security: enforce authenticated CRM contact ownership

pages/api/endpoint/getportallogin_api.js

@@ -17,20 +17,61 @@
  */
 
 import { azureHeadersPaged } from "../../../actions/core/headers";
+import { escapeODataString } from "../../../actions/core/guards";
 import { hashAPIPath } from "../../../actions/core/hash";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 import { respondError } from "../middleware/apiResponse";
 import { relayGet } from "../middleware/relayForwarding";
 import { RELAY_POLICY_STRICT_LOGIN } from "../middleware/relayPolicyPresets";
 
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+$/;
+
 export default async function ApiProxy(req, res) {
+    if (req.method !== "GET") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Only GET is supported"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    const authenticatedEmail = session?.user?.email;
+
+    if (
+        typeof authenticatedEmail !== "string" ||
+        !EMAIL_PATTERN.test(authenticatedEmail.trim())
+    ) {
+        return respondError(res, {
+            status: 401,
+            code: "UNAUTHENTICATED",
+            message: "Authentication required"
+        });
+    }
+
     const emailAddress = req.query.emailAddress;
     const checkHash = req.query.hash;
 
-    if (typeof emailAddress !== "string" || emailAddress.trim().length === 0) {
+    if (
+        typeof emailAddress !== "string" ||
+        !EMAIL_PATTERN.test(emailAddress.trim())
+    ) {
         return respondError(res, {
             status: 400,
-            code: "EMAIL_ADDRESS_REQUIRED",
-            message: "emailAddress is required"
+            code: "INVALID_EMAIL_ADDRESS",
+            message: "emailAddress must be a valid email address"
+        });
+    }
+
+    const normalizedAuthenticatedEmail = authenticatedEmail.trim().toLowerCase();
+    const normalizedRequestedEmail = emailAddress.trim().toLowerCase();
+
+    if (normalizedRequestedEmail !== normalizedAuthenticatedEmail) {
+        return respondError(res, {
+            status: 403,
+            code: "FORBIDDEN",
+            message: "Request not permitted"
         });
     }
 
@@ -63,7 +104,7 @@ export default async function ApiProxy(req, res) {
 
     const queryUrl =
         "contacts?$filter=emailaddress1 eq '" +
-        emailAddress +
+        escapeODataString(normalizedAuthenticatedEmail) +
         "' and statuscode eq 1&$count=true&$select=pinswg_preferredlanguage,emailaddress1,contactid,yomifullname,firstname,lastname";
 
     const relayPolicy = RELAY_POLICY_STRICT_LOGIN;