Lock the server down before the editor goes public (#427)

The editor is about to be opened to strangers: a post on Reddit and a
guest access (#428). nginx served the whole workspace and ran every PHP
file in it, the API let anybody guess passwords as fast as they liked,
and one account could fill the disk.

- nginx (shared web stack, outside this repo, backup in
  /root/config-backup-20261015/) hands out only the two pages, dist/,
  public/brand/, the uploads by kind and ending, and api/index.php.
  Everything else under /feuerwerk/ is a 404.
- PHP behind it has display_errors off and no X-Powered-By. Plain HTTP
  forwards to HTTPS, the API refuses it.
- Headers: a Content-Security-Policy without inline code or eval,
  nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP.
- vite.config.ts writes the same policy into the built pages, so CI
  runs the whole suite under it. Pixi gets by without eval through
  pixi.js/unsafe-eval. The page CSS left its inline style for a file.
- The harness fails a module for anything the policy refuses, from
  Chrome's log and from the page's securitypolicyviolation event.
- LoginThrottle: five wrong passwords from one address within 15
  minutes, and it gets 429 until 15 minutes after the last of them.
  The address is the last X-Forwarded-For entry, the Brandmauer's own.
- Quota: 1 GB per account for uploads, projects and snapshots. Only a
  write that grows the account is refused (413). Admins have no limit.
- A write whose Sec-Fetch-Site says another site is refused (403).
- The session cookie carries Secure, nginx passes HTTPS on.
- showFailure puts the message in as text, not as HTML.
- Every PHP script outside api/ stops unless it runs on the command
  line.
- The video worker sees the checkout read-only and can only write
  data/videos. No capabilities, 2 GB and 256 processes at most.
- tests/php/rights.test.php runs the API under php -S on a scratch
  directory and asks every route as signed out, owner, stranger and
  admin. A route named in api/index.php but missing in the matrix
  fails it. limits.test.php covers the brake and the quota.

Findings:

- tmp/ was readable from outside, with 79 copies of project files.
  Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10.
  shows only our own requests.
- Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the
  Brandmauer. Left as it is: the web stack is not this project's.
- npm audit finds nothing in what is shipped. Dev tools (vitest,
  brace-expansion, source-map-js) have advisories, not touched here.

Tests: check 313 files / 4843 tests. PHP limits 21, rights 60,
accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no
ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41
197/198, the one red check (a click in 41) passes with 41 alone,
27/27. 67 misses frames at 1080p on stein2 with and without this.
Path list from outside: 10 served, 26 refused. ZAP baseline against
the live site: nothing High or Medium under /feuerwerk/.
Counter-checks: rights.test.php without the cross-site guard, the
quota, the brake, the admin check of users, or with an undocumented
route fails each time. A policy without wasm-unsafe-eval fails e2e 41
with the harness's own CSP line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/core/store/AuthStore.ts

@@ -37,3 +37,11 @@ export class WrongCredentialsError extends Error {
     this.name = 'WrongCredentialsError';
   }
 }
+
+/** Thrown while the server turns sign-ins away after too many wrong ones (#427); says for how long. */
+export class TooManyAttemptsError extends Error {
+  constructor(message = 'Too many failed sign-ins. Try again later') {
+    super(message);
+    this.name = 'TooManyAttemptsError';
+  }
+}

src/core/store/HttpAuthStore.ts

@@ -1,14 +1,24 @@
-import { type AuthStore, roleOf, type SignedIn, WrongCredentialsError } from './AuthStore';
+import {
+  type AuthStore,
+  roleOf,
+  type SignedIn,
+  TooManyAttemptsError,
+  WrongCredentialsError,
+} from './AuthStore';
 import { apiRequest, jsonBody } from './http';
 
 /**
  * A wrong password is the expected answer of a login screen, not a breakdown: it gets its own type
  * so the screen can say one thing about it and another about a server that is down. Changing the
  * password answers the same way when the current one was wrong; a 422 (too short) carries the
- * server's wording and stays generic.
+ * server's wording and stays generic. So does the brake after too many wrong ones (429), which
+ * says how long it lasts.
  */
 function wrongCredentials(status: number, data: unknown): Error | undefined {
-  return status === 401 ? new WrongCredentialsError((data as { error?: string } | null)?.error) : undefined;
+  const message = (data as { error?: string } | null)?.error;
+  if (status === 401) return new WrongCredentialsError(message);
+  if (status === 429) return new TooManyAttemptsError(message);
+  return undefined;
 }
 
 export class HttpAuthStore implements AuthStore {

src/editor/auth/loginRules.ts

@@ -1,3 +1,5 @@
+import { TooManyAttemptsError } from '../../core/store/AuthStore';
+
 /**
  * What a login form may complain about before anything is sent. Kept apart from the screen so it
  * can be read without a browser: the screen only shows what this returns.
@@ -11,6 +13,7 @@ export function loginProblem(username: string, password: string): string | null
 /** The message a failed attempt puts under the form. */
 export function loginError(error: unknown, wrongCredentials: boolean): string {
   if (wrongCredentials) return 'Wrong user name or password';
+  if (error instanceof TooManyAttemptsError) return error.message;
   return `Could not sign in: ${error instanceof Error ? error.message : String(error)}`;
 }
 
@@ -34,5 +37,6 @@ export function passwordProblem(current: string, next: string, repeat: string):
 /** The message a refused change puts under the form. */
 export function passwordError(error: unknown, wrongCredentials: boolean): string {
   if (wrongCredentials) return 'Wrong current password';
+  if (error instanceof TooManyAttemptsError) return error.message;
   return `Could not change the password: ${error instanceof Error ? error.message : String(error)}`;
 }

src/page.ts

@@ -1,4 +1,7 @@
 import { Application, Container } from 'pixi.js';
+// Pixi writes its uniform uploads as generated code; this swaps them for plain ones, so the pages run
+// under a Content-Security-Policy without `unsafe-eval` (#427).
+import 'pixi.js/unsafe-eval';
 import { initPixelGrid, initRenderLoop, initUI, loadEditorFonts, Theme, tieBreakFor, VStack } from './ui';
 import { fixedPageSize, type PageSize, placePage } from './ui/pageSize';
 import { moveOldStoredKeys } from './core/site';
@@ -75,7 +78,11 @@ function pinCanvas(canvas: HTMLCanvasElement, size: PageSize): void {
   window.addEventListener('resize', place);
 }
 
+/** Shows what went wrong as text: a message may carry a project's or a file's name. */
 export function showFailure(error: unknown): void {
   console.error(error);
-  document.body.innerHTML = `<pre style="color:#e0553f;padding:16px;font:13px monospace">${String(error)}</pre>`;
+  const text = document.createElement('pre');
+  text.textContent = String(error);
+  Object.assign(text.style, { color: '#e0553f', padding: '16px', font: '13px monospace' });
+  document.body.replaceChildren(text);
 }