ITHC: protect administrative representation unlock endpoint

2026-10-26 15:27:10 +00:00
parent 0daeb783b9
commit 37aeb03509
5 changed files with 378 additions and 98 deletions
@@ -0,0 +1,126 @@
+import { DefaultAzureCredential } from "@azure/identity";
+import { BlobServiceClient } from "@azure/storage-blob";
+import { consoleLogger } from "../../../actions/core/logger";
+import {
+    hasTrustedSameOrigin,
+    readAdminSessionCookie,
+    setAdminAuthNoStore,
+    validateAdminSession
+} from "../../../lib/admin/adminAuth";
+import { respondError, respondSuccess } from "../middleware/apiResponse";
+
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
+const isValidBlobName = (value) =>
+    typeof value === "string" &&
+    value.length > 0 &&
+    value.length <= 1024 &&
+    value === value.trim() &&
+    !/[\\\u0000-\u001f\u007f]/.test(value) &&
+    value.split("/").every((segment) => segment && segment !== "." && segment !== "..");
+
+export default async function handler(req, res) {
+    setAdminAuthNoStore(res);
+    res.setHeader("Allow", "POST");
+
+    if (req.method !== "POST") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Method not allowed"
+        });
+    }
+
+    const adminSession = readAdminSessionCookie(req);
+    if (
+        !validateAdminSession(adminSession) ||
+        !hasTrustedSameOrigin(req)
+    ) {
+        return forbidden(res);
+    }
+
+    const { container, blobName } = req.body ?? {};
+    if (!isValidContainer(container) || !isValidBlobName(blobName)) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    try {
+        const accountName = process.env.AZURE_STORAGE_ACCOUNT_NAME;
+        const creds = new DefaultAzureCredential();
+        const blobServiceClient = new BlobServiceClient(
+            `https://${accountName}.blob.core.windows.net`,
+            creds
+        );
+
+        const containerClient = blobServiceClient.getContainerClient(container);
+        const blockBlobClient = containerClient.getBlockBlobClient(blobName);
+
+        const downloadResponse = await blockBlobClient.download(0);
+        const downloaded = await streamToString(
+            downloadResponse.readableStreamBody
+        );
+        const json = JSON.parse(downloaded);
+
+        if ("repComplete" in json) {
+            delete json.repComplete;
+        }
+
+        const tags = {
+            containerid: json.containerID,
+            caseID: json.ticketnumber,
+            blobType: "Representation"
+        };
+
+        const updatedContent = JSON.stringify(json, null, 2);
+
+        await blockBlobClient.upload(
+            updatedContent,
+            Buffer.byteLength(updatedContent),
+            {
+                blobHTTPHeaders: { blobContentType: "application/json" }
+            }
+        );
+
+        await blockBlobClient.setTags(tags);
+        await blockBlobClient.setMetadata(tags);
+
+        return respondSuccess(res, {
+            message: "repComplete removed successfully"
+        });
+    } catch (error) {
+        consoleLogger(error);
+        return respondError(res, {
+            status: 500,
+            code: "EDIT_REP_JSON_FAILED",
+            message: "Failed to edit rep.json"
+        });
+    }
+}
+
+async function streamToString(readableStream) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        readableStream.on("data", (data) => {
+            chunks.push(data.toString());
+        });
+        readableStream.on("end", () => {
+            resolve(chunks.join(""));
+        });
+        readableStream.on("error", reject);
+    });
+}