hotfix: close production bleed-through and dashboard auth gaps

.github/workflows/quality.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - "revival/**"
+      - "hotfix/**"
   pull_request:
 
 permissions:
@@ -41,6 +42,32 @@ jobs:
       - name: Compile Python sources
         run: python -m compileall -q bot.py main.py cogs core cytechlink utils web
 
+  web-syntax:
+    name: JavaScript syntax
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Check browser scripts
+        run: |
+          node --check web/script.js
+          node --check web/settings.js
+          node --check web/security-bootstrap.js
+
+      - name: Check Cloudflare Pages modules
+        run: |
+          node --input-type=module --check < web/functions/_middleware.js
+          node --input-type=module --check < web/functions/api/proxy.js
+          node --input-type=module --check < web/functions/api/gateway.js
+          node --input-type=module --check < web/functions/api/recommended.js
+
   security-audit:
     name: Dependency audit
     runs-on: ubuntu-latest

core/database.py

@@ -1,25 +1,59 @@
 import asyncio
 import time
-from typing import Dict, Any, Optional, Union
+from typing import Dict, Any, Union
 from motor.motor_asyncio import AsyncIOMotorCollection
 
 
+class _RootSafeCollectionProxy:
+    """Delegate collection access while making empty root selectors fail-safe.
+
+    This collection stores both the root config document and standalone user
+    documents. Accidental find_one({}) / update_one({}) calls can otherwise
+    select an arbitrary user document. Empty selectors are rewritten to the
+    resolved root _id.
+    """
+
+    def __init__(self, manager: "DatabaseManager", collection: AsyncIOMotorCollection):
+        self._manager = manager
+        self._collection = collection
+
+    def __getattr__(self, name):
+        return getattr(self._collection, name)
+
+    async def find_one(self, filter=None, *args, **kwargs):
+        if filter == {}:
+            await self._manager._fetch_root()
+            if self._manager._root_id is None:
+                return None
+            filter = {"_id": self._manager._root_id}
+        return await self._collection.find_one(filter, *args, **kwargs)
+
+    async def update_one(self, filter, update, *args, **kwargs):
+        if filter == {}:
+            await self._manager._fetch_root()
+            if self._manager._root_id is None:
+                raise RuntimeError("Refusing update_one({}): root document could not be resolved")
+            filter = {"_id": self._manager._root_id}
+        return await self._collection.update_one(filter, update, *args, **kwargs)
+
+
 class DatabaseManager:
     """
     Centralized Database Manager with In-Memory Caching.
     Reduces the number of redundant MongoDB query calls.
     """
 
     def __init__(self, collection: AsyncIOMotorCollection):
-        self.collection = collection
+        self._raw_collection = collection
         self._cache_data: Dict[str, Any] = {}
         self._last_fetch_time: float = 0
         self._cache_ttl: int = 60  # Cache duration (seconds)
         self._lock = asyncio.Lock()
         self._root_id = None
+        self.collection = _RootSafeCollectionProxy(self, collection)
 
     async def _fetch_root(self, force: bool = False) -> Dict[str, Any]:
-        """Fetch the root document (often empty query `{}`) and cache it."""
+        """Fetch the root document and cache it."""
         current_time = time.time()
         # Return cache if valid
         if (
@@ -39,7 +73,7 @@ async def _fetch_root(self, force: bool = False) -> Dict[str, Any]:
                 return self._cache_data
 
             try:
-                # 🛡️ Protection: Exclude user docs strictly, find the actual root config doc
+                # Protection: Exclude user docs strictly, find the actual root config doc
                 data = await self.collection.find_one(
                     {"user_id": {"$exists": False}, "guilds": {"$exists": True}}
                 )
@@ -102,7 +136,7 @@ async def update_guild(
         set_payload = {f"guilds.{gid}.{k}": v for k, v in update_dict.items()}
 
         try:
-            # 🛡️ Protection: Only update the explicitly cached root document
+            # Protection: Only update the explicitly cached root document
             query = (
                 {"_id": self._root_id}
                 if self._root_id

main.py

@@ -3,6 +3,9 @@
 from discord.ext import commands
 from bot import Cyori
 from utils.config import BOT_TOKEN
+from utils.dashboard_security import make_dashboard_security_middleware
+from utils.runtime_config import make_runtime_config_middleware
+from utils.command_security import install_settings_permission_guard
 
 logging.basicConfig(level=logging.INFO)
 logging.getLogger("discord.http").setLevel(logging.CRITICAL)
@@ -19,11 +22,19 @@ async def get_prefix(bot, message: discord.Message):
 
     return commands.when_mentioned_or(prefix)(bot, message)
 
+class SecuredCyori(Cyori):
+    async def setup_hook(self):
+        await super().setup_hook()
+        install_settings_permission_guard(self)
+        if self.web_app is not None:
+            self.web_app.middlewares.append(make_dashboard_security_middleware(self))
+            self.web_app.middlewares.append(make_runtime_config_middleware(self))
+
 intents = discord.Intents.default()
 intents.members = True
 intents.message_content = True
 
-bot = Cyori(
+bot = SecuredCyori(
     command_prefix=get_prefix,
     activity=discord.Activity(type=discord.ActivityType.listening, name="Starting..."),
     help_command=None,

utils/command_security.py

@@ -0,0 +1,67 @@
+"""Defense-in-depth permission guards for sensitive hybrid settings commands."""
+import discord
+
+
+RESTRICTED_MANAGE_GUILD_COMMANDS = {"djrole", "djmode", "vote_mode"}
+
+
+def _has_manage_guild(member) -> bool:
+    permissions = getattr(member, "guild_permissions", None)
+    return bool(
+        permissions
+        and (permissions.administrator or permissions.manage_guild)
+    )
+
+
+def install_settings_permission_guard(bot) -> None:
+    """Protect both prefix and application-command entry points."""
+
+    async def prefix_settings_check(ctx):
+        command = getattr(ctx, "command", None)
+        if not command or command.qualified_name not in RESTRICTED_MANAGE_GUILD_COMMANDS:
+            return True
+        if ctx.guild and _has_manage_guild(ctx.author):
+            return True
+        try:
+            await ctx.send(
+                "You need Manage Server permission to change this setting.",
+                delete_after=10,
+            )
+        except Exception:
+            pass
+        return False
+
+    bot.add_check(prefix_settings_check)
+
+    previous_interaction_check = bot.tree.interaction_check
+
+    async def secured_interaction_check(interaction: discord.Interaction) -> bool:
+        if previous_interaction_check is not None:
+            allowed = await previous_interaction_check(interaction)
+            if not allowed:
+                return False
+
+        command = getattr(interaction, "command", None)
+        if not command or command.qualified_name not in RESTRICTED_MANAGE_GUILD_COMMANDS:
+            return True
+
+        member = interaction.user
+        if interaction.guild and _has_manage_guild(member):
+            return True
+
+        try:
+            if not interaction.response.is_done():
+                await interaction.response.send_message(
+                    "You need Manage Server permission to change this setting.",
+                    ephemeral=True,
+                )
+            else:
+                await interaction.followup.send(
+                    "You need Manage Server permission to change this setting.",
+                    ephemeral=True,
+                )
+        except Exception:
+            pass
+        return False
+
+    bot.tree.interaction_check = secured_interaction_check