Uh oh!
There was an error while loading. Please reload this page.
dev: Scam file purge helper - #3629
Open
isTravis wants to merge 7 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new “Scam Files” workflow to the SuperAdmin dashboard to streamline responding to phishing/malware reports targeting assets.pubpub.org, including S3 archive/copy + delete and CDN cache purges (Fastly + Cloudflare), with a status-check endpoint/UI.
Changes:
- Adds a new
scamFilesSuperAdmin tab and React UI for a guided removal workflow + status checks. - Introduces server-side APIs to copy/delete S3 objects and purge Fastly/Cloudflare caches for a single asset URL.
- Extends env/schema + infra envs for Cloudflare cache purge token configuration.
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| utils/superAdmin.ts | Registers new scamFiles tab kind. |
| server/utils/s3.ts | Adds S3 delete/copy helpers and a reported-scams client. |
| server/utils/fastlyPurge.ts | New helper to purge Fastly by URL. |
| server/utils/cloudflareCachePurge.ts | New helper to purge Cloudflare cache by URL list + config check. |
| server/routes/superAdminDashboard.tsx | Adds Scam Files API routes (copy/delete/purge/check) and SSR tab props. |
| server/envSchema.ts | Adds CLOUDFLARE_CACHE_PURGE_API_TOKEN to env validation. |
| infra/.env.local.enc | Adds encrypted Cloudflare cache purge token. |
| infra/.env.enc | Adds encrypted Cloudflare cache purge token. |
| infra/.env.dev.enc | Adds encrypted Cloudflare cache purge token. |
| client/containers/SuperAdminDashboard/tabs.tsx | Registers “Scam Files” tab in client tab map. |
| client/containers/SuperAdminDashboard/ScamFiles/ScamFiles.tsx | New UI for parsing URL, running steps, checking status, and marking spam. |
| client/containers/SuperAdminDashboard/ScamFiles/scamFiles.scss | Styles for the new Scam Files UI. |
| client/containers/SuperAdminDashboard/ScamFiles/index.ts | Barrel export for the new tab component. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+3
to
+16
| export async function purgeByUrl(url: string) { | ||
| const res = await fetch(`https://api.fastly.com/purge/${url}`, { | ||
| method: 'POST', | ||
| headers: { | ||
| 'Fastly-Key': env.FASTLY_PURGE_TOKEN, | ||
| Accept: 'application/json', | ||
| }, | ||
| }); | ||
| const json = await res.json(); | ||
| if (!res.ok) { | ||
| throw new Error(`Fastly purge failed: ${json?.msg || res.statusText}`); | ||
| } | ||
| return json; | ||
| } |
Comment on lines
+192
to
+200
| const copyObjectTo = async (key: string, destBucket: string) => { | ||
| await s3Client.send( | ||
| new CopyObjectCommand({ | ||
| Bucket: destBucket, | ||
| Key: key, | ||
| CopySource: `${bucket}/${key}`, | ||
| }), | ||
| ); | ||
| }; |
Comment on lines
+699
to
+703
| // Keys follow the pattern: c{communityId}/p{pubId}/u{userId}/filename | ||
| // The /p{pubId} segment is optional. | ||
| const parseIdsFromKey = (key: string) => { | ||
| const communityMatch = key.match(/^(?:_testing\/)?c([0-9a-f-]{36})\//i); | ||
| const userMatch = key.match(/\/u([0-9a-f-]{36})\//i); |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Comment on lines
+18
to
+33
| const res = await fetch(`${CF_API_BASE}/zones/${zoneId}/purge_cache`, { | ||
| method: 'POST', | ||
| headers: { | ||
| Authorization: `Bearer ${apiToken}`, | ||
| 'Content-Type': 'application/json', | ||
| }, | ||
| body: JSON.stringify({ files: urls }), | ||
| }); | ||
| const json = await res.json(); | ||
| if (!json.success) { | ||
| const msgs = (json.errors ?? []).map((e: any) => e.message).join('; '); | ||
| throw new Error(`Cloudflare cache purge failed: ${msgs || res.statusText}`); | ||
| } | ||
| return json; | ||
| } |
Uh oh!
There was an error while loading. Please reload this page.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
…/pubpub into tr/purge-helper
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a new Scam Files tab to the superadmin dashboard for handling phishing/malware reports on
assets.pubpub.org. Previously, responding to these reports required manually running S3 commands and CDN purge API calls. This tab provides a guided workflow with status verification at each step.I have only tested this locally, where there aren't the same spam files that are being reported from prod. This will likely need a couple iterations to work out bugs that we'll only find once deployed.
Workflow
hxxps://assets.pubpub[.]org/...are handled automatically)reported-scamsS3 bucket (preserving the key as an archive)assets.pubpub.orgA Check Status button queries each layer independently — S3 via HeadObject (bypasses CDN), and a HEAD request to the CDN URL to inspect
cf-cache-status,x-cache, and other headers — so you can verify the file is fully gone before and after each step.The check also searches User and Community image fields for references to the asset key. If an associated account is found, it displays the current spam status and provides quick Mark Spam / Mark Not Spam buttons (using the existing spamTags API).
New env var required
CLOUDFLARE_CACHE_PURGE_API_TOKEN— a Cloudflare API token with Zone > Cache Purge > Edit permission. The tab warns if this isn't set but doesn't block the other steps.