124 lines
3.8 KiB
JavaScript
124 lines
3.8 KiB
JavaScript
import { hashAPIPath } from "../../../actions/core/hash";
|
|
import nextConnect from "next-connect";
|
|
import { getServerSession } from "next-auth/next";
|
|
import { authOptions } from "../auth/[...nextauth]";
|
|
import { respondError, respondSuccess } from "../middleware/apiResponse";
|
|
|
|
const ApiProxy = nextConnect();
|
|
|
|
const isValidContainer = (value) =>
|
|
typeof value === "string" &&
|
|
value.length >= 3 &&
|
|
value.length <= 63 &&
|
|
/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
|
|
|
|
const isValidTempCaseRef = (value) =>
|
|
typeof value === "string" &&
|
|
value.length <= 100 &&
|
|
!value.includes("..") &&
|
|
/^[A-Za-z0-9](?:[A-Za-z0-9/-]*[A-Za-z0-9])?$/.test(value);
|
|
|
|
ApiProxy.get(async (req, res) => {
|
|
const session = await getServerSession(req, res, authOptions(req, res));
|
|
|
|
if (!session) {
|
|
return respondError(res, {
|
|
status: 401,
|
|
code: "UNAUTHENTICATED",
|
|
message: "Authentication required"
|
|
});
|
|
}
|
|
|
|
const rawQueryPath = req.query.path;
|
|
|
|
const queryPath =
|
|
typeof rawQueryPath === "string"
|
|
? rawQueryPath.split("?")[0]
|
|
: rawQueryPath;
|
|
|
|
const allowedPrefix = [
|
|
"/api/endpoint/getportallogin_api",
|
|
"/api/endpoint/deletemyrepresentations_api",
|
|
"/api/endpoint/deletewatchedcases_api",
|
|
"/api/file/upload",
|
|
"/api/file/uploadsinglefile",
|
|
"/api/file/deleteblobcase",
|
|
"/api/file/deleteblobrep",
|
|
"/api/file/createrepcompletemessage_api",
|
|
"/api/file/createappealcompletemessage_api",
|
|
"/api/file/generatepdf",
|
|
"/api/file/generateappealpdf"
|
|
];
|
|
|
|
if (
|
|
typeof queryPath !== "string" ||
|
|
queryPath.length === 0 ||
|
|
!queryPath.startsWith("/api/") ||
|
|
!allowedPrefix.some((prefix) => queryPath.startsWith(prefix)) ||
|
|
queryPath.includes("/api/endpoint/gethash_api")
|
|
) {
|
|
return respondError(res, {
|
|
status: 400,
|
|
code: "INVALID_HASH_PATH",
|
|
message: "Invalid path for hash generation"
|
|
});
|
|
}
|
|
|
|
if (
|
|
queryPath.startsWith("/api/file/createappealcompletemessage_api") &&
|
|
queryPath !== "/api/file/createappealcompletemessage_api"
|
|
) {
|
|
return respondError(res, {
|
|
status: 400,
|
|
code: "INVALID_HASH_PATH",
|
|
message: "Invalid path for hash generation"
|
|
});
|
|
}
|
|
|
|
if (queryPath === "/api/file/createappealcompletemessage_api") {
|
|
let completionPath;
|
|
|
|
try {
|
|
completionPath = new URL(rawQueryPath, "http://localhost");
|
|
} catch (_error) {
|
|
return respondError(res, {
|
|
status: 400,
|
|
code: "INVALID_HASH_PATH",
|
|
message: "Invalid path for hash generation"
|
|
});
|
|
}
|
|
|
|
const containerName = completionPath.searchParams.get("container");
|
|
const tempCaseRef = completionPath.searchParams.get("tempcaseref");
|
|
|
|
if (
|
|
!isValidContainer(containerName) ||
|
|
!isValidTempCaseRef(tempCaseRef) ||
|
|
completionPath.searchParams.getAll("container").length !== 1 ||
|
|
completionPath.searchParams.getAll("tempcaseref").length !== 1
|
|
) {
|
|
return respondError(res, {
|
|
status: 400,
|
|
code: "INVALID_HASH_PATH",
|
|
message: "Invalid path for hash generation"
|
|
});
|
|
}
|
|
|
|
if (
|
|
typeof session?.user?.id !== "string" ||
|
|
session.user.id.length === 0 ||
|
|
session.user.id !== containerName
|
|
) {
|
|
return respondError(res, {
|
|
status: 403,
|
|
code: "FORBIDDEN",
|
|
message: "Request not permitted"
|
|
});
|
|
}
|
|
}
|
|
|
|
return respondSuccess(res, { hash: hashAPIPath(rawQueryPath) });
|
|
});
|
|
|
|
export default ApiProxy;
|