robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ITHC: protect administrative representation unlock endpoint

Browse Source
This commit is contained in:
robbond
2026-10-26 15:27:10 +00:00
parent 0daeb783b9
commit 37aeb03509
5 changed files with 378 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pages/api/admin/editRepJson.js
+126
View File
@@ -0,0 +1,126 @@
import { DefaultAzureCredential } from "@azure/identity";
import { BlobServiceClient } from "@azure/storage-blob";
import { consoleLogger } from "../../../actions/core/logger";
import {
hasTrustedSameOrigin,
readAdminSessionCookie,
setAdminAuthNoStore,
validateAdminSession
} from "../../../lib/admin/adminAuth";
import { respondError, respondSuccess } from "../middleware/apiResponse";
const forbidden = (res) =>
respondError(res, {
status: 403,
code: "FORBIDDEN",
message: "Request not permitted"
});
const isValidContainer = (value) =>
typeof value === "string" &&
value.length >= 3 &&
value.length <= 63 &&
/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
const isValidBlobName = (value) =>
typeof value === "string" &&
value.length > 0 &&
value.length <= 1024 &&
value === value.trim() &&
!/[\\\u0000-\u001f\u007f]/.test(value) &&
value.split("/").every((segment) => segment && segment !== "." && segment !== "..");
export default async function handler(req, res) {
setAdminAuthNoStore(res);
res.setHeader("Allow", "POST");
if (req.method !== "POST") {
return respondError(res, {
status: 405,
code: "METHOD_NOT_ALLOWED",
message: "Method not allowed"
});
}
const adminSession = readAdminSessionCookie(req);
if (
!validateAdminSession(adminSession) ||
!hasTrustedSameOrigin(req)
) {
return forbidden(res);
}
const { container, blobName } = req.body ?? {};
if (!isValidContainer(container) || !isValidBlobName(blobName)) {
return respondError(res, {
status: 400,
code: "INVALID_REQUEST",
message: "Invalid request"
});
}
try {
const accountName = process.env.AZURE_STORAGE_ACCOUNT_NAME;
const creds = new DefaultAzureCredential();
const blobServiceClient = new BlobServiceClient(
`https://${accountName}.blob.core.windows.net`,
creds
);
const containerClient = blobServiceClient.getContainerClient(container);
const blockBlobClient = containerClient.getBlockBlobClient(blobName);
const downloadResponse = await blockBlobClient.download(0);
const downloaded = await streamToString(
downloadResponse.readableStreamBody
);
const json = JSON.parse(downloaded);
if ("repComplete" in json) {
delete json.repComplete;
}
const tags = {
containerid: json.containerID,
caseID: json.ticketnumber,
blobType: "Representation"
};
const updatedContent = JSON.stringify(json, null, 2);
await blockBlobClient.upload(
updatedContent,
Buffer.byteLength(updatedContent),
{
blobHTTPHeaders: { blobContentType: "application/json" }
}
);
await blockBlobClient.setTags(tags);
await blockBlobClient.setMetadata(tags);
return respondSuccess(res, {
message: "repComplete removed successfully"
});
} catch (error) {
consoleLogger(error);
return respondError(res, {
status: 500,
code: "EDIT_REP_JSON_FAILED",
message: "Failed to edit rep.json"
});
}
}
async function streamToString(readableStream) {
return new Promise((resolve, reject) => {
const chunks = [];
readableStream.on("data", (data) => {
chunks.push(data.toString());
});
readableStream.on("end", () => {
resolve(chunks.join(""));
});
readableStream.on("error", reject);
});
}
pages/api/file/editRepJson.js
+5 -92
View File
@@ -1,96 +1,9 @@
import { DefaultAzureCredential } from "@azure/identity";
import { BlobServiceClient } from "@azure/storage-blob";
import { consoleLogger } from "../../../actions/core/logger";
import { respondError, respondSuccess } from "../middleware/apiResponse";
import { respondError } from "../middleware/apiResponse";
export default async function handler(req, res) {
if (req.method !== "POST") {
return respondError(res, {
status: 405,
code: "METHOD_NOT_ALLOWED",
message: "Method not allowed"
});
}
const { container, blobName } = req.body;
if (!container || !blobName) {
return respondError(res, {
status: 400,
code: "MISSING_REQUIRED_BODY",
message: "Missing container or blobName"
});
}
try {
const accountName = process.env.AZURE_STORAGE_ACCOUNT_NAME;
const creds = new DefaultAzureCredential();
const blobServiceClient = new BlobServiceClient(
`https://${accountName}.blob.core.windows.net`,
creds
);
const containerClient = blobServiceClient.getContainerClient(container);
const blockBlobClient = containerClient.getBlockBlobClient(blobName);
// Download blob content
const downloadResponse = await blockBlobClient.download(0);
const downloaded = await streamToString(
downloadResponse.readableStreamBody
);
// Parse JSON
const json = JSON.parse(downloaded);
// Remove repComplete element if it exists
if ("repComplete" in json) {
delete json.repComplete;
}
const tags = {
containerid: json.containerID,
caseID: json.ticketnumber,
blobType: "Representation"
};
// Convert back to string
const updatedContent = JSON.stringify(json, null, 2);
// Upload updated content (overwrite)
await blockBlobClient.upload(
updatedContent,
Buffer.byteLength(updatedContent),
{
blobHTTPHeaders: { blobContentType: "application/json" }
}
);
const withTags = await blockBlobClient.setTags(tags);
const withMeta = await blockBlobClient.setMetadata(tags);
return respondSuccess(res, {
message: "repComplete removed successfully"
});
} catch (error) {
consoleLogger(error);
return respondError(res, {
status: 500,
code: "EDIT_REP_JSON_FAILED",
message: "Failed to edit rep.json"
});
}
}
// Helper function to read stream to string
async function streamToString(readableStream) {
return new Promise((resolve, reject) => {
const chunks = [];
readableStream.on("data", (data) => {
chunks.push(data.toString());
});
readableStream.on("end", () => {
resolve(chunks.join(""));
});
readableStream.on("error", reject);
return respondError(res, {
status: 410,
code: "ENDPOINT_RETIRED",
message: "Endpoint retired"
});
}