98 lines
2.7 KiB
JavaScript
98 lines
2.7 KiB
JavaScript
import { BASE_URL } from "../../../actions/core/env";
|
|
import { getToken } from "../../../actions/core/token";
|
|
import { azureHeaders } from "../../../actions/core/headers";
|
|
import { consoleLogger } from "../../../actions/core/logger";
|
|
import { hashAPIPath } from "../../../actions/core/hash";
|
|
import axios from "axios";
|
|
import {
|
|
ADMIN_SESSION_COOKIE,
|
|
hasTrustedSameOrigin,
|
|
readAdminSessionCookie,
|
|
setAdminAuthNoStore,
|
|
validateAdminSession
|
|
} from "../../../lib/admin/adminAuth";
|
|
import { respondError, respondSuccess } from "../middleware/apiResponse";
|
|
|
|
const isTrustedInternalDestination = () => {
|
|
try {
|
|
return (
|
|
new URL(BASE_URL).origin ===
|
|
new URL(process.env.NEXTAUTH_URL).origin
|
|
);
|
|
} catch {
|
|
return false;
|
|
}
|
|
};
|
|
|
|
const forbidden = (res) =>
|
|
respondError(res, {
|
|
status: 403,
|
|
code: "FORBIDDEN",
|
|
message: "Request not permitted"
|
|
});
|
|
|
|
const isValidContainer = (value) =>
|
|
typeof value === "string" &&
|
|
value.length >= 3 &&
|
|
value.length <= 63 &&
|
|
/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
|
|
|
|
export default async function handler(req, res) {
|
|
setAdminAuthNoStore(res);
|
|
res.setHeader("Allow", "POST");
|
|
|
|
if (req.method !== "POST") {
|
|
return respondError(res, {
|
|
status: 405,
|
|
code: "METHOD_NOT_ALLOWED",
|
|
message: "Method not allowed"
|
|
});
|
|
}
|
|
|
|
const adminSession = readAdminSessionCookie(req);
|
|
if (!validateAdminSession(adminSession) || !hasTrustedSameOrigin(req)) {
|
|
return forbidden(res);
|
|
}
|
|
|
|
const { container } = req.body ?? {};
|
|
if (!isValidContainer(container)) {
|
|
return respondError(res, {
|
|
status: 400,
|
|
code: "INVALID_REQUEST",
|
|
message: "Invalid request"
|
|
});
|
|
}
|
|
|
|
if (!isTrustedInternalDestination()) {
|
|
return forbidden(res);
|
|
}
|
|
|
|
const token = await getToken();
|
|
const queryUrl =
|
|
"/api/file/getrepsblob?container=" + encodeURIComponent(container);
|
|
|
|
try {
|
|
const config = azureHeaders(token.access_token);
|
|
|
|
const { data } = await axios.get(
|
|
BASE_URL + queryUrl + hashAPIPath(queryUrl),
|
|
{
|
|
...config,
|
|
headers: {
|
|
...config.headers,
|
|
Cookie: `${ADMIN_SESSION_COOKIE}=${encodeURIComponent(adminSession)}`
|
|
},
|
|
maxRedirects: 0
|
|
}
|
|
);
|
|
return respondSuccess(res, data);
|
|
} catch (error) {
|
|
consoleLogger(error);
|
|
return respondError(res, {
|
|
status: 400,
|
|
code: "GET_REPS_BLOB_PROXY_FAILED",
|
|
message: "Failed to fetch representation blobs"
|
|
});
|
|
}
|
|
}
|