harden security, extract shared helpers, add error boundaries

- Sanitize fetch errors in UNIT3D adapter to prevent API token leaks
- Add password max-length (128) validation on setup and login
- Clamp pollIntervalMinutes to 15-1440 range on create and update
- Add input length limits for tracker name, URL, color, and token
- Switch JWT to encrypted (JWE) with A256GCM via EncryptJWT/jwtDecrypt
- Extract shared API route helpers (authenticate, parseTrackerId, parseJsonBody)
- Extract shared formatters and types to reduce duplication
- Add error boundaries for auth-protected and global contexts

Author: jordanlambrecht

.env.example

@@ -1,2 +1,2 @@
 DATABASE_URL=postgresql://postgres:postgres@localhost:5432/tracker_tracker
-SESSION_SECRET=change-this-to-a-random-64-char-string
+SESSION_SECRET=change-this-to-a-random-string-minimum-32-chars

src/app/(auth)/error.tsx

@@ -0,0 +1,48 @@
+"use client"
+// src/app/(auth)/error.tsx
+
+import Link from "next/link"
+import { useEffect } from "react"
+
+export default function AuthError({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string }
+  reset: () => void
+}) {
+  useEffect(() => {
+    console.error(error)
+  }, [error])
+
+  return (
+    <div className="flex min-h-screen items-center justify-center bg-[#0a0e1a] px-4">
+      <div className="w-full max-w-md rounded-lg border border-[rgba(239,68,68,0.2)] bg-[#0f1424] p-8">
+        <p className="mb-1 font-mono text-xs uppercase tracking-widest text-[#ef4444]">
+          Runtime Error
+        </p>
+        <h1 className="mb-4 text-xl font-semibold text-[#e2e8f0]">
+          Something went wrong
+        </h1>
+        <pre className="mb-6 overflow-x-auto rounded border border-[rgba(148,163,184,0.1)] bg-[#080c16] p-3 font-mono text-xs text-[#94a3b8]">
+          {error.message || "An unexpected error occurred."}
+        </pre>
+        <div className="flex gap-3">
+          <button
+            type="button"
+            onClick={reset}
+            className="rounded border border-[rgba(0,212,255,0.3)] bg-[rgba(0,212,255,0.08)] px-4 py-2 text-sm text-[#00d4ff] transition-colors hover:bg-[rgba(0,212,255,0.15)]"
+          >
+            Try Again
+          </button>
+          <Link
+            href="/"
+            className="rounded border border-[rgba(148,163,184,0.15)] px-4 py-2 text-sm text-[#94a3b8] transition-colors hover:text-[#e2e8f0]"
+          >
+            Go Home
+          </Link>
+        </div>
+      </div>
+    </div>
+  )
+}

src/app/(auth)/trackers/[id]/page.tsx

@@ -2,7 +2,7 @@
 
 // src/app/(auth)/trackers/[id]/page.tsx
 //
-// Functions: formatGiB, formatRatio, formatHours, TrackerDetailPage
+// Functions: formatHours, TrackerDetailPage
 
 import { useParams } from "next/navigation"
 import { useCallback, useEffect, useState } from "react"
@@ -11,58 +11,13 @@ import { Badge } from "@/components/ui/Badge"
 import { Button } from "@/components/ui/Button"
 import { Card } from "@/components/ui/Card"
 import { StatCard } from "@/components/ui/StatCard"
-
-interface TrackerLatestStats {
-  ratio: number | null
-  uploadedBytes: string | null
-  downloadedBytes: string | null
-  seedingCount: number | null
-  leechingCount: number | null
-  username: string | null
-  group: string | null
-}
-
-interface Tracker {
-  id: number
-  name: string
-  baseUrl: string
-  platformType: string
-  pollIntervalMinutes: number
-  isActive: boolean
-  lastPolledAt: string | null
-  lastError: string | null
-  color: string
-  latestStats: TrackerLatestStats | null
-}
-
-interface Snapshot {
-  polledAt: string
-  uploadedBytes: string
-  downloadedBytes: string
-  ratio: number | null
-  bufferBytes: string
-  seedbonus: number | null
-  seedingCount: number | null
-  leechingCount: number | null
-  hitAndRuns: number | null
-}
+import { formatBytesFromString, formatRatio } from "@/lib/formatters"
+import type { Snapshot, TrackerSummary } from "@/types/api"
 
 type DayRange = 7 | 30 | 90 | 365
 
 const DAY_RANGES: DayRange[] = [7, 30, 90, 365]
 
-function formatGiB(bytesStr: string | null): string {
-  if (!bytesStr) return "—"
-  const gib = Number(BigInt(bytesStr)) / 1024 ** 3
-  if (gib >= 1024) return `${(gib / 1024).toFixed(2)} TiB`
-  return `${gib.toFixed(2)} GiB`
-}
-
-function formatRatio(ratio: number | null | undefined): string {
-  if (ratio === null || ratio === undefined) return "—"
-  return ratio.toFixed(2)
-}
-
 function formatHours(minutes: number): string {
   if (minutes < 60) return `${minutes}m`
   const hours = minutes / 60
@@ -73,7 +28,7 @@ export default function TrackerDetailPage() {
   const params = useParams()
   const id = params.id as string
 
-  const [tracker, setTracker] = useState<Tracker | null>(null)
+  const [tracker, setTracker] = useState<TrackerSummary | null>(null)
   const [snapshots, setSnapshots] = useState<Snapshot[]>([])
   const [days, setDays] = useState<DayRange>(30)
   const [loading, setLoading] = useState(true)
@@ -88,7 +43,7 @@ export default function TrackerDetailPage() {
       ])
 
       if (trackersRes.ok) {
-        const allTrackers: Tracker[] = await trackersRes.json()
+        const allTrackers: TrackerSummary[] = await trackersRes.json()
         const found = allTrackers.find((t) => t.id === Number(id))
         setTracker(found ?? null)
       }
@@ -211,11 +166,11 @@ export default function TrackerDetailPage() {
       <div className="grid grid-cols-2 gap-4 sm:grid-cols-4">
         <StatCard
           label="Uploaded"
-          value={formatGiB(stats?.uploadedBytes ?? null)}
+          value={formatBytesFromString(stats?.uploadedBytes ?? null)}
         />
         <StatCard
           label="Downloaded"
-          value={formatGiB(stats?.downloadedBytes ?? null)}
+          value={formatBytesFromString(stats?.downloadedBytes ?? null)}
         />
         <StatCard
           label="Ratio"
@@ -232,7 +187,7 @@ export default function TrackerDetailPage() {
         />
         <StatCard
           label="Buffer"
-          value={formatGiB(latestSnapshot?.bufferBytes ?? null)}
+          value={formatBytesFromString(latestSnapshot?.bufferBytes ?? null)}
         />
       </div>
 

src/app/api/auth/login/route.ts

@@ -4,6 +4,7 @@ import { createSession, verifyPassword } from "@/lib/auth"
 import { deriveKey } from "@/lib/crypto"
 import { db } from "@/lib/db"
 import { appSettings } from "@/lib/db/schema"
+import { startScheduler } from "@/lib/scheduler"
 
 export async function POST(request: Request) {
   const [settings] = await db.select().from(appSettings).limit(1)
@@ -19,8 +20,8 @@ export async function POST(request: Request) {
   }
 
   const { password } = body
-  if (!password || typeof password !== "string") {
-    return NextResponse.json({ error: "Password required" }, { status: 400 })
+  if (!password || typeof password !== "string" || password.length > 128) {
+    return NextResponse.json({ error: "Invalid password" }, { status: 400 })
   }
 
   const valid = await verifyPassword(settings.passwordHash, password)
@@ -31,6 +32,7 @@ export async function POST(request: Request) {
   // Derive encryption key and store in session
   const key = await deriveKey(password, settings.encryptionSalt)
   await createSession(key.toString("hex"))
+  startScheduler(key)
 
   return NextResponse.json({ success: true })
 }

src/app/api/auth/logout/route.ts

@@ -1,8 +1,10 @@
 // src/app/api/auth/logout/route.ts
 import { NextResponse } from "next/server"
 import { clearSession } from "@/lib/auth"
+import { stopScheduler } from "@/lib/scheduler"
 
 export async function POST() {
+  stopScheduler()
   await clearSession()
   return NextResponse.json({ success: true })
 }

src/app/api/auth/setup/route.ts

@@ -19,9 +19,9 @@ export async function POST(request: Request) {
   }
 
   const { password } = body
-  if (!password || typeof password !== "string" || password.length < 8) {
+  if (!password || typeof password !== "string" || password.length < 8 || password.length > 128) {
     return NextResponse.json(
-      { error: "Password must be at least 8 characters" },
+      { error: "Password must be between 8 and 128 characters" },
       { status: 400 }
     )
   }

src/app/api/trackers/[id]/poll/route.ts

@@ -1,26 +1,19 @@
 // src/app/api/trackers/[id]/poll/route.ts
 import { NextResponse } from "next/server"
-import { requireAuth } from "@/lib/auth"
+import { authenticate, parseTrackerId } from "@/lib/api-helpers"
 import { pollTracker } from "@/lib/scheduler"
 
 export async function POST(
   _request: Request,
   { params }: { params: Promise<{ id: string }> }
 ) {
-  let session: { encryptionKey: string }
-  try {
-    session = await requireAuth()
-  } catch {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
-  }
+  const auth = await authenticate()
+  if (auth instanceof NextResponse) return auth
 
-  const { id } = await params
-  const trackerId = parseInt(id, 10)
-  if (Number.isNaN(trackerId)) {
-    return NextResponse.json({ error: "Invalid tracker ID" }, { status: 400 })
-  }
+  const trackerId = await parseTrackerId(params)
+  if (trackerId instanceof NextResponse) return trackerId
 
-  const key = Buffer.from(session.encryptionKey, "hex")
+  const key = Buffer.from(auth.encryptionKey, "hex")
 
   try {
     await pollTracker(trackerId, key)

src/app/api/trackers/[id]/roles/route.ts

@@ -1,25 +1,19 @@
 // src/app/api/trackers/[id]/roles/route.ts
 import { desc, eq } from "drizzle-orm"
 import { NextResponse } from "next/server"
-import { requireAuth } from "@/lib/auth"
+import { authenticate, parseJsonBody, parseTrackerId } from "@/lib/api-helpers"
 import { db } from "@/lib/db"
 import { trackerRoles } from "@/lib/db/schema"
 
 export async function GET(
   _request: Request,
   { params }: { params: Promise<{ id: string }> }
 ) {
-  try {
-    await requireAuth()
-  } catch {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
-  }
+  const auth = await authenticate()
+  if (auth instanceof NextResponse) return auth
 
-  const { id } = await params
-  const trackerId = parseInt(id, 10)
-  if (Number.isNaN(trackerId)) {
-    return NextResponse.json({ error: "Invalid tracker ID" }, { status: 400 })
-  }
+  const trackerId = await parseTrackerId(params)
+  if (trackerId instanceof NextResponse) return trackerId
 
   const roles = await db
     .select()
@@ -34,24 +28,14 @@ export async function POST(
   request: Request,
   { params }: { params: Promise<{ id: string }> }
 ) {
-  try {
-    await requireAuth()
-  } catch {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
-  }
+  const auth = await authenticate()
+  if (auth instanceof NextResponse) return auth
 
-  const { id } = await params
-  const trackerId = parseInt(id, 10)
-  if (Number.isNaN(trackerId)) {
-    return NextResponse.json({ error: "Invalid tracker ID" }, { status: 400 })
-  }
+  const trackerId = await parseTrackerId(params)
+  if (trackerId instanceof NextResponse) return trackerId
 
-  let body: Record<string, unknown>
-  try {
-    body = await request.json()
-  } catch {
-    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 })
-  }
+  const body = await parseJsonBody(request)
+  if (body instanceof NextResponse) return body
 
   const { roleName, achievedAt, notes } = body as {
     roleName?: string