[Jan0707]

What

Two server-only helpers lived in helpers/, the barrel shared by client and server code. Both move to server/utils/.

• aiSpamFilter: its only caller is server/api/email.post.ts. It moves unchanged, except that ResponseSchema goes to server/utils/schema.ts as SpamFilterResponseSchema. Exported from server/utils/ under its old name, it would have become a server-wide auto-import with a generic name.
• ipProcessing: the shared useDirectus composable received raw IPs and hashed them, loading node:crypto through a dynamic import() so that the client bundle would not break. Now server/api/vote.post.ts hashes once and passes only the hash. createRating stores it as given, and getRecentRatingByIP becomes getRecentRatingByIPHash(podcast, ipHash, since). With static imports, the helper is synchronous.

⚠️ Also fixes a production outage: every vote has failed since 2026-10-20

The preview test returned 500, and the cause was not this PR. Since the cooldown shipped in cd9acca, every vote with an IP has failed, in production too, and none was stored.

• useDirectus talks to the CMS without a token, so the cooldown lookup ran as the public role.
• That role may create ratings, but may not read their ip or target, so the CMS answered 403 FORBIDDEN. The same 403 reproduces with a plain unauthenticated request.
• The lookup runs before the insert, so nothing was saved.
• Vercel's error list stayed empty, because the route catches the error and only logs it.

Fix: getRecentRatingByIPHash and updateRatingVote move to useAuthenticatedDirectus() (the API token). createRating stays on the public client, which may create. Opening the public role instead would expose the IP hashes to anyone.

Tests: the route test now mocks the two clients separately. A single mock stood in for both before, which is how the tests stayed green through the outage. Negative control: with the lookup back on the public client, 4 tests fail. Locally without a token, a vote fails with NUXT_DIRECTUS_API_TOKEN not configured, which shows the token path is taken.

Requires the token's role to have read and update on ratings, including ip and target. Verify on the preview: vote, then vote the opposite way within 10 minutes, and expect exactly one rating with the second direction.

Why the hashes matter, and how they were kept identical

Stored ratings carry these hashes, and the 10-minute vote cooldown matches on them. A changed hash would split the cooldown across the deploy.

• Reference hashes: before the move, 13 inputs were hashed with the old helper (IPv4, IPv6 compressed and full, ::1, ::ffff:, a zone index, whitespace, three invalid inputs). The moved helper produces identical output for all of them.
• Pinned in tests: the new test/ipProcessing.test.ts pins those values. test/vote.route.test.ts now asserts the exact hash passed to the composable, and adds a case for an invalid IP (no cooldown lookup, no ip stored).
• Negative control: changing the truncation by one octet makes both hash-dependent route tests fail.

Verification

• Client bundle: the Vite warnings about node:crypto and node:net being externalized for the browser are gone. The client bundle contains none of the moved code.
• Gates:
  • prettier:check clean. lint 0 errors, 168 warnings (unchanged).
  • test 347/347 (11 new). Ratchet 226. build exit 0.
  • Smoke 18/18. /api/vote and /api/email both load in a production server.

Found along the way, deliberately not fixed

Every IPv4-mapped address (::ffff:a.b.c.d) hashes like ::1, because zeroing the last four IPv6 groups erases the embedded IPv4 address. This is probably not reachable in production: Vercel overwrites x-forwarded-for with the public client IP, and the ::ffff: form only comes from the local remoteAddress fallback. Fixing it changes those hashes, so it stays out of a move that had to keep every hash identical. It is recorded in the plan's backlog.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RE7Gq8fzzVAfBahzvcUqTP

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
programmierbar-website	Ready	Preview	Oct 21, 2026 1:55pm UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T15:56:59.794742Z	13229e2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

The focused refactor preserves hashing behavior, updates affected callers consistently, and has no identified blocking issues.

No open issues 🎉

What changed in this PR

Moves server-only helpers out of the shared client/server barrel and hashes vote IPs in the server route while preserving existing cooldown hashes.

Changes:

• Relocates spam filtering and IP processing to server utilities.
• Updates voting interfaces to accept hashes instead of raw IPs.
• Adds hash regression tests and documents verification and deferred work.

File	Description
nuxt-app/​test/​vote.route.test.ts	Checks exact hashes and invalid-IP handling.
nuxt-app/​test/​ipProcessing.test.ts	Adds hash compatibility regression tests.
nuxt-app/​server/​utils/​schema.ts	Houses the renamed spam-response schema.
nuxt-app/​server/​utils/​ipProcessing.ts	Uses synchronous, server-only Node imports.
nuxt-app/​server/​utils/​index.ts	Exports the relocated helpers.
nuxt-app/​server/​utils/​aiSpamFilter.ts	Uses the centralized response schema.
nuxt-app/​server/​api/​vote.post.ts	Hashes IPs before calling the composable.
nuxt-app/​server/​api/​email.post.ts	Imports spam filtering from server utilities.
nuxt-app/​helpers/​index.ts	Removes server-only exports.
nuxt-app/​composables/​useDirectus.ts	Stores and queries precomputed IP hashes.
docs/​dependency-upgrade-plan.md	Records completion and the deferred mapped-IPv6 issue.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The helper moves and caller updates are consistent, with regression coverage for hash compatibility and no identified blocking issues.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No blocking issues remain in the relocation or authenticated voting flow, and required token permissions are documented.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No blocking issues remain in the helper relocation, hash preservation, or authenticated voting flow.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The manual CMS recovery checklist names a nonexistent permission field and needs correction for reliable reconstruction.

1 open issue

• Use target_collection as the junction discriminator · New

_{Review effort: Balanced}