From a7d6cf9386ba4b1205dd83a9515ef3b50d2a50fd Mon Sep 17 00:00:00 2001
From: rdbsolutions <rob@rdbsolutions.co.uk>
Date: Mon, 15 Nov 2021 17:07:49 +0000
Subject: [PATCH] hashing function

---
 .env.local                    |  7 +++++--
 pages/api/proxy/[...route].js | 25 +++++++++++++++++++++----
 2 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/.env.local b/.env.local
index c448df58..6d59b112 100644
--- a/.env.local
+++ b/.env.local
@@ -33,6 +33,9 @@ I18N_DOMAIN = "cymru.local"
 GOOGLE_TAG_MANAGER = GTM-T78CBC3
 SHOWLOGIN = "false"
 SHOWREPRESENTATIONS = "false"
-BASIC_AUTH_CREDENTIALS = pinswg:password|pinswg2:password2
+BASIC_AUTH_CREDENTIALS,, = pinswg:password|pinswg2:password2
+
+NEXT_PUBLIC_ISHARESECRETPHRASE = "Secret phrase"
+
+HASHKEY = 028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c
 
-NEXT_PUBLIC_ISHARESECRETPHRASE = "Secret phrase"
\ No newline at end of file
diff --git a/pages/api/proxy/[...route].js b/pages/api/proxy/[...route].js
index dcab89d3..cb18967c 100644
--- a/pages/api/proxy/[...route].js
+++ b/pages/api/proxy/[...route].js
@@ -1,7 +1,7 @@
 import axios from "axios";
 import https from "https";
 import CryptoJS from "crypto-js";
-import { response } from "express";
+import HmacSHA256 from "crypto-js/hmac-sha256";
 
 const PROXY_RELAY_URL =
     "https://" +
@@ -48,16 +48,33 @@ const getSASToken = () => {
     return token;
 };
 
+function hashProxyPath(queryPath) {
+    const wordKey = process.env.HASHKEY;
+    //console.log(CryptoJS.enc.Hex.parse(wordKey));
+    var hashlink = CryptoJS.HmacSHA256(
+        queryPath,
+        CryptoJS.enc.Hex.parse(wordKey)
+    );
+
+    hashlink = hashlink.toString(CryptoJS.enc.Base64);
+
+    console.log("&hash=" + hashlink);
+
+    return queryPath; //+ "&hash=" + hashlink;
+}
+
 export default async function ApiProxy(req, res) {
     //console.log(req.method);
 
     var data = JSON.stringify(req.body);
     const SASToken = getSASToken();
 
+    //console.log("the request", req.query.route, req.url);
+
     var configNoData = {
         method: req.method,
         //url: PROXY_RELAY_URL + updateFormCollection + "(" + incidentId + ")",
-        url: PROXY_RELAY_URL + req.url.split("/api/proxy/")[1],
+        url: PROXY_RELAY_URL + hashProxyPath(req.url.split("/api/proxy/")[1]),
         headers: {
             "OData-MaxVersion": "4.0",
             "OData-Version": "4.0",
@@ -71,7 +88,7 @@ export default async function ApiProxy(req, res) {
 
     var config = {
         method: req.method,
-        url: PROXY_RELAY_URL + req.query.route[0],
+        url: PROXY_RELAY_URL + hashProxyPath(req.query.route[0]),
         headers: {
             "OData-MaxVersion": "4.0",
             "OData-Version": "4.0",
@@ -85,7 +102,7 @@ export default async function ApiProxy(req, res) {
 
     var configDocument = {
         method: req.method,
-        url: PROXY_RELAY_URL + req.url.split("/api/proxy/")[1],
+        url: PROXY_RELAY_URL + hashProxyPath(req.url.split("/api/proxy/")[1]),
         headers: {
             "OData-MaxVersion": "4.0",
             "OData-Version": "4.0",