TASK22017: phase 8 hardening for sensitive hash-guarded APIs

pages/api/file/createappealcompletemessage_api.js

@@ -1,4 +1,6 @@
 import { updateAccount } from "../../../actions/services/accountService";
+import { hashAPIPath } from "../../../actions/core/hash";
+import { consoleLogger } from "../../../actions/core/logger";
 import {
     createCaseCompleteMessage,
     getProgressBlobs,
@@ -20,16 +22,25 @@ ApiProxy.get(async (req, res) => {
     var typeofinvolvement = req.query.inv;
     var checkHash = req.query.hash;
 
-    console.log("/////Create Case Message:\n", tempCaseRef, "\n//////////////");
+    if (
+        typeof containerName === "undefined" ||
+        containerName.length === 0 ||
+        typeof tempCaseRef === "undefined" ||
+        tempCaseRef.length === 0
+    ) {
+        return res.status(400).json();
+    }
 
-    //console.log(hashAPIPath(checkquerypath), checkHash);
-    //console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
     var checkquerypath =
         "/api/file/createappealcompletemessage_api?container=" +
         containerName +
         "&tempcaseref=" +
         tempCaseRef;
 
+    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+        return res.status(400).json();
+    }
+
     const blobProgress = await getProgressBlobs(
         containerName,
         tempCaseRef
@@ -49,8 +60,6 @@ ApiProxy.get(async (req, res) => {
 
     delete blobProgress["pinswg_name"];
 
-    //http: if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
-
     await createBlob(JSON.stringify(blobProgress), containerName, tempCaseRef)
         .then(() => {
             //update case.json with lpa ref and description
@@ -90,15 +99,8 @@ ApiProxy.get(async (req, res) => {
                             "pinswg_typeofinvolvement": 846040001
                         },
                         true
-                    ).then((data) => {
-                        console.log(
-                            "uopdated account : " +
-                                contactId +
-                                " \nfrom: " +
-                                data.pinswg_typeofinvolvement +
-                                "\nto: " +
-                                typeofinvolvement
-                        );
+                    ).catch((error) => {
+                        consoleLogger(error);
                     });
                 }
 
@@ -109,29 +111,9 @@ ApiProxy.get(async (req, res) => {
             });
         })
         .catch((error) => {
-            console.log(
-                "///////////////////////\n createCaseCompleteMessage:",
-                error,
-                "///////////////////////\n"
-            );
+            consoleLogger(error);
             return res.status(400).json(error);
         });
-
-    // await createCaseCompleteMessage(containerName, tempCaseRef)
-    //     .then((data) => {
-    //         console.log(data);
-    //         createBlob(
-    //             JSON.stringify(blobProgress),
-    //             containerName,
-    //             tempCaseRef
-    //         );
-    //         return res.status(200).json(data);
-    //     })
-    //     .catch((error) => {
-    //         console.log(error);
-
-    //         return res.status(400).json(error);
-    //     });
 });
 
 export const config = {