From 8a26ace11f833c4f3b8d2b048b70be4c9574eff2 Mon Sep 17 00:00:00 2001 From: stringsplit <77242831+nbitzz@users.noreply.github.com> Date: Tue, 30 Apr 2024 21:25:54 -0700 Subject: [PATCH 1/3] initial commit --- package-lock.json | 11 +++- package.json | 3 +- src/server/lib/files.ts | 56 +++++------------- src/server/lib/middleware.ts | 23 +++----- src/server/lib/schemas/accounts.ts | 21 +++++++ src/server/lib/schemas/files.ts | 18 ++++++ src/server/lib/schemas/index.ts | 2 + src/server/routes/api/v0/authRoutes.ts | 3 +- src/server/routes/api/v0/fileApiRoutes.ts | 4 -- src/server/routes/api/v1/account.ts | 70 ++++------------------- src/server/routes/api/v1/session.ts | 2 +- src/server/{ => tools}/cli.ts | 10 ++-- 12 files changed, 93 insertions(+), 130 deletions(-) create mode 100644 src/server/lib/schemas/accounts.ts create mode 100644 src/server/lib/schemas/files.ts create mode 100644 src/server/lib/schemas/index.ts rename src/server/{ => tools}/cli.ts (92%) diff --git a/package-lock.json b/package-lock.json index c882d2e..c21765a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -26,7 +26,8 @@ "multer": "^1.4.5-lts.1", "node-fetch": "^3.3.2", "nodemailer": "^6.9.3", - "typescript": "^5.2.2" + "typescript": "^5.2.2", + "zod": "^3.23.5" }, "devDependencies": { "@sveltejs/vite-plugin-svelte": "^2.4.6", @@ -1941,6 +1942,14 @@ "engines": { "node": ">=0.4" } + }, + "node_modules/zod": { + "version": "3.23.5", + "resolved": "https://registry.npmjs.org/zod/-/zod-3.23.5.tgz", + "integrity": "sha512-fkwiq0VIQTksNNA131rDOsVJcns0pfVUjHzLrNBiF/O/Xxb5lQyEXkhZWcJ7npWsYlvs+h0jFWXXy4X46Em1JA==", + "funding": { + "url": "https://github.com/sponsors/colinhacks" + } } } } diff --git a/package.json b/package.json index 15f91f9..af8bc38 100644 --- a/package.json +++ b/package.json @@ -35,7 +35,8 @@ "multer": "^1.4.5-lts.1", "node-fetch": "^3.3.2", "nodemailer": "^6.9.3", - "typescript": "^5.2.2" + "typescript": "^5.2.2", + "zod": "^3.23.5" }, "devDependencies": { "@sveltejs/vite-plugin-svelte": "^2.4.6", diff --git a/src/server/lib/files.ts b/src/server/lib/files.ts index 0145e78..92b0d1b 100644 --- a/src/server/lib/files.ts +++ b/src/server/lib/files.ts @@ -8,22 +8,23 @@ import config, { Configuration } from "./config.js" import "dotenv/config" import * as Accounts from "./accounts.js" +import { z } from "zod" +import * as schemas from "./schemas/files.js" -export let id_check_regex = /[A-Za-z0-9_\-\.\!\=\:\&\$\,\+\;\@\~\*\(\)\']+/ export let alphanum = Array.from( "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890" ) // bad solution but whatever -export type FileVisibility = "public" | "anonymous" | "private" +export type FileVisibility = z.infer /** * @description Generates an alphanumeric string, used for files * @param length Length of the ID * @returns a random alphanumeric string */ -export function generateFileId(length: number = 5) { +export function generateFileId(length: number = 5): z.infer { let fid = "" for (let i = 0; i < length; i++) { fid += alphanum[crypto.randomInt(0, alphanum.length)] @@ -31,35 +32,7 @@ export function generateFileId(length: number = 5) { return fid } -/** - * @description Assert multiple conditions... this exists out of pure laziness - * @param conditions - */ - -function multiAssert( - conditions: Map -) { - for (let [cond, err] of conditions.entries()) { - if (cond) return err - } -} - -export type FileUploadSettings = Partial> & - Pick & { uploadId?: string } - -export interface FilePointer { - filename: string - mime: string - messageids: string[] - owner?: string - sizeInBytes?: number - tag?: string - visibility?: FileVisibility - reserved?: boolean - chunkSize?: number - lastModified?: number - md5?: string -} +export type FilePointer = z.infer export interface StatusCodeError { status: number @@ -470,9 +443,9 @@ export class UploadStream extends Writable { sizeInBytes: this.filled, visibility: ogf ? ogf.visibility - : this.owner - ? Accounts.getFromId(this.owner)?.defaultFileVisibility - : undefined, + : this.owner + && Accounts.getFromId(this.owner)?.defaultFileVisibility + || "public", // so that json.stringify doesnt include tag:undefined ...((ogf || {}).tag ? { tag: ogf.tag } : {}), @@ -527,12 +500,11 @@ export class UploadStream extends Writable { return this.destroy( new WebError(400, "duplicate attempt to set upload ID") ) - if ( - !id || - id.match(id_check_regex)?.[0] != id || - id.length > this.files.config.maxUploadIdLength - ) - return this.destroy(new WebError(400, "invalid file ID")) + + let check = schemas.FileId.safeParse(id); + + if (!check.success) + return this.destroy(new WebError(400, check.error.message)) if (this.files.files[id] && this.files.files[id].owner != this.owner) return this.destroy(new WebError(403, "you don't own this file")) @@ -717,4 +689,4 @@ export default class Files { throw err }) } -} +} \ No newline at end of file diff --git a/src/server/lib/middleware.ts b/src/server/lib/middleware.ts index a7a9cba..61e58da 100644 --- a/src/server/lib/middleware.ts +++ b/src/server/lib/middleware.ts @@ -3,6 +3,7 @@ import type { Context, Handler as RequestHandler } from "hono" import ServeError from "../lib/errors.js" import * as auth from "./auth.js" import { setCookie } from "hono/cookie" +import { ZodObject } from "zod" /** * @description Middleware which adds an account, if any, to ctx.get("account") @@ -102,20 +103,10 @@ export const login = (ctx: Context, account: string) => setCookie(ctx, "auth", a httpOnly: true }) -type SchemeType = "array" | "object" | "string" | "number" | "boolean" - -interface SchemeObject { - type: "object" - children: { - [key: string]: SchemeParameter +export const scheme = function(scheme: ZodObject): RequestHandler { + return function(ctx, next) { + let chk = scheme.safeParse(ctx.req.json()) + if (chk.success) next() + else ServeError(ctx, 400, chk.error.message) } -} - -interface SchemeArray { - type: "array" - children: - | SchemeParameter /* All children of the array must be this type */ - | SchemeParameter[] /* Array must match this pattern */ -} - -type SchemeParameter = SchemeType | SchemeObject | SchemeArray +} \ No newline at end of file diff --git a/src/server/lib/schemas/accounts.ts b/src/server/lib/schemas/accounts.ts new file mode 100644 index 0000000..4d85cc8 --- /dev/null +++ b/src/server/lib/schemas/accounts.ts @@ -0,0 +1,21 @@ +import {z} from "zod" +import { FileVisibility } from "./files.js" + +export const StringPassword = z.string().min(8,"password must be at least 8 characters") +export const Password = + z.object({ + hash: z.string(), + salt: z.string() + }) +export const Username = + z.string().min(3, "username too short").max(20, "username too long").regex(/[A-Za-z0-9_\-\.]+/, "username contains invalid characters") +export const Account = + z.object({ + id: z.string(), + username: Username, + email: z.optional(z.string().email("must be an email")), + password: Password, + files: z.array(z.string()), + admin: z.boolean(), + defaultFileVisibility: FileVisibility + }) \ No newline at end of file diff --git a/src/server/lib/schemas/files.ts b/src/server/lib/schemas/files.ts new file mode 100644 index 0000000..cd23dcf --- /dev/null +++ b/src/server/lib/schemas/files.ts @@ -0,0 +1,18 @@ +import {z} from "zod" +import config from "../config.js" + +export const FileId = z.string().regex(/[A-Za-z0-9_\-\.\!\=\:\&\$\,\+\;\@\~\*\(\)\']+/).max(config.maxUploadIdLength) +export const FileVisibility = z.enum(["public", "anonymous", "private"]) +export const FileTag = z.string().toLowerCase().max(30, "tag length too long") +export const FilePointer = z.object({ + filename: z.string().max(256, "filename too long"), + mime: z.string().max(256, "mimetype too long"), + messageids: z.array(z.string()), + owner: z.optional(z.string()), + sizeInBytes: z.optional(z.number()), + tag: z.optional(FileTag), + visibility: z.optional(FileVisibility).default("public"), + chunkSize: z.optional(z.number()), + lastModified: z.optional(z.number()), + md5: z.optional(z.string()) +}) \ No newline at end of file diff --git a/src/server/lib/schemas/index.ts b/src/server/lib/schemas/index.ts new file mode 100644 index 0000000..4d030ab --- /dev/null +++ b/src/server/lib/schemas/index.ts @@ -0,0 +1,2 @@ +export * as AccountSchemas from "./accounts.js" +export * as FileSchemas from "./files.js" \ No newline at end of file diff --git a/src/server/routes/api/v0/authRoutes.ts b/src/server/routes/api/v0/authRoutes.ts index 1017d4c..cb09122 100644 --- a/src/server/routes/api/v0/authRoutes.ts +++ b/src/server/routes/api/v0/authRoutes.ts @@ -14,8 +14,7 @@ import config from "../../../lib/config.js" import ServeError from "../../../lib/errors.js" import Files, { FileVisibility, - generateFileId, - id_check_regex, + generateFileId } from "../../../lib/files.js" import { writeFile } from "fs/promises" diff --git a/src/server/routes/api/v0/fileApiRoutes.ts b/src/server/routes/api/v0/fileApiRoutes.ts index 9b59fff..434b817 100644 --- a/src/server/routes/api/v0/fileApiRoutes.ts +++ b/src/server/routes/api/v0/fileApiRoutes.ts @@ -68,10 +68,6 @@ export default function (files: Files) { let fp = files.files[e] - if (fp.reserved) { - return - } - switch (body.action) { case "delete": files.unlink(e, true) diff --git a/src/server/routes/api/v1/account.ts b/src/server/routes/api/v1/account.ts index ab6a41d..08c4ecc 100644 --- a/src/server/routes/api/v1/account.ts +++ b/src/server/routes/api/v1/account.ts @@ -5,7 +5,7 @@ import { getCookie, setCookie } from "hono/cookie" // Libs -import Files, { id_check_regex } from "../../../lib/files.js" +import Files from "../../../lib/files.js" import * as Accounts from "../../../lib/accounts.js" import * as auth from "../../../lib/auth.js" import { @@ -15,11 +15,14 @@ import { noAPIAccess, requiresAccount, requiresPermissions, + scheme, } from "../../../lib/middleware.js" import ServeError from "../../../lib/errors.js" import { CodeMgr, sendMail } from "../../../lib/mail.js" import Configuration from "../../../lib/config.js" +import { AccountSchemas, FileSchemas } from "../../../lib/schemas/index.js" +import { z } from "zod" const router = new Hono<{ Variables: { @@ -80,13 +83,7 @@ const validators: { | ValidatorWithSettings } = { defaultFileVisibility(actor, target, params) { - if ( - ["public", "private", "anonymous"].includes( - params.defaultFileVisibility - ) - ) - return params.defaultFileVisibility - else return [400, "invalid file visibility"] + return params.defaultFileVisibility }, email: { acceptsNull: true, @@ -109,8 +106,8 @@ const validators: { return undefined } - if (typeof params.email !== "string") - return [400, "email must be string"] + if (!z.string().email().safeParse(typeof params.email).success) + return [400, "bad email"] if (actor.admin) return params.email // send verification email @@ -150,9 +147,6 @@ const validators: { ) return [401, "current password incorrect"] - if (typeof params.password != "string" || params.password.length < 8) - return [400, "password must be 8 characters or longer"] - if (target.email) { sendMail( target.email, @@ -173,25 +167,9 @@ const validators: { ) return [401, "current password incorrect"] - if ( - typeof params.username != "string" || - params.username.length < 3 || - params.username.length > 20 - ) - return [ - 400, - "username must be between 3 and 20 characters in length", - ] - if (Accounts.getFromUsername(params.username)) return [400, "account with this username already exists"] - if ( - (params.username.match(/[A-Za-z0-9_\-\.]+/) || [])[0] != - params.username - ) - return [400, "username has invalid characters"] - if (target.email) { sendMail( target.email, @@ -207,12 +185,7 @@ const validators: { customCSS: { acceptsNull: true, validator: (actor, target, params) => { - if ( - !params.customCSS || - (params.customCSS.match(id_check_regex)?.[0] == - params.customCSS && - params.customCSS.length <= Configuration.maxUploadIdLength) - ) + if (FileSchemas.FileId.safeParse(params.customCSS).success) return params.customCSS else return [400, "bad file id"] }, @@ -272,7 +245,10 @@ function isMessage(object: any): object is Message { } export default function (files: Files) { - router.post("/", async (ctx) => { + router.post("/", scheme(z.object({ + username: AccountSchemas.Username, + password: AccountSchemas.StringPassword + })), async (ctx) => { const body = await ctx.req.json() if (!Configuration.accounts.registrationEnabled) { return ServeError(ctx, 403, "account registration disabled") @@ -290,28 +266,6 @@ export default function (files: Files) { ) } - if (body.username.length < 3 || body.username.length > 20) { - return ServeError( - ctx, - 400, - "username must be over or equal to 3 characters or under or equal to 20 characters in length" - ) - } - - if ( - (body.username.match(/[A-Za-z0-9_\-\.]+/) || [])[0] != body.username - ) { - return ServeError(ctx, 400, "username contains invalid characters") - } - - if (body.password.length < 8) { - return ServeError( - ctx, - 400, - "password must be 8 characters or longer" - ) - } - return Accounts.create(body.username, body.password) .then((account) => { login(ctx, account) diff --git a/src/server/routes/api/v1/session.ts b/src/server/routes/api/v1/session.ts index 590d1f3..7006dad 100644 --- a/src/server/routes/api/v1/session.ts +++ b/src/server/routes/api/v1/session.ts @@ -6,7 +6,7 @@ import { getCookie, setCookie } from "hono/cookie" // Libs -import Files, { id_check_regex } from "../../../lib/files.js" +import Files from "../../../lib/files.js" import * as Accounts from "../../../lib/accounts.js" import * as auth from "../../../lib/auth.js" import { diff --git a/src/server/cli.ts b/src/server/tools/cli.ts similarity index 92% rename from src/server/cli.ts rename to src/server/tools/cli.ts index f6ce73c..6a7fca0 100644 --- a/src/server/cli.ts +++ b/src/server/tools/cli.ts @@ -1,19 +1,19 @@ import fs from "fs" import { stat } from "fs/promises" -import Files from "./lib/files.js" +import Files from "../lib/files.js" import { program } from "commander" import { basename } from "path" import { Writable } from "node:stream" -import config from "./lib/config.js" -import pkg from "../../package.json" assert { type: "json" } +import config from "../lib/config.js" +import pkg from "../../../package.json" assert { type: "json" } import { fileURLToPath } from "url" import { dirname } from "path" // init data const __dirname = dirname(fileURLToPath(import.meta.url)) -if (!fs.existsSync(__dirname + "/../../.data/")) - fs.mkdirSync(__dirname + "/../../.data/") +if (!fs.existsSync(__dirname + "/../../../.data/")) + fs.mkdirSync(__dirname + "/../../../.data/") // discord let files = new Files(config) From f0a245008202385d21d20ab8ab7b5f8b6016b578 Mon Sep 17 00:00:00 2001 From: stringsplit <77242831+nbitzz@users.noreply.github.com> Date: Tue, 30 Apr 2024 23:40:42 -0700 Subject: [PATCH 2/3] i think we're done actually --- src/server/index.ts | 4 +- src/server/lib/files.ts | 3 +- src/server/lib/middleware.ts | 25 ++- src/server/routes/api/v1/account.ts | 191 +++++++----------- src/server/routes/api/v1/api.json | 5 +- .../routes/api/v1/{info.ts => index.ts} | 0 src/server/routes/api/v1/session.ts | 17 +- 7 files changed, 107 insertions(+), 138 deletions(-) rename src/server/routes/api/v1/{info.ts => index.ts} (100%) diff --git a/src/server/index.ts b/src/server/index.ts index a96c6da..158b338 100644 --- a/src/server/index.ts +++ b/src/server/index.ts @@ -9,7 +9,7 @@ import { fileURLToPath } from "url" import { dirname } from "path" import config from "./lib/config.js" -const app = new Hono() +const app = new Hono({strict: false}) app.get( "/static/assets/*", @@ -78,7 +78,7 @@ apiRouter.loadAPIMethods().then(() => { app.fetch( new Request( new URL( - "/api/v1/info", + "/api/v1", ctx.req.raw.url ).href, ctx.req.raw diff --git a/src/server/lib/files.ts b/src/server/lib/files.ts index 92b0d1b..bd38a4c 100644 --- a/src/server/lib/files.ts +++ b/src/server/lib/files.ts @@ -10,6 +10,7 @@ import "dotenv/config" import * as Accounts from "./accounts.js" import { z } from "zod" import * as schemas from "./schemas/files.js" +import { issuesToMessage } from "./middleware.js" export let alphanum = Array.from( "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890" @@ -504,7 +505,7 @@ export class UploadStream extends Writable { let check = schemas.FileId.safeParse(id); if (!check.success) - return this.destroy(new WebError(400, check.error.message)) + return this.destroy(new WebError(400, issuesToMessage(check.error.issues))) if (this.files.files[id] && this.files.files[id].owner != this.owner) return this.destroy(new WebError(403, "you don't own this file")) diff --git a/src/server/lib/middleware.ts b/src/server/lib/middleware.ts index 61e58da..c6ab333 100644 --- a/src/server/lib/middleware.ts +++ b/src/server/lib/middleware.ts @@ -3,7 +3,7 @@ import type { Context, Handler as RequestHandler } from "hono" import ServeError from "../lib/errors.js" import * as auth from "./auth.js" import { setCookie } from "hono/cookie" -import { ZodObject } from "zod" +import { z } from "zod" /** * @description Middleware which adds an account, if any, to ctx.get("account") @@ -38,7 +38,6 @@ export const requiresAdmin: RequestHandler = function (ctx, next) { * @param tokenPermissions Permissions which your route requires. * @returns Express middleware */ - export const requiresPermissions = function ( ...tokenPermissions: auth.TokenPermission[] ): RequestHandler { @@ -94,6 +93,18 @@ export const assertAPI = function ( } } +export const issuesToMessage = function(issues: z.ZodIssue[]) { + return issues.map(e => `${e.path}: ${e.code} :: ${e.message}`).join("; ") +} + +export const scheme = function(scheme: z.ZodTypeAny): RequestHandler { + return async function(ctx, next) { + let chk = scheme.safeParse(await ctx.req.json()) + if (chk.success) return next() + else return ServeError(ctx, 400, issuesToMessage(chk.error.issues)) + } +} + // Not really middleware but a utility export const login = (ctx: Context, account: string) => setCookie(ctx, "auth", auth.create(account, 3 * 24 * 60 * 60 * 1000), { @@ -101,12 +112,4 @@ export const login = (ctx: Context, account: string) => setCookie(ctx, "auth", a sameSite: "Strict", secure: true, httpOnly: true -}) - -export const scheme = function(scheme: ZodObject): RequestHandler { - return function(ctx, next) { - let chk = scheme.safeParse(ctx.req.json()) - if (chk.success) next() - else ServeError(ctx, 400, chk.error.message) - } -} \ No newline at end of file +}) \ No newline at end of file diff --git a/src/server/routes/api/v1/account.ts b/src/server/routes/api/v1/account.ts index 08c4ecc..e4ea5a5 100644 --- a/src/server/routes/api/v1/account.ts +++ b/src/server/routes/api/v1/account.ts @@ -11,6 +11,7 @@ import * as auth from "../../../lib/auth.js" import { assertAPI, getAccount, + issuesToMessage, login, noAPIAccess, requiresAccount, @@ -43,8 +44,7 @@ type Message = [200 | 400 | 401 | 403 | 429 | 501, string] // @Jack5079 make typings better if possible type Validator< - T extends keyof Partial, - ValueNotNull extends boolean, + T extends keyof Partial > = /** * @param actor The account performing this action @@ -55,38 +55,33 @@ type Validator< actor: Accounts.Account, target: Accounts.Account, params: UserUpdateParameters & - (ValueNotNull extends true - ? { - [K in keyof Pick< - UserUpdateParameters, - T - >]-?: UserUpdateParameters[K] - } - : {}), + { + [K in keyof Pick< + UserUpdateParameters, + T + >]-?: UserUpdateParameters[K] + }, ctx: Context ) => Accounts.Account[T] | Message -// this type is so stupid stg -type ValidatorWithSettings> = - | { - acceptsNull: true - validator: Validator - } - | { - acceptsNull?: false - validator: Validator - } +type SchemedValidator< + T extends keyof Partial +> = { + validator: Validator, + schema: z.ZodTypeAny +} const validators: { - [T in keyof Partial]: - | Validator - | ValidatorWithSettings + [T in keyof Partial]: SchemedValidator } = { - defaultFileVisibility(actor, target, params) { - return params.defaultFileVisibility + defaultFileVisibility: { + schema: FileSchemas.FileVisibility, + validator: (actor, target, params) => { + return params.defaultFileVisibility + } }, email: { - acceptsNull: true, + schema: AccountSchemas.Account.shape.email.optional(), validator: (actor, target, params, ctx) => { if ( !params.currentPassword || // actor on purpose here to allow admins @@ -139,82 +134,62 @@ const validators: { return [200, "please check your inbox"] }, }, - password(actor, target, params) { - if ( - !params.currentPassword || // actor on purpose here to allow admins - (params.currentPassword && - Accounts.password.check(actor.id, params.currentPassword)) - ) - return [401, "current password incorrect"] - - if (target.email) { - sendMail( - target.email, - `Your login details have been updated`, - `Hello there! Your password on your account, ${target.username}, has been updated` + - `${actor != target ? ` by ${actor.username}` : ""}. ` + - `Please update your saved login details accordingly.` - ).catch() - } - - return Accounts.password.hash(params.password) - }, - username(actor, target, params) { - if ( - !params.currentPassword || // actor on purpose here to allow admins - (params.currentPassword && - Accounts.password.check(actor.id, params.currentPassword)) - ) - return [401, "current password incorrect"] - - if (Accounts.getFromUsername(params.username)) - return [400, "account with this username already exists"] - - if (target.email) { - sendMail( - target.email, - `Your login details have been updated`, - `Hello there! Your username on your account, ${target.username}, has been updated` + - `${actor != target ? ` by ${actor.username}` : ""} to ${params.username}. ` + - `Please update your saved login details accordingly.` - ).catch() - } - - return params.username - }, - customCSS: { - acceptsNull: true, + password: { + schema: AccountSchemas.StringPassword, validator: (actor, target, params) => { - if (FileSchemas.FileId.safeParse(params.customCSS).success) - return params.customCSS - else return [400, "bad file id"] - }, - }, - embed(actor, target, params) { - if (typeof params.embed !== "object") - return [400, "must use an object for embed"] - if (params.embed.color === undefined) { - params.embed.color = target.embed?.color - } else if ( - !( - (params.embed.color.toLowerCase().match(/[a-f0-9]+/)?.[0] == - params.embed.color.toLowerCase() && - params.embed.color.length == 6) || - params.embed.color == null + if ( + !params.currentPassword || // actor on purpose here to allow admins + (params.currentPassword && + Accounts.password.check(actor.id, params.currentPassword)) ) - ) - return [400, "bad embed color"] + return [401, "current password incorrect"] - if (params.embed.largeImage === undefined) { - params.embed.largeImage = target.embed?.largeImage - } else params.embed.largeImage = Boolean(params.embed.largeImage) + if (target.email) { + sendMail( + target.email, + `Your login details have been updated`, + `Hello there! Your password on your account, ${target.username}, has been updated` + + `${actor != target ? ` by ${actor.username}` : ""}. ` + + `Please update your saved login details accordingly.` + ).catch() + } - return params.embed + return Accounts.password.hash(params.password) + } }, - admin(actor, target, params) { - if (actor.admin && !target.admin) return params.admin - else if (!actor.admin) return [400, "cannot promote yourself"] - else return [400, "cannot demote an admin"] + username: { + schema: AccountSchemas.Username, + validator: (actor, target, params) => { + if ( + !params.currentPassword || // actor on purpose here to allow admins + (params.currentPassword && + Accounts.password.check(actor.id, params.currentPassword)) + ) + return [401, "current password incorrect"] + + if (Accounts.getFromUsername(params.username)) + return [400, "account with this username already exists"] + + if (target.email) { + sendMail( + target.email, + `Your login details have been updated`, + `Hello there! Your username on your account, ${target.username}, has been updated` + + `${actor != target ? ` by ${actor.username}` : ""} to ${params.username}. ` + + `Please update your saved login details accordingly.` + ).catch() + } + + return params.username + } + }, + admin: { + schema: z.boolean(), + validator: (actor, target, params) => { + if (actor.admin && !target.admin) return params.admin + else if (!actor.admin) return [400, "cannot promote yourself"] + else return [400, "cannot demote an admin"] + } }, } @@ -306,23 +281,11 @@ export default function (files: Files) { `the ${x} parameter cannot be set or is not a valid parameter`, ] as Message - let validator = ( - typeof validators[x] == "object" - ? validators[x] - : { - validator: validators[x] as Validator< - typeof x, - false - >, - acceptsNull: false, - } - ) as ValidatorWithSettings + let validator = validators[x]! - if (!validator.acceptsNull && !v) - return [ - 400, - `the ${x} validator does not accept null values`, - ] as Message + let check = validator.schema.safeParse(v) + if (!check.success) + return [400, issuesToMessage(check.error.issues)] return [ x, @@ -391,7 +354,7 @@ export default function (files: Files) { }) }) - router.get("/css", async (ctx) => { + router.get("/:user/css", async (ctx) => { let acc = ctx.get("account") if (acc?.customCSS) return ctx.redirect(`/file/${acc.customCSS}`) else return ctx.text("") diff --git a/src/server/routes/api/v1/api.json b/src/server/routes/api/v1/api.json index fc46ef7..25318b7 100644 --- a/src/server/routes/api/v1/api.json +++ b/src/server/routes/api/v1/api.json @@ -4,7 +4,10 @@ "mount": [ "account", "session", - "info", + { + "file": "index", + "to": "/" + }, { "file": "file/index", "to": "/file" diff --git a/src/server/routes/api/v1/info.ts b/src/server/routes/api/v1/index.ts similarity index 100% rename from src/server/routes/api/v1/info.ts rename to src/server/routes/api/v1/index.ts diff --git a/src/server/routes/api/v1/session.ts b/src/server/routes/api/v1/session.ts index 7006dad..cb2f4d6 100644 --- a/src/server/routes/api/v1/session.ts +++ b/src/server/routes/api/v1/session.ts @@ -12,9 +12,12 @@ import * as auth from "../../../lib/auth.js" import { getAccount, login, - requiresAccount + requiresAccount, + scheme } from "../../../lib/middleware.js" import ServeError from "../../../lib/errors.js" +import { AccountSchemas } from "../../../lib/schemas/index.js" +import { z } from "zod" const router = new Hono<{ Variables: { @@ -25,15 +28,11 @@ const router = new Hono<{ router.use(getAccount) export default function (files: Files) { - router.post("/", async (ctx, res) => { + router.post("/",scheme(z.object({ + username: AccountSchemas.Username, + password: AccountSchemas.StringPassword + })), async (ctx) => { const body = await ctx.req.json() - if ( - typeof body.username != "string" || - typeof body.password != "string" - ) { - ServeError(ctx, 400, "please provide a username or password") - return - } if (auth.validate(getCookie(ctx, "auth")!)) { ServeError(ctx, 400, "you are already logged in") From 5155e64b10d6d556b94523366024d7971ab6860a Mon Sep 17 00:00:00 2001 From: stringsplit <77242831+nbitzz@users.noreply.github.com> Date: Wed, 1 May 2024 00:03:57 -0700 Subject: [PATCH 3/3] i think thats probably etter actually. --- src/server/lib/schemas/files.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/server/lib/schemas/files.ts b/src/server/lib/schemas/files.ts index cd23dcf..453e2ac 100644 --- a/src/server/lib/schemas/files.ts +++ b/src/server/lib/schemas/files.ts @@ -1,7 +1,10 @@ import {z} from "zod" import config from "../config.js" -export const FileId = z.string().regex(/[A-Za-z0-9_\-\.\!\=\:\&\$\,\+\;\@\~\*\(\)\']+/).max(config.maxUploadIdLength) +export const FileId = z.string() + .regex(/[A-Za-z0-9_\-\.\!\=\:\&\$\,\+\;\@\~\*\(\)\']+/,"file ID uses invalid characters") + .max(config.maxUploadIdLength,"file ID too long") + .min(1, "you... *need* a file ID") export const FileVisibility = z.enum(["public", "anonymous", "private"]) export const FileTag = z.string().toLowerCase().max(30, "tag length too long") export const FilePointer = z.object({