robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TASK22017: phase 8 hardening for sensitive hash-guarded APIs

Browse Source
This commit is contained in:
robbond
2026-03-13 11:38:14 +00:00
parent f28b25cc24
commit 52202f4e1c
7 changed files with 347 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pages/api/endpoint/getportallogin_api.js
+22 -29
View File
@@ -18,7 +18,6 @@
import axios from "axios";
import CryptoJS from "crypto-js";
import _ from "lodash";
import { azureHeadersPaged } from "../../../actions/core/headers";
import { consoleLogger } from "../../../actions/core/logger";
import { getToken } from "../../../actions/core/token";
@@ -40,44 +39,38 @@ const hashAPIPath = (queryPath) => {
export default async function ApiProxy(req, res) {
var emailAddress = req.query.emailAddress;
var token = await getToken();
var checkHash = req.query.hash;
if (typeof emailAddress == "undefined" || emailAddress.length === 0) {
return res.status(400).json();
}
var checkquerypath =
"/api/endpoint/getportallogin_api?emailAddress=" + emailAddress;
// console.log("-----", casefolderID);
// console.log("-----", req.query);
// console.log("-----", checkquerypath);
// console.log("-----", hashAPIPath(checkquerypath));
// console.log("-----", checkHash);
// console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
var token = await getToken();
var queryUrl =
"contacts?$filter=emailaddress1 eq '" +
emailAddress +
"' and statuscode eq 1&$count=true&$select=emailaddress1,contactid,yomifullname,firstname,lastname";
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
var apiResponse = _.isEmpty(req.query)
? res.status(400).json()
: typeof emailAddress != "undefined" && emailAddress.length > 0
? axios
.get(
WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
azureHeadersPaged(token.access_token)
)
.then(({ data }) => {
//console.log(data);
res.status(200).json(data);
})
.catch((error) => {
consoleLogger(error);
res.status(400).json(error);
})
: res.status(400).json();
} else {
return res.status(400).json();
}
var apiResponse = axios
.get(
WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
azureHeadersPaged(token.access_token)
)
.then(({ data }) => {
res.status(200).json(data);
})
.catch((error) => {
consoleLogger(error);
res.status(400).json(error);
});
return apiResponse;
}
pages/api/file/createappealcompletemessage_api.js
+17 -35
View File
@@ -1,4 +1,6 @@
import { updateAccount } from "../../../actions/services/accountService";
import { hashAPIPath } from "../../../actions/core/hash";
import { consoleLogger } from "../../../actions/core/logger";
import {
createCaseCompleteMessage,
getProgressBlobs,
@@ -20,16 +22,25 @@ ApiProxy.get(async (req, res) => {
var typeofinvolvement = req.query.inv;
var checkHash = req.query.hash;
console.log("/////Create Case Message:\n", tempCaseRef, "\n//////////////");
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof tempCaseRef === "undefined" ||
tempCaseRef.length === 0
) {
return res.status(400).json();
}
//console.log(hashAPIPath(checkquerypath), checkHash);
//console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
var checkquerypath =
"/api/file/createappealcompletemessage_api?container=" +
containerName +
"&tempcaseref=" +
tempCaseRef;
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
return res.status(400).json();
}
const blobProgress = await getProgressBlobs(
containerName,
tempCaseRef
@@ -49,8 +60,6 @@ ApiProxy.get(async (req, res) => {
delete blobProgress["pinswg_name"];
//http: if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
await createBlob(JSON.stringify(blobProgress), containerName, tempCaseRef)
.then(() => {
//update case.json with lpa ref and description
@@ -90,15 +99,8 @@ ApiProxy.get(async (req, res) => {
"pinswg_typeofinvolvement": 846040001
},
true
).then((data) => {
console.log(
"uopdated account : " +
contactId +
" \nfrom: " +
data.pinswg_typeofinvolvement +
"\nto: " +
typeofinvolvement
);
).catch((error) => {
consoleLogger(error);
});
}
@@ -109,29 +111,9 @@ ApiProxy.get(async (req, res) => {
});
})
.catch((error) => {
console.log(
"///////////////////////\n createCaseCompleteMessage:",
error,
"///////////////////////\n"
);
consoleLogger(error);
return res.status(400).json(error);
});
// await createCaseCompleteMessage(containerName, tempCaseRef)
// .then((data) => {
// console.log(data);
// createBlob(
// JSON.stringify(blobProgress),
// containerName,
// tempCaseRef
// );
// return res.status(200).json(data);
// })
// .catch((error) => {
// console.log(error);
// return res.status(400).json(error);
// });
});
export const config = {
pages/api/file/deleteblobcase.js
+16 -11
View File
@@ -10,25 +10,30 @@ ApiProxy.use(middleware);
ApiProxy.get(async (req, res) => {
var containerName = req.query.container;
var casefolderID = req.query.casefolderID;
var blobName = req.query.blobname;
var checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0
) {
return res.status(400).json();
}
var checkquerypath =
"/api/file/deleteblobcase?container=" +
containerName +
"&casefolderID=" +
casefolderID;
//console.log(hashAPIPath(checkquerypath), checkHash);
//console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
//if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
await deleteBlobCase(containerName, casefolderID).then((data) => {
return res.status(200).json({ data: data });
});
// } else {
// return res.status(400).json();
// }
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
await deleteBlobCase(containerName, casefolderID).then((data) => {
return res.status(200).json({ data: data });
});
} else {
return res.status(400).json();
}
});
export const config = {
pages/api/file/deleteblobrep.js
+19 -12
View File
@@ -1,5 +1,5 @@
import { hashAPIPath } from "../../../actions/core/hash";
import { deleteBlobCase, deleteBlobRep } from "../../../actions/azurestorage";
import { deleteBlobRep } from "../../../actions/azurestorage";
import nextConnect from "next-connect";
import middleware from "../middleware/middleware";
@@ -11,9 +11,19 @@ ApiProxy.get(async (req, res) => {
var containerName = req.query.container;
var casefolderID = req.query.casefolderID;
var repfile = req.query.repfile;
var blobName = req.query.blobname;
var checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
containerName.length === 0 ||
typeof casefolderID === "undefined" ||
casefolderID.length === 0 ||
typeof repfile === "undefined" ||
repfile.length === 0
) {
return res.status(400).json();
}
var checkquerypath =
"/api/file/deleteblobrep?container=" +
containerName +
@@ -24,16 +34,13 @@ ApiProxy.get(async (req, res) => {
casefolderID = casefolderID + "/" + repfile;
//console.log(hashAPIPath(checkquerypath), checkHash);
//console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
//if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
await deleteBlobRep(containerName, casefolderID).then((data) => {
return res.status(200).json({ data: data });
});
// } else {
// return res.status(400).json();
// }
if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
await deleteBlobRep(containerName, casefolderID).then((data) => {
return res.status(200).json({ data: data });
});
} else {
return res.status(400).json();
}
});
export const config = {