Skip to content

v1.1.7 — Dual-Mode Auth, Supabase Vault AES-256, API Gateway, Anti-SSRF & Proxy Pool

Choose a tag to compare

View all tags
@Curzyori Curzyori released this 30 Sep 14:10
· 276 commits to main since this release
v1.1.7
a9b3aa0

Release v1.1.7 — Dual-Mode Auth, Supabase Vault AES-256, API Gateway, Anti-SSRF & Proxy Pool

👥 Core Contributors

  • Yuken Velino (@Curzyori) — Lead Developer & Creator
  • M Raffli Aldiansyah (@Seeyaa77) — Core Contributor
  • Verzio (@MyKineID) — Core Contributor

🚀 Key Highlights & Milestones

1. Dual-Mode Authentication & Multi-Tenancy Architecture

  • Standalone / Self-Host Mode: Pengembang yang meng-clone repositori tetap dapat menjalankan backend secara offline dan lokal hanya bermodalkan 1 Master Key (API_KEY) di .env dengan unmetered rate limits tanpa dependensi database eksternal.
  • Cloud Hosted Mode (Muara AI): Mendukung Member Key (muara_live_...) yang terikat pada kredensial mahasiswa terenkripsi kuat (AES-256-GCM) di Supabase Vault.
  • Sub-millisecond Redis Caching: Kredensial vault di-cache in-memory di Redis (TTL 10 menit), memangkas latensi query DB mendekati 0 ms.
  • 3-Tier Credential Resolution: Hirarki dependensi otomatis: Member Vault (request.state) > Manual Developer Headers (X-Elearning-NIM, X-Studentv2-NIM) > Local .env.

2. Unified API Gateway (api.muaraai.com/v1/ubsi-api/*)

  • Rute resmi gateway live di server produksi Tencent Cloud VPS melalui reverse proxy Caddy dan Cloudflare DNS.
  • Konfigurasi ROOT_PATH=/v1/ubsi-api otomatis menyesuaikan dokumentasi Swagger UI (/docs) dan skema OpenAPI tanpa path ganda.

3. Pre-Validation Endpoint (POST /v1/auth/verify)

  • Endpoint verifikasi login real-time ke students.bsi.ac.id dan elearning.bsi.ac.id secara paralel sebelum kredensial disimpan ke dalam vault.
  • Diproteksi khusus Master Key dan rate limit ketat 5 percobaan/menit per-NIM untuk mencegah brute-force dan melindungi IP server dari pemblokiran kampus.

4. Scraper Proxy Manager & Sticky Pool Rotation

  • Mendukung format bare ip:port, ip:port:user:pass, user:pass@ip:port, dan protokol socks5://.
  • Sticky Session per-NIM: Khusus modul SIAKAD & MyBest Elearning, proxy dialokasikan secara deterministik berbasis hash NIM agar sesi login mahasiswa tidak terputus (anti-session hijacking).
  • Rotating Proxy: Modul publik (Berita, Perpus, Repo, Jurnal) otomatis merotasi proxy pool secara acak.

5. Keamanan & Hardening Menyeluruh (Anti-SSRF)

  • Validasi URL webhook dengan memblokir alamat loopback (localhost, 127.0.0.1), link-local metadata cloud (169.254.169.254), dan subnet privat RFC 1918.
  • Seluruh tabel Supabase diproteksi Row Level Security (RLS) dengan subquery (SELECT auth.uid()) dan view security_invoker = true (0 security lints).
  • Master Key diverifikasi konstan waktu (secrets.compare_digest), dan file .env dikunci izin chmod 600.

6. Peningkatan Modul Elearning

  • Auto-solver captcha SVG teks dinamis dengan fallback hitungan matematika.
  • Rekapitulasi nilai tugas & kuis per pertemuan 1 s/d 16 (/v1/elearning/grades dan /courses/{id}/grades).
  • ID kursus deterministik permanen berbasis {kode}:{hari}:{jam}:{ruang} dan dukungan query via kode matkul langsung (101, 104).

🧪 Testing & Verification

  • 126 Unit & Integration Tests Passed (100% offline, 0 failures, 3.49s).
  • TypeScript & Build Check: npx tsc --noEmit 0 errors, Next.js 15 compiled successfully.
  • AST Hygiene: 0 unused imports, 0 dead functions.

📦 Commits & PRs Included

  • PR #13: fix(elearning): support new SVG text captcha on login page
  • PR #14: feat(elearning): add per-meeting grades recap endpoints
  • PR #15: refactor(elearning): clean up JSON responses, fix kelompok_praktek bug, enrich presence headers, and aggregate assignments
  • PR #16: feat(web): redesign landing page to light glassmorphism style
  • PR #17: docs: remove auto-attendance write operations from public roadmap
  • PR #18: docs(readme): compact contributors section into card layout
  • PR #19: fix(elearning): make course id deterministic and allow querying grades by course code
  • PR #20: fix(web): use 92EEFF ocean cyan, 3d glass cards, dark badge pill, and remove loader card
  • PR #21: docs(readme): shorten Muhammad Raffli Aldiansyah to M Raffli Aldiansyah
  • PR #22: chore: ignore /docs/superpowers directory and untrack spec/plan files
  • PR #23: feat(web): add gh icon to star pill, darken 3d pyramid card, and add ubsi api info
  • PR #24: feat(auth): add Dual-Mode authentication, Supabase AES-256 vault, and ROOT_PATH gateway
  • PR #25: fix(security): prevent SSRF and restrict news webhook test endpoint to master key
  • PR #26: fix(deps): support dynamic env overrides and mockable elearning pool client
  • PR #27: docs: update Caddyfile template for api.muaraai.com gateway routing
  • PR #28: feat(auth): add POST /v1/auth/verify credential pre-validation with per-NIM rate limiting
  • PR #29: feat(proxy): add single proxy and rotating proxy pool with auto format normalization
  • PR #30: refactor: remove dead code and eliminate unused imports across backend modules

Full Changelog: v1.1.5...v1.1.7

Assets 2
Loading