ITHC: enforce representation completion ownership and admin access

pages/api/admin/createrepcompletemessage.js

@@ -0,0 +1,82 @@
+import { createRepCompleteMessage } from "../../../actions/azurestorage";
+import { consoleLogger } from "../../../actions/core/logger";
+import {
+    hasTrustedSameOrigin,
+    readAdminSessionCookie,
+    setAdminAuthNoStore,
+    validateAdminSession
+} from "../../../lib/admin/adminAuth";
+import { respondError, respondSuccess } from "../middleware/apiResponse";
+
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
+const isValidPathSegment = (value) =>
+    typeof value === "string" &&
+    value.length > 0 &&
+    value.length <= 255 &&
+    value === value.trim() &&
+    value !== "." &&
+    value !== ".." &&
+    !/[\\/\u0000-\u001f\u007f]/.test(value);
+
+export default async function handler(req, res) {
+    setAdminAuthNoStore(res);
+    res.setHeader("Allow", "POST");
+
+    if (req.method !== "POST") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Method not allowed"
+        });
+    }
+
+    const adminSession = readAdminSessionCookie(req);
+    if (!validateAdminSession(adminSession)) {
+        return forbidden(res);
+    }
+
+    if (!hasTrustedSameOrigin(req)) {
+        return forbidden(res);
+    }
+
+    const { container, tempcaseref, repid } = req.body ?? {};
+    if (
+        !isValidContainer(container) ||
+        !isValidPathSegment(tempcaseref) ||
+        !isValidPathSegment(repid)
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    try {
+        const data = await createRepCompleteMessage(
+            container,
+            tempcaseref,
+            repid
+        );
+        return respondSuccess(res, data);
+    } catch (error) {
+        consoleLogger(error);
+        return respondError(res, {
+            status: 400,
+            code: "CREATE_REP_COMPLETE_MESSAGE_FAILED",
+            message: "Failed to create representation complete message"
+        });
+    }
+}

pages/api/file/createrepcompletemessage_api.js

@@ -1,18 +1,42 @@
-import {
-    getBlobs,
-    createRepCompleteMessage
-} from "../../../actions/azurestorage";
+import { createRepCompleteMessage } from "../../../actions/azurestorage";
 import { hashAPIPath } from "../../../actions/core/hash";
 import { consoleLogger } from "../../../actions/core/logger";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { getSession } from "next-auth/react";
 
-import nextConnect from "next-connect";
-import middleware from "../middleware/middleware";
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
 
-const ApiProxy = nextConnect();
-ApiProxy.use(middleware);
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
+const isValidPathSegment = (value) =>
+    typeof value === "string" &&
+    value.length > 0 &&
+    value.length <= 255 &&
+    value === value.trim() &&
+    value !== "." &&
+    value !== ".." &&
+    !/[\\/\u0000-\u001f\u007f]/.test(value);
+
+export default async function handler(req, res) {
+    res.setHeader("Allow", "GET");
+
+    if (req.method !== "GET") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Method not allowed"
+        });
+    }
 
-ApiProxy.get(async (req, res) => {
     const containerName = req.query.container;
     const tempCaseRef = req.query.tempcaseref;
     const filename = req.query.repid;
@@ -20,13 +44,13 @@ ApiProxy.get(async (req, res) => {
 
     if (
         typeof containerName === "undefined" ||
-        containerName.length === 0 ||
+        containerName === "" ||
         typeof tempCaseRef === "undefined" ||
-        tempCaseRef.length === 0 ||
+        tempCaseRef === "" ||
         typeof filename === "undefined" ||
-        filename.length === 0 ||
+        filename === "" ||
         typeof checkHash === "undefined" ||
-        checkHash.length === 0
+        checkHash === ""
     ) {
         return respondError(res, {
             status: 400,
@@ -35,6 +59,28 @@ ApiProxy.get(async (req, res) => {
         });
     }
 
+    if (
+        !isValidContainer(containerName) ||
+        !isValidPathSegment(tempCaseRef) ||
+        !isValidPathSegment(filename) ||
+        typeof checkHash !== "string"
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    const session = await getSession({ req });
+    if (
+        typeof session?.user?.id !== "string" ||
+        session.user.id.length === 0 ||
+        session.user.id !== containerName
+    ) {
+        return forbidden(res);
+    }
+
     const hashCandidatePaths = [
         "/api/file/createrepcompletemessage_api?container=" +
             containerName +
@@ -77,12 +123,10 @@ ApiProxy.get(async (req, res) => {
             message: "Failed to create representation complete message"
         });
     }
-});
+}
 
 export const config = {
     api: {
         bodyParser: false
     }
 };
-
-export default ApiProxy;