ITHC: enforce representation completion ownership and admin access

2026-10-26 17:11:38 +00:00
parent 034b59a981
commit 8b607d8134
4 changed files with 585 additions and 71 deletions
@@ -0,0 +1,82 @@
+import { createRepCompleteMessage } from "../../../actions/azurestorage";
+import { consoleLogger } from "../../../actions/core/logger";
+import {
+    hasTrustedSameOrigin,
+    readAdminSessionCookie,
+    setAdminAuthNoStore,
+    validateAdminSession
+} from "../../../lib/admin/adminAuth";
+import { respondError, respondSuccess } from "../middleware/apiResponse";
+
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
+const isValidPathSegment = (value) =>
+    typeof value === "string" &&
+    value.length > 0 &&
+    value.length <= 255 &&
+    value === value.trim() &&
+    value !== "." &&
+    value !== ".." &&
+    !/[\\/\u0000-\u001f\u007f]/.test(value);
+
+export default async function handler(req, res) {
+    setAdminAuthNoStore(res);
+    res.setHeader("Allow", "POST");
+
+    if (req.method !== "POST") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Method not allowed"
+        });
+    }
+
+    const adminSession = readAdminSessionCookie(req);
+    if (!validateAdminSession(adminSession)) {
+        return forbidden(res);
+    }
+
+    if (!hasTrustedSameOrigin(req)) {
+        return forbidden(res);
+    }
+
+    const { container, tempcaseref, repid } = req.body ?? {};
+    if (
+        !isValidContainer(container) ||
+        !isValidPathSegment(tempcaseref) ||
+        !isValidPathSegment(repid)
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    try {
+        const data = await createRepCompleteMessage(
+            container,
+            tempcaseref,
+            repid
+        );
+        return respondSuccess(res, data);
+    } catch (error) {
+        consoleLogger(error);
+        return respondError(res, {
+            status: 400,
+            code: "CREATE_REP_COMPLETE_MESSAGE_FAILED",
+            message: "Failed to create representation complete message"
+        });
+    }
+}