Fix client hash signing via authenticated endpoint

pages/api/endpoint/gethash_api.js

@@ -0,0 +1,35 @@
+import { hashAPIPath } from "../../../actions/core/hash";
+import nextConnect from "next-connect";
+import { getSession } from "next-auth/react";
+
+const ApiProxy = nextConnect();
+
+ApiProxy.get(async (req, res) => {
+    const session = await getSession({ req });
+
+    if (!session) {
+        return res.status(401).json();
+    }
+
+    const queryPath = req.query.path;
+    const allowedPrefix = [
+        "/api/file/upload",
+        "/api/file/uploadsinglefile",
+        "/api/file/createrepcompletemessage_api",
+        "/api/file/createappealcompletemessage_api"
+    ];
+
+    if (
+        typeof queryPath !== "string" ||
+        queryPath.length === 0 ||
+        !queryPath.startsWith("/api/") ||
+        !allowedPrefix.some((prefix) => queryPath.startsWith(prefix)) ||
+        queryPath.includes("/api/endpoint/gethash_api")
+    ) {
+        return res.status(400).json();
+    }
+
+    return res.status(200).json({ hash: hashAPIPath(queryPath) });
+});
+
+export default ApiProxy;