Merge pull request #8 from ZeroHost-Code/beta

Beta

Author: ddrayko

.env.example

@@ -17,8 +17,8 @@ DB_NAME=zerohost_dashboard
 PTERO_URL=https://panel.your-domain.com
 PTERO_API_KEY=change_me
 
-# Encryption key for sensitive data — Generate with: openssl rand -hex 32
-ENCRYPTION_KEY=change_me_to_a_random_hex_string
+# Panel database name (for egg variable lookup)
+PANEL_DB_NAME=panel
 
 # Cap CAPTCHA (self-hosted alternative to Turnstile)
 CAP_ENDPOINT=https://cap.zero-host.org/f6c8171b08/

.github/workflows/deploy-beta.yml

@@ -18,9 +18,9 @@ jobs:
           script: |
             cd ${{ secrets.BETA_PATH }}
             cp .env /tmp/beta.env 2>/dev/null; cp port.txt /tmp/beta.port.txt 2>/dev/null
-            git fetch origin
-            git reset --hard origin/beta
-            git checkout -B beta
+            git fetch origin --prune
+            git checkout beta
+            git merge --ff-only origin/beta
             cp /tmp/beta.env .env 2>/dev/null; cp /tmp/beta.port.txt port.txt 2>/dev/null
             grep 'discord.zero-host.org' public/js/app.js || echo "⚠ DISCORD LINK NOT FOUND IN FILE"
             head -20 port.txt 2>/dev/null || echo "⚠ port.txt missing or empty"

.github/workflows/deploy-main.yml

@@ -18,9 +18,9 @@ jobs:
           script: |
             cd ${{ secrets.MAIN_PATH }}
             cp .env /tmp/main.env 2>/dev/null; cp port.txt /tmp/main.port.txt 2>/dev/null
-            git fetch origin
-            git reset --hard origin/main
-            git checkout -B main
+            git fetch origin --prune
+            git checkout main
+            git merge --ff-only origin/main
             cp /tmp/main.env .env 2>/dev/null; cp /tmp/main.port.txt port.txt 2>/dev/null
             npm install
             pm2 restart zerohost-dashboard

admin.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# ZeroHost Dashboard - Admin Account Management
+#
+# Usage:
+#   ./admin.sh create <email> <username> <password>
+#     Create a new admin account
+#
+#   ./admin.sh set-admin <email>
+#     Set an existing user as admin by email
+#
+#   ./admin.sh set-admin-by-username <username>
+#     Set an existing user as admin by username
+#
+#   ./admin.sh list
+#     List all admin users
+#
+#   ./admin.sh remove-admin <email>
+#     Remove admin privileges from a user
+
+cd "$(dirname "$0")"
+node scripts/admin-cli.js "$@"

config/cap.js

@@ -19,17 +19,26 @@ async function fetchWithTimeout(url, options = {}, timeout = 10000) {
   }
 }
 
+function normalizeUrl(base) {
+  return base.endsWith('/') ? base : base + '/';
+}
+
 export async function verifyCap(token) {
   if (!token) return false;
+  const url = `${normalizeUrl(CAP_ENDPOINT)}siteverify`;
   try {
-    const res = await fetchWithTimeout(`${CAP_ENDPOINT}siteverify`, {
+    const res = await fetchWithTimeout(url, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ secret: CAP_SECRET, response: token }),
     });
     const data = await res.json();
+    if (data.success !== true) {
+      console.error('[CAP] Verification failed:', JSON.stringify(data));
+    }
     return data.success === true;
-  } catch {
+  } catch (err) {
+    console.error('[CAP] Service unreachable at', url, ':', err.message);
     return false;
   }
 }

config/db.js

@@ -13,7 +13,9 @@ const pool = mariadb.createPool({
   password: process.env.DB_PASSWORD,
   database: process.env.DB_NAME,
   connectionLimit: 10,
+  connectTimeout: 5000,
   acquireTimeout: 10000,
+  idleTimeout: 30000,
   insertIdAsNumber: true,
 });
 

config/migrate.js

@@ -12,6 +12,7 @@ const tables = {
       { name: 'first_name', def: 'VARCHAR(255)' },
       { name: 'last_name', def: 'VARCHAR(255)' },
       { name: 'password_set', def: 'TINYINT(1) NOT NULL DEFAULT 0' },
+      { name: 'is_admin', def: 'TINYINT(1) NOT NULL DEFAULT 0' },
       { name: 'ptero_client_api_key', def: 'VARCHAR(255) DEFAULT NULL' },
       { name: 'created_at', def: 'TIMESTAMP DEFAULT CURRENT_TIMESTAMP' },
     ],
@@ -24,6 +25,8 @@ const tables = {
       { name: 'created_at', def: 'TIMESTAMP DEFAULT CURRENT_TIMESTAMP' },
       { name: 'expires_at', def: 'TIMESTAMP NOT NULL' },
       { name: 'status', def: "ENUM('active', 'suspended', 'expired') DEFAULT 'active'" },
+      { name: 'suspend_reason', def: 'TEXT DEFAULT NULL' },
+      { name: 'suspended_by', def: "VARCHAR(20) DEFAULT NULL" },
     ],
   },
   user_ips: {
@@ -99,8 +102,10 @@ export async function migrate() {
     try {
       await query(c.sql);
       console.log(`Applied constraint: ${c.name}`);
-    } catch {
-      // Constraint already exists or table missing — safe to ignore
+    } catch (err) {
+      if (process.env.NODE_ENV !== 'production') {
+        console.log(`Skipped constraint ${c.name}: ${err.message}`);
+      }
     }
   }
 }

config/pyrodactyl.js

@@ -1,5 +1,6 @@
 export const PTERO_URL = process.env.PTERO_URL || 'https://panel.zero-host.org';
 export const PTERO_API_KEY = process.env.PTERO_API_KEY || '';
+export const PANEL_DB_NAME = process.env.PANEL_DB_NAME || 'panel';
 
 export const SERVER_LIMITS = {
   memory: 512,

middleware/auth.js

@@ -4,6 +4,8 @@ const JWT_SECRET = process.env.JWT_SECRET;
 
 if (!JWT_SECRET) {
   console.error('Missing JWT_SECRET environment variable');
+} else if (/[\$\(\)]/.test(JWT_SECRET)) {
+  console.error('JWT_SECRET contains unresolved shell expansion characters ($(), backticks). Generate a proper random key (e.g. openssl rand -hex 32) and hardcode it in .env');
 }
 
 export function authenticateToken(req, res, next) {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "zerohost-dashboard",
-  "version": "0.9.9",
+  "version": "1.0.0",
   "private": true,
   "type": "module",
   "scripts": {