add timeouts

server/config/federation.js

@@ -35,8 +35,9 @@ if (FEDERATION_DOMAIN) {
     publicKeyPem = crypto.createPublicKey(currentPrivateKey).export({ type: 'spki', format: 'pem' });
 }
 
-// Instance discovery cache (domain → { baseUrl, publicKey })
+// Instance discovery cache (domain → { baseUrl, publicKey, cachedAt })
 const discoveryCache = new Map();
+const DISCOVERY_TTL_MS = 5 * 60 * 1000; // 5 minutes
 
 /**
  * Get this instance's federation domain.
@@ -101,19 +102,20 @@ export function verifyPayload(payload, signature, remotePublicKeyPem) {
  * @returns {Promise<{ baseUrl: string, publicKey: string }>}
  */
 export async function discoverInstance(domain) {
-    if (discoveryCache.has(domain)) {
-        return discoveryCache.get(domain);
+    const cached = discoveryCache.get(domain);
+    if (cached && (Date.now() - cached.cachedAt) < DISCOVERY_TTL_MS) {
+        return cached;
     }
 
     const wellKnownUrl = `https://${domain}/.well-known/redlight`;
+    const TIMEOUT_MS = 10_000; // 10 seconds
     try {
-        // Since we test locally, allow http fallback if the request fails (optional but good for testing)
         let response;
         try {
-            response = await fetch(wellKnownUrl);
+            response = await fetch(wellKnownUrl, { signal: AbortSignal.timeout(TIMEOUT_MS) });
         } catch (e) {
             if (e.message.includes('fetch') && wellKnownUrl.startsWith('https://localhost')) {
-                response = await fetch(`http://${domain}/.well-known/redlight`);
+                response = await fetch(`http://${domain}/.well-known/redlight`, { signal: AbortSignal.timeout(TIMEOUT_MS) });
             } else throw e;
         }
 
@@ -127,17 +129,17 @@ export async function discoverInstance(domain) {
         }
 
         const baseUrl = `https://${domain}${data.federation_api || '/api/federation'}`;
-        // Optionally handle local testing gracefully for baseUrl
         const result = {
             baseUrl: baseUrl.replace('https://localhost', 'http://localhost'),
-            publicKey: data.public_key
+            publicKey: data.public_key,
+            cachedAt: Date.now(),
         };
 
         discoveryCache.set(domain, result);
         return result;
     } catch (error) {
         console.error(`Federation discovery failed for ${domain}:`, error.message);
-        throw new Error(`Could not discover Redlight instance at ${domain}`);
+        throw new Error(`Could not discover Redlight instance at ${domain}: ${error.message}`);
     }
 }
 

server/config/mailer.js

@@ -18,6 +18,9 @@ export function initMailer() {
     port,
     secure: port === 465,
     auth: { user, pass },
+    connectionTimeout: 10_000,  // 10 s to establish TCP connection
+    greetingTimeout: 10_000,   // 10 s to receive SMTP greeting
+    socketTimeout: 15_000,     // 15 s of inactivity before abort
   });
 
   console.log('✅ SMTP mailer configured');