Added filterable stash pages.

src/web/auth.js

@@ -1,16 +1,42 @@
 /* eslint-disable no-param-reassign */
+import IPCIDR from 'ip-cidr';
+
 import { login, signup } from '../auth.js';
 
+function getIp(req) {
+	const ip = req.headers['x-forwarded-for']?.split(',')[0] || req.connection.remoteAddress; // See src/ws
+
+	const unmappedIp = ip?.includes('.')
+		? ip.slice(ip.lastIndexOf(':') + 1)
+		: ip;
+
+	// ensure IP is in expanded notation for consistency and matching
+	const expandedIp = unmappedIp.includes(':')
+		? new IPCIDR(`${ip}/128`) // IPv6
+		: new IPCIDR(`${ip}/32`); // IPv4
+
+	if (!expandedIp.addressStart?.addressMinusSuffix) {
+		throw new Error(`Could not determine user IP from ${ip}`);
+	}
+
+	return expandedIp.addressStart?.addressMinusSuffix || null;
+}
+
 export async function setUserApi(req, res, next) {
+	const ip = getIp(req);
+
+	req.userIp = ip;
+
 	if (req.session.user) {
 		req.user = req.session.user;
+		req.user.ip = ip;
 	}
 
 	next();
 }
 
 export async function loginApi(req, res) {
-	const user = await login(req.body);
+	const user = await login(req.body, req.userIp);
 
 	req.session.user = user;
 	res.send(user);
@@ -27,7 +53,7 @@ export async function logoutApi(req, res) {
 }
 
 export async function signupApi(req, res) {
-	const user = await signup(req.body);
+	const user = await signup(req.body, req.userIp);
 
 	req.session.user = user;
 	res.send(user);

src/web/scenes.js

@@ -11,6 +11,7 @@ export async function curateScenesQuery(query) {
 		actorIds: [query.actorId, ...(query.actors?.split(',') || []).map((identifier) => parseActorIdentifier(identifier)?.id)].filter(Boolean),
 		tagIds: await getIdsBySlug([query.tagSlug, ...(query.tags?.split(',') || [])], 'tags'),
 		entityId: query.e ? await getIdsBySlug([query.e], 'entities').then(([id]) => id) : query.entityId,
+		stashId: Number(query.stashId),
 	};
 }
 

src/web/server.js

@@ -135,7 +135,14 @@ export default async function initServer() {
 		const pageContextInit = {
 			urlOriginal: req.originalUrl,
 			urlQuery: req.query, // vike's own query does not apply boolean parser
-			user: req.user,
+			user: req.user && {
+				id: req.user.id,
+				username: req.user.username,
+				email: req.user.email,
+				avatar: req.user.avatar,
+				stashes: req.user.stashes,
+				primaryStash: req.user.primaryStash,
+			},
 			env: {
 				maxAggregateSize: config.database.manticore.maxAggregateSize,
 			},

src/web/stashes.js

@@ -53,7 +53,7 @@ export async function unstashActorApi(req, res) {
 }
 
 export async function unstashSceneApi(req, res) {
-	const stashes = await unstashScene(req.params.sceneId, req.params.stashId, req.user);
+	const stashes = await unstashScene(Number(req.params.sceneId), Number(req.params.stashId), req.user);
 
 	res.send(stashes);
 }