d4be44c316d22bec30f89b71a72b798770fba587 Mon Sep 17 00:00:00 2001
From: Kosztyk <36381705+Kosztyk@users.noreply.github.com>
Date: Thu, 4 Dec 2025 15:34:55 +0200
Subject: [PATCH 16/34] Add files via upload
---
src/pages/upload.tsx | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/pages/upload.tsx b/src/pages/upload.tsx
index 49b91ffe..1a95a765 100644
--- a/src/pages/upload.tsx
+++ b/src/pages/upload.tsx
@@ -238,3 +238,4 @@ export const upload = new Elysia()
auth: true,
},
);
+
From 3420464d7254dd6c641238efdf84a16204b39785 Mon Sep 17 00:00:00 2001
From: Kosztyk <36381705+Kosztyk@users.noreply.github.com>
Date: Thu, 4 Dec 2025 16:08:48 +0200
Subject: [PATCH 17/34] Add files via upload
---
src/pages/antivirus.tsx | 76 ++++++++++++++++++++++++++++++++++-------
1 file changed, 64 insertions(+), 12 deletions(-)
diff --git a/src/pages/antivirus.tsx b/src/pages/antivirus.tsx
index 8a29eeea..3330d59b 100644
--- a/src/pages/antivirus.tsx
+++ b/src/pages/antivirus.tsx
@@ -8,38 +8,90 @@ import {
setAntivirusEnabled,
} from "../helpers/avToggle";
+/**
+ * Antivirus toggle API
+ *
+ * GET /api/antivirus (auth required)
+ * -> { available: boolean, enabled: boolean }
+ *
+ * POST /api/antivirus (auth required)
+ * body: { enabled: boolean }
+ * -> { available: boolean, enabled: boolean }
+ *
+ * - `available` reflects CLAMAV_URL (via isAntivirusAvailable()).
+ * - `enabled` is the global effective flag used by upload.tsx.
+ */
export const antivirus = new Elysia()
.use(userService)
- // Get current AV status
- .get("/api/antivirus", () => {
- const available = isAntivirusAvailable();
- const enabled = isAntivirusEnabled();
- return { available, enabled };
- })
- // Update AV status
+
+ // Read current antivirus state
+ .get(
+ "/api/antivirus",
+ () => {
+ const available = isAntivirusAvailable();
+ const enabled = isAntivirusEnabled();
+
+ console.log(
+ "[Antivirus API][GET] available:",
+ available,
+ "enabled:",
+ enabled,
+ );
+
+ return { available, enabled };
+ },
+ {
+ // 🔒 Only logged-in users should see global AV state
+ auth: true,
+ },
+ )
+
+ // Update antivirus state (enable/disable)
.post(
"/api/antivirus",
({ body }) => {
- const { enabled } = body;
+ const requested = Boolean(body.enabled);
+ const available = isAntivirusAvailable();
+
+ console.log(
+ "[Antivirus API][POST] requested enabled=",
+ requested,
+ "available=",
+ available,
+ );
- if (!isAntivirusAvailable()) {
- // CLAMAV_URL missing: force disabled and report unavailable
+ // If AV is not available (CLAMAV_URL missing), force disabled
+ if (!available) {
+ console.warn(
+ "[Antivirus API][POST] CLAMAV_URL not configured. Refusing to enable antivirus.",
+ );
return {
available: false,
enabled: false,
};
}
- setAntivirusEnabled(Boolean(enabled));
+ // Persist the new state
+ setAntivirusEnabled(requested);
+
+ const effectiveEnabled = isAntivirusEnabled();
+
+ console.log(
+ "[Antivirus API][POST] effective enabled=",
+ effectiveEnabled,
+ );
return {
available: true,
- enabled: isAntivirusEnabled(),
+ enabled: effectiveEnabled,
};
},
{
body: t.Object({
enabled: t.Boolean(),
}),
+ // 🔒 Only logged-in users can change global AV setting
+ auth: true,
},
);
+
From 8ec2a22d735788d0e0638b8d7ac25375ab8fc8d8 Mon Sep 17 00:00:00 2001
From: Kosztyk <36381705+Kosztyk@users.noreply.github.com>
Date: Thu, 4 Dec 2025 16:13:29 +0200
Subject: [PATCH 18/34] Update package.json
---
package.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/package.json b/package.json
index 64b6538f..c8b3ed97 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "convertx-frontend",
- "version": "0.15.0",
+ "version": "0.16.0",
"scripts": {
"dev": "bun run --watch src/index.tsx",
"hot": "bun run --hot src/index.tsx",
From 55fa5ae813d7c36e9de6adaceb333e1b289e38ab Mon Sep 17 00:00:00 2001
From: Kosztyk <36381705+Kosztyk@users.noreply.github.com>
Date: Thu, 4 Dec 2025 20:58:22 +0200
Subject: [PATCH 19/34] Add files via upload
---
src/db/db.ts | 13 +++++++++++++
src/db/types.ts | 2 ++
2 files changed, 15 insertions(+)
diff --git a/src/db/db.ts b/src/db/db.ts
index de572685..2c4f6f00 100644
--- a/src/db/db.ts
+++ b/src/db/db.ts
@@ -31,12 +31,25 @@ PRAGMA user_version = 1;`);
}
const dbVersion = (db.query("PRAGMA user_version").get() as { user_version?: number }).user_version;
+
+// existing migration: add status column to file_names
if (dbVersion === 0) {
db.exec("ALTER TABLE file_names ADD COLUMN status TEXT DEFAULT 'not started';");
db.exec("PRAGMA user_version = 1;");
console.log("Updated database to version 1.");
}
+/**
+ * Ensure `role` column exists on users table.
+ * This works for both fresh installs and existing DBs, without touching user_version.
+ */
+const userColumns = db.query("PRAGMA table_info(users)").all() as { name: string }[];
+const hasRoleColumn = userColumns.some((col) => col.name === "role");
+if (!hasRoleColumn) {
+ db.exec("ALTER TABLE users ADD COLUMN role TEXT NOT NULL DEFAULT 'user';");
+ console.log("Added 'role' column to users table.");
+}
+
// enable WAL mode
db.exec("PRAGMA journal_mode = WAL;");
diff --git a/src/db/types.ts b/src/db/types.ts
index 48257119..3993b810 100644
--- a/src/db/types.ts
+++ b/src/db/types.ts
@@ -20,4 +20,6 @@ export class User {
id!: number;
email!: string;
password!: string;
+ role!: string; // 'admin' | 'user'
}
+
From 4fd9862dbde6be070351401f30565315148953bd Mon Sep 17 00:00:00 2001
From: Kosztyk <36381705+Kosztyk@users.noreply.github.com>
Date: Thu, 4 Dec 2025 20:58:51 +0200
Subject: [PATCH 20/34] Add files via upload
---
src/pages/root.tsx | 42 ++--
src/pages/user.tsx | 543 +++++++++++++++++++++++++++++++++++++++++++--
2 files changed, 558 insertions(+), 27 deletions(-)
diff --git a/src/pages/root.tsx b/src/pages/root.tsx
index f2a83dec..490dae9b 100644
--- a/src/pages/root.tsx
+++ b/src/pages/root.tsx
@@ -16,6 +16,8 @@ import {
} from "../helpers/env";
import { FIRST_RUN, userService } from "./user";
+type JwtUser = { id: string; role: string } & JWTPayloadSpec;
+
export const root = new Elysia().use(userService).get(
"/",
async ({ jwt, redirect, cookie: { auth, jobId } }) => {
@@ -30,18 +32,23 @@ export const root = new Elysia().use(userService).get(
}
// validate jwt
- let user: ({ id: string } & JWTPayloadSpec) | false = false;
+ let user: JwtUser | null = null;
+
if (ALLOW_UNAUTHENTICATED) {
+ // unauthenticated / guest mode
const newUserId = String(
UNAUTHENTICATED_USER_SHARING
? 0
: randomInt(2 ** 24, Math.min(2 ** 48 + 2 ** 24 - 1, Number.MAX_SAFE_INTEGER)),
);
+
const accessToken = await jwt.sign({
id: newUserId,
+ role: "user",
});
- user = { id: newUserId };
+ user = { id: newUserId, role: "user" } as JwtUser;
+
if (!auth) {
return {
message: "No auth cookie, perhaps your browser is blocking cookies.",
@@ -57,10 +64,14 @@ export const root = new Elysia().use(userService).get(
sameSite: "strict",
});
} else if (auth?.value) {
- user = await jwt.verify(auth.value);
+ const decoded = await jwt.verify(auth.value);
+
+ if (decoded && typeof decoded === "object" && "id" in decoded && "role" in decoded) {
+ user = decoded as JwtUser;
+ }
if (
- user !== false &&
+ user &&
user.id &&
(Number.parseInt(user.id) < 2 ** 24 || !ALLOW_UNAUTHENTICATED)
) {
@@ -82,27 +93,31 @@ export const root = new Elysia().use(userService).get(
// create a new job
db.query("INSERT INTO jobs (user_id, date_created) VALUES (?, ?)").run(
- user.id,
+ Number.parseInt(user.id),
new Date().toISOString(),
);
- const { id } = db
- .query("SELECT id FROM jobs WHERE user_id = ? ORDER BY id DESC")
- .get(user.id) as { id: number };
+ const newJob = db.query("SELECT last_insert_rowid() AS id").get() as { id: number };
if (!jobId) {
return { message: "Cookies should be enabled to use this app." };
}
jobId.set({
- value: id,
+ value: newJob.id.toString(),
httpOnly: true,
secure: !HTTP_ALLOWED,
maxAge: 24 * 60 * 60,
sameSite: "strict",
});
- console.log("jobId set to:", id);
+ console.log("jobId set to:", newJob.id);
+
+ const converters = await getAllTargets();
+
+ const storedJobs = db.query(
+ "SELECT jobs.*, users.email FROM jobs INNER JOIN users ON jobs.user_id = users.id ORDER BY jobs.date_created DESC",
+ ).all() as (User & { date_created: string; num_files: number; status: string })[];
return (
@@ -174,7 +189,7 @@ export const root = new Elysia().use(userService).get(
sm:h-[30vh]
`}
>
- {Object.entries(getAllTargets()).map(([converter, targets]) => (
+ {Object.entries(converters).map(([converter, targets]) => (
{targets.map((target) => (
+
+ {userData.role === "admin" && (
+ <>
+
+
+
+
+
+ {otherUsers.length > 0 && (
+
+
+
+
+ )}
+
+ )}
@@ -461,11 +646,13 @@ export const user = new Elysia()
return redirect(`${WEBROOT}/login`, 302);
}
- const user = await jwt.verify(auth.value);
- if (!user) {
+ const tokenUser = await jwt.verify(auth.value);
+ if (!tokenUser) {
return redirect(`${WEBROOT}/login`, 302);
}
- const existingUser = db.query("SELECT * FROM users WHERE id = ?").as(User).get(user.id);
+ const existingUser = db.query("SELECT * FROM users WHERE id = ?").as(User).get(
+ tokenUser.id,
+ );
if (!existingUser) {
if (auth?.value) {
@@ -483,15 +670,15 @@ export const user = new Elysia()
};
}
- const fields = [];
- const values = [];
+ const fields: string[] = [];
+ const values: any[] = [];
if (body.email) {
- const existingUser = await db
+ const existingUserWithEmail = await db
.query("SELECT id FROM users WHERE email = ?")
.as(User)
.get(body.email);
- if (existingUser && existingUser.id.toString() !== user.id) {
+ if (existingUserWithEmail && existingUserWithEmail.id.toString() !== tokenUser.id) {
set.status = 409;
return { message: "Email already in use." };
}
@@ -506,7 +693,7 @@ export const user = new Elysia()
if (fields.length > 0) {
db.query(
`UPDATE users SET ${fields.map((field) => `${field}=?`).join(", ")} WHERE id=?`,
- ).run(...values, user.id);
+ ).run(...values, tokenUser.id);
}
return redirect(`${WEBROOT}/`, 302);
@@ -519,4 +706,332 @@ export const user = new Elysia()
}),
cookie: "session",
},
+ )
+ .post(
+ "/account/add-user",
+ async ({ body, set, redirect, jwt, cookie: { auth } }) => {
+ if (!auth?.value) {
+ return redirect(`${WEBROOT}/login`, 302);
+ }
+
+ const tokenUser = await jwt.verify(auth.value);
+ if (!tokenUser) {
+ return redirect(`${WEBROOT}/login`, 302);
+ }
+
+ const actingUser = db.query("SELECT * FROM users WHERE id = ?").as(User).get(tokenUser.id);
+
+ if (!actingUser) {
+ if (auth?.value) {
+ auth.remove();
+ }
+ return redirect(`${WEBROOT}/login`, 302);
+ }
+
+ if (actingUser.role !== "admin") {
+ set.status = 403;
+ return {
+ message: "Only admins can create new users.",
+ };
+ }
+
+ const { newUserEmail, newUserPassword, newUserRole } = body as {
+ newUserEmail: string;
+ newUserPassword: string;
+ newUserRole: string;
+ };
+
+ if (!newUserEmail || !newUserPassword) {
+ set.status = 400;
+ return {
+ message: "Missing email or password.",
+ };
+ }
+
+ const existingNewUser = db.query("SELECT id FROM users WHERE email = ?").get(newUserEmail);
+ if (existingNewUser) {
+ set.status = 400;
+ return {
+ message: "A user with this email already exists.",
+ };
+ }
+
+ const hashedPassword = await Bun.password.hash(newUserPassword);
+ const role = newUserRole === "admin" ? "admin" : "user";
+
+ db.query("INSERT INTO users (email, password, role) VALUES (?, ?, ?)").run(
+ newUserEmail,
+ hashedPassword,
+ role,
+ );
+
+ return redirect(`${WEBROOT}/account`, 302);
+ },
+ {
+ body: t.Object({
+ newUserEmail: t.String(),
+ newUserPassword: t.String(),
+ newUserRole: t.String(),
+ }),
+ cookie: "session",
+ },
+ )
+ .get(
+ "/account/edit-user",
+ async ({ query, user, redirect }) => {
+ if (!user) {
+ return redirect(`${WEBROOT}/login`, 302);
+ }
+
+ const actingUser = db.query("SELECT * FROM users WHERE id = ?").as(User).get(user.id);
+ if (!actingUser || actingUser.role !== "admin") {
+ return redirect(`${WEBROOT}/account`, 302);
+ }
+
+ const targetId = Number.parseInt(query.userId, 10);
+ if (!Number.isFinite(targetId) || targetId === actingUser.id) {
+ return redirect(`${WEBROOT}/account`, 302);
+ }
+
+ const targetUser = db.query("SELECT * FROM users WHERE id = ?").as(User).get(targetId);
+ if (!targetUser) {
+ return redirect(`${WEBROOT}/account`, 302);
+ }
+
+ return (
+