124 lines
3.7 KiB
JavaScript
124 lines
3.7 KiB
JavaScript
/**
|
|
* @swagger
|
|
* /api/endpoint/getportallogin_api:
|
|
* get:
|
|
* tags: [Login]
|
|
* description: Returns portal login
|
|
* summary: Phase 2
|
|
* parameters:
|
|
* - name: emailaddress
|
|
* in: query
|
|
* required: true
|
|
* schema:
|
|
* type: string
|
|
* responses:
|
|
* 200:
|
|
* description: hello world
|
|
*/
|
|
|
|
import { azureHeadersPaged } from "../../../actions/core/headers";
|
|
import { escapeODataString } from "../../../actions/core/guards";
|
|
import { hashAPIPath } from "../../../actions/core/hash";
|
|
import { getServerSession } from "next-auth/next";
|
|
import { authOptions } from "../auth/[...nextauth]";
|
|
import { respondError } from "../middleware/apiResponse";
|
|
import { relayGet } from "../middleware/relayForwarding";
|
|
import { RELAY_POLICY_STRICT_LOGIN } from "../middleware/relayPolicyPresets";
|
|
|
|
const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+$/;
|
|
|
|
export default async function ApiProxy(req, res) {
|
|
if (req.method !== "GET") {
|
|
return respondError(res, {
|
|
status: 405,
|
|
code: "METHOD_NOT_ALLOWED",
|
|
message: "Only GET is supported"
|
|
});
|
|
}
|
|
|
|
const session = await getServerSession(req, res, authOptions(req, res));
|
|
const authenticatedEmail = session?.user?.email;
|
|
|
|
if (
|
|
typeof authenticatedEmail !== "string" ||
|
|
!EMAIL_PATTERN.test(authenticatedEmail.trim())
|
|
) {
|
|
return respondError(res, {
|
|
status: 401,
|
|
code: "UNAUTHENTICATED",
|
|
message: "Authentication required"
|
|
});
|
|
}
|
|
|
|
const emailAddress = req.query.emailAddress;
|
|
const checkHash = req.query.hash;
|
|
|
|
if (
|
|
typeof emailAddress !== "string" ||
|
|
!EMAIL_PATTERN.test(emailAddress.trim())
|
|
) {
|
|
return respondError(res, {
|
|
status: 400,
|
|
code: "INVALID_EMAIL_ADDRESS",
|
|
message: "emailAddress must be a valid email address"
|
|
});
|
|
}
|
|
|
|
const normalizedAuthenticatedEmail = authenticatedEmail.trim().toLowerCase();
|
|
const normalizedRequestedEmail = emailAddress.trim().toLowerCase();
|
|
|
|
if (normalizedRequestedEmail !== normalizedAuthenticatedEmail) {
|
|
return respondError(res, {
|
|
status: 403,
|
|
code: "FORBIDDEN",
|
|
message: "Request not permitted"
|
|
});
|
|
}
|
|
|
|
if (typeof checkHash !== "string" || checkHash.length === 0) {
|
|
return respondError(res, {
|
|
status: 400,
|
|
code: "HASH_REQUIRED",
|
|
message: "hash is required"
|
|
});
|
|
}
|
|
|
|
const checkquerypath =
|
|
"/api/endpoint/getportallogin_api?emailAddress=" + emailAddress;
|
|
const encodedCheckquerypath =
|
|
"/api/endpoint/getportallogin_api?emailAddress=" +
|
|
encodeURIComponent(emailAddress);
|
|
|
|
const expectedHashCandidates = [
|
|
hashAPIPath(checkquerypath),
|
|
hashAPIPath(encodedCheckquerypath)
|
|
];
|
|
|
|
if (!expectedHashCandidates.includes("&hash=" + checkHash)) {
|
|
return respondError(res, {
|
|
status: 400,
|
|
code: "INVALID_HASH",
|
|
message: "Invalid hash"
|
|
});
|
|
}
|
|
|
|
const queryUrl =
|
|
"contacts?$filter=emailaddress1 eq '" +
|
|
escapeODataString(normalizedAuthenticatedEmail) +
|
|
"' and statuscode eq 1&$count=true&$select=pinswg_preferredlanguage,emailaddress1,contactid,yomifullname,firstname,lastname";
|
|
|
|
const relayPolicy = RELAY_POLICY_STRICT_LOGIN;
|
|
|
|
return relayGet({
|
|
queryUrl,
|
|
res,
|
|
requestOptionsBuilder: (accessToken) => azureHeadersPaged(accessToken),
|
|
relayPolicy,
|
|
errorResponse: {
|
|
status: 400,
|
|
code: "PORTAL_LOGIN_FETCH_FAILED",
|
|
message: "Failed to fetch portal login"
|
|
}
|
|
});
|
|
}
|