From c12387ac947cde677e78fe77d914a904795d404c Mon Sep 17 00:00:00 2001
From: kevin <kevin@yuno.malio.fr>
Date: Wed, 18 Mar 2026 09:00:11 +0100
Subject: [PATCH] fix: t-005 a t-0029 correctif

---
 assets/css/main.css                |  1 -
 components/BackupRun.vue           | 23 +++--------------------
 components/SystemMetricsChart.vue  |  2 +-
 layouts/default.vue                |  1 -
 nuxt.config.ts                     |  6 ++++--
 package-lock.json                  |  8 +++++---
 package.json                       |  6 ++++--
 pages/index.vue                    |  9 ---------
 public/robots.txt                  |  2 +-
 server/api/backups.get.ts          |  4 +---
 server/api/discord/messages.get.ts |  7 ++++---
 server/api/download-latest.get.ts  |  8 +++++---
 server/api/download.get.ts         |  8 +++-----
 server/api/upload.post.ts          |  3 ++-
 server/api/version-status.get.ts   | 10 +++++++++-
 server/utils/ssh.ts                |  6 +++---
 16 files changed, 45 insertions(+), 59 deletions(-)

diff --git a/assets/css/main.css b/assets/css/main.css
index d7aaddf..f0b5e8c 100644
--- a/assets/css/main.css
+++ b/assets/css/main.css
@@ -15,7 +15,6 @@
   --color-m-success: rgb(var(--m-success));
   --color-m-accent: rgb(var(--m-accent));
   --color-m-warning: rgb(var(--m-warning));
-  --color-m-succes: rgb(var(--m-success));
   --font-display: "Outfit", system-ui, sans-serif;
   --font-mono: "JetBrains Mono", "Fira Code", monospace;
 }
diff --git a/components/BackupRun.vue b/components/BackupRun.vue
index 639dce8..6252d7d 100644
--- a/components/BackupRun.vue
+++ b/components/BackupRun.vue
@@ -77,7 +77,6 @@
 </template>
 
 <script setup lang="ts">
-import { computed, onMounted, ref } from "vue"
 import { Icon as IconifyIcon } from "@iconify/vue"
 import { apiFetch } from "~/composables/useApiAuth"
 
@@ -116,7 +115,6 @@ const active = ref<string | null>(null)
 const loading = ref(true)
 const runningKey = ref<string | null>(null)
 const scripts = ref<BackupScript[]>([])
-const output = ref<string>("")
 const message = ref<string>("")
 const isError = ref(false)
 
@@ -125,7 +123,6 @@ const statusClass = computed(() => (isError.value ? "status-error" : "status-suc
 const loadScripts = async () => {
   loading.value = true
   message.value = ""
-  output.value = ""
   isError.value = false
   emit("result", {
     key: null,
@@ -156,7 +153,6 @@ const loadScripts = async () => {
 const runScript = async (key: string) => {
   active.value = key
   runningKey.value = key
-  output.value = ""
   message.value = ""
   isError.value = false
 
@@ -165,30 +161,17 @@ const runScript = async (key: string) => {
       method: "POST",
       body: { key }
     })
+    const resultOutput = data.output || "Aucune sortie retournee."
     message.value = `${data.label} execute avec succes`
-    output.value = data.output || "Aucune sortie retournee."
     emit("result", {
       key: data.key,
       label: data.label,
-      output: output.value,
+      output: resultOutput,
       isError: false,
       downloadFolders: data.downloadFolders || []
     })
   } catch (error: unknown) {
-    isError.value = true
-    const statusMessage =
-      typeof error === "object" &&
-      error !== null &&
-      "data" in error &&
-      typeof error.data === "object" &&
-      error.data !== null &&
-      "statusMessage" in error.data &&
-      typeof error.data.statusMessage === "string"
-        ? error.data.statusMessage
-        : null
-
-    message.value = statusMessage || "Erreur execution script"
-    output.value = ""
+    message.value = (error as any)?.data?.statusMessage || "Erreur execution script"
     emit("result", {
       key,
       label: scripts.value.find((item) => item.key === key)?.label || key,
diff --git a/components/SystemMetricsChart.vue b/components/SystemMetricsChart.vue
index f4e30fe..d51707b 100644
--- a/components/SystemMetricsChart.vue
+++ b/components/SystemMetricsChart.vue
@@ -293,7 +293,7 @@ const visibleHistory = computed(() => {
   return history.value.filter((point) => point.sampledAt >= minTimestamp)
 })
 
-const scaleMax = computed(() => 100)
+const scaleMax = 100
 
 const formatValue = (value: number) => `${Math.round(value)}%`
 
diff --git a/layouts/default.vue b/layouts/default.vue
index 01b8563..9cab07b 100644
--- a/layouts/default.vue
+++ b/layouts/default.vue
@@ -146,7 +146,6 @@
 </template>
 
 <script setup lang="ts">
-import {ref} from "vue"
 import {Icon as IconifyIcon} from "@iconify/vue"
 import logoSrc from '~/assets/LOGO_CARRE_BLANC.png'
 
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 6143248..0f68a34 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -26,7 +26,7 @@ export default defineNuxtConfig({
     head: {
       link: [
         { rel: "preconnect", href: "https://fonts.googleapis.com" },
-        { rel: "preconnect", href: "https://fonts.gstatic.com ", crossorigin: "" },
+        { rel: "preconnect", href: "https://fonts.gstatic.com", crossorigin: "" },
         {
           rel: "stylesheet",
           href: "https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600;700&family=Outfit:wght@300;400;500;600;700;800;900&display=swap"
@@ -36,6 +36,8 @@ export default defineNuxtConfig({
   },
   runtimeConfig: {
     apiSecretKey: process.env.API_SECRET_KEY,
+    discordBotToken: process.env.DISCORD_BOT_TOKEN,
+    discordChannelId: process.env.DISCORD_CHANNEL_ID,
     public: {
       appVersion: getRepoVersion(),
       apiKey: process.env.API_SECRET_KEY
@@ -44,4 +46,4 @@ export default defineNuxtConfig({
   vite: {
     plugins: [tailwindcss()]
   }
-})
\ No newline at end of file
+})
diff --git a/package-lock.json b/package-lock.json
index f064253..d0d255c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,10 +1,10 @@
 {
-  "name": "disk-monitor",
+  "name": "supervisor",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "disk-monitor",
+      "name": "supervisor",
       "hasInstallScript": true,
       "dependencies": {
         "@iconify/vue": "^5.0.0",
@@ -15,11 +15,13 @@
         "@semantic-release/changelog": "^6.0.3",
         "@semantic-release/commit-analyzer": "^13.0.1",
         "@semantic-release/git": "^10.0.1",
-        "@semantic-release/github": "^12.0.6",
         "@semantic-release/release-notes-generator": "^14.1.0",
         "@tailwindcss/vite": "^4.2.1",
         "semantic-release": "^25.0.3",
         "tailwindcss": "^4.2.1"
+      },
+      "engines": {
+        "node": ">=20"
       }
     },
     "node_modules/@actions/core": {
diff --git a/package.json b/package.json
index 6808b03..2207ffa 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,10 @@
 {
-  "name": "disk-monitor",
+  "name": "supervisor",
   "type": "module",
   "private": true,
+  "engines": {
+    "node": ">=20"
+  },
   "scripts": {
     "build": "nuxt build",
     "dev": "nuxt dev",
@@ -20,7 +23,6 @@
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/git": "^10.0.1",
-    "@semantic-release/github": "^12.0.6",
     "@semantic-release/release-notes-generator": "^14.1.0",
     "@tailwindcss/vite": "^4.2.1",
     "semantic-release": "^25.0.3",
diff --git a/pages/index.vue b/pages/index.vue
index 7e4981b..bdff5b8 100644
--- a/pages/index.vue
+++ b/pages/index.vue
@@ -66,7 +66,6 @@
 </template>
 
 <script setup lang="ts">
-import {computed, onMounted, ref} from "vue"
 import { apiFetch } from "~/composables/useApiAuth"
 import type { SystemMetrics } from "~/types/system";
 
@@ -334,14 +333,6 @@ onBeforeUnmount(() => {
     grid-template-columns: 1fr;
   }
 
-  .backup-selector {
-    order: 2;
-  }
-
-  .backup-list-mobile {
-    order: 3;
-  }
-
   .speedtest-card-mobile {
     order: 4;
   }
diff --git a/public/robots.txt b/public/robots.txt
index 0ad279c..c6742d8 100644
--- a/public/robots.txt
+++ b/public/robots.txt
@@ -1,2 +1,2 @@
 User-Agent: *
-Disallow:
+Disallow: /
diff --git a/server/api/backups.get.ts b/server/api/backups.get.ts
index 3e87b28..d4b33e0 100644
--- a/server/api/backups.get.ts
+++ b/server/api/backups.get.ts
@@ -3,12 +3,10 @@ import {
   shellQuote,
   resolveFolderRemoteDir,
   REMOTE_ROOT,
+  isSafeFolder,
 } from "../utils/ssh.ts"
 
-import {process} from "std-env";
-
 const MAX_FILES_PER_FOLDER = Math.max(1, Number(process.env.BACKUPS_MAX_FILES) || 50)
-const isSafeFolder = (value: string) => /^[a-zA-Z0-9._-]+$/.test(value)
 
 
 function isMissingPathError(error: unknown): boolean {
diff --git a/server/api/discord/messages.get.ts b/server/api/discord/messages.get.ts
index 4e67f88..147bd4a 100644
--- a/server/api/discord/messages.get.ts
+++ b/server/api/discord/messages.get.ts
@@ -1,6 +1,7 @@
-export default defineEventHandler(async () => {
-  const token = process.env.DISCORD_BOT_TOKEN
-  const channel = process.env.DISCORD_CHANNEL_ID
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig(event)
+  const token = config.discordBotToken
+  const channel = config.discordChannelId
 
   if (!token || !channel) {
     throw createError({
diff --git a/server/api/download-latest.get.ts b/server/api/download-latest.get.ts
index c2985f7..cba1ca0 100644
--- a/server/api/download-latest.get.ts
+++ b/server/api/download-latest.get.ts
@@ -3,11 +3,10 @@ import {
   shellQuote,
   resolveFolderRemoteDir,
   REMOTE_HOST,
+  isSafeFolder
 } from "../utils/ssh.ts"
 import { spawn } from "node:child_process"
 
-const isSafeFolder = (value: string) => /^[a-zA-Z0-9._-]+$/.test(value)
-
 async function getLatestRemoteFile(remoteDir: string): Promise<string | null> {
   const output = await runSsh(`cd ${shellQuote(remoteDir)} && ls -1A | sort -r | head -n 1`)
   const fileName = output.trim()
@@ -45,6 +44,9 @@ export default defineEventHandler(async (event) => {
     }
 
     const fileName = await getLatestRemoteFile(remoteDir)
+    if (!fileName || !isSafeFolder(fileName)) {
+        continue
+    }
     if (!fileName) {
       continue
     }
@@ -93,6 +95,6 @@ export default defineEventHandler(async (event) => {
       console.error(`Erreur archive SSH (${code}): ${stderr}`)
     }
   })
-
+  event.node.res.on("close", () => child.kill())
   return sendStream(event, child.stdout)
 })
diff --git a/server/api/download.get.ts b/server/api/download.get.ts
index e550752..3df9bf8 100644
--- a/server/api/download.get.ts
+++ b/server/api/download.get.ts
@@ -3,13 +3,11 @@ import {
   shellQuote,
   resolveFolderRemoteDir,
   REMOTE_HOST,
+  isSafeFolder,
+  isSafeFile
 } from "../utils/ssh.ts"
 import { spawn } from "node:child_process"
 
-const isSafeFolder = (value: string) => /^[a-zA-Z0-9._-]+$/.test(value)
-const isSafeFile = (value: string) => /^[a-zA-Z0-9._-]+$/.test(value)
-
-
 function buildContentDisposition(fileName: string) {
   const asciiName = fileName.replace(/[^\x20-\x7E]/g, "_").replace(/["\\]/g, "_")
   return `attachment; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(fileName)}`
@@ -61,6 +59,6 @@ export default defineEventHandler(async (event) => {
       console.error(`Erreur téléchargement SSH (${code}): ${stderr}`)
     }
   })
-
+  event.node.res.on("close", () => child.kill())
   return sendStream(event, child.stdout)
 })
diff --git a/server/api/upload.post.ts b/server/api/upload.post.ts
index f051edc..35ad6cd 100644
--- a/server/api/upload.post.ts
+++ b/server/api/upload.post.ts
@@ -1,9 +1,10 @@
 export default defineEventHandler(async (event) => {
     const req = event.node.req
-
+    const MAX_UPLOAD_BYTES = 100 * 1024 * 1024 // 100MB
     let received = 0
 
     for await (const chunk of req) {
+        if (received > MAX_UPLOAD_BYTES) throw createError({ statusCode: 413, statusMessage: "Fichier trop volumineux" })
         received += chunk.length
     }
 
diff --git a/server/api/version-status.get.ts b/server/api/version-status.get.ts
index a212b8d..5449949 100644
--- a/server/api/version-status.get.ts
+++ b/server/api/version-status.get.ts
@@ -1,12 +1,18 @@
 import targets from "../config/version-status-targets.json"
 
+const REQUEST_TIMEOUT_MS = 5000
+
 export default defineEventHandler(async () => {
   const results = await Promise.all(
     targets.map(async (target) => {
+      const controller = new AbortController()
+      const timeoutId = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS)
+
       try {
         const response = await fetch(target.url, {
           method: "GET",
-          headers: { Accept: "application/json" }
+          headers: { Accept: "application/json" },
+          signal: controller.signal
         })
 
         return {
@@ -25,6 +31,8 @@ export default defineEventHandler(async () => {
           checkedAt: new Date().toISOString(),
           error: error instanceof Error ? error.message : String(error)
         }
+      } finally {
+        clearTimeout(timeoutId)
       }
     })
   )
diff --git a/server/utils/ssh.ts b/server/utils/ssh.ts
index 42cd129..d8c91ca 100644
--- a/server/utils/ssh.ts
+++ b/server/utils/ssh.ts
@@ -1,11 +1,11 @@
 import {execFile} from "node:child_process"
-import {process} from "std-env";
 import folderMap from "#server/config/backup-folders.json";
 
 export const REMOTE_HOST = process.env.BACKUPS_REMOTE_HOST
 export const REMOTE_ROOT = process.env.BACKUPS_REMOTE_ROOT || "/home/malio-b/backups"
 export const FOLDER_MAP = folderMap as Record<string, string>
-
+export const isSafeFolder = (value: string) => /^[a-zA-Z0-9._-]+$/.test(value)
+export const isSafeFile = (value: string) => /^[a-zA-Z0-9._-]+$/.test(value)
 
 export const shellQuote = (value: string) => `'${value.replace(/'/g, `'\\''`)}'`
 
@@ -45,7 +45,7 @@ export async function resolveFolderRemoteDir(folderName: string): Promise<string
         return direct
     }
 
-    const nested = `${REMOTE_ROOT}/bdd_recette/${folderName}`
+    const nested = `${REMOTE_ROOT}/bdd-recette/${folderName}`
     if (await remoteDirExists(nested)) {
         return nested
     }