versia-pub/server
2
0
Fork 0
mirror of https://github.com/versia-pub/server.git synced 2026-01-26 12:16:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

refactor(api): 🚚 Refactor authentication middleware and implement some OpenAPI routes

Browse source
This commit is contained in:
Jesse Wierzbinski 2024-08-27 17:20:36 +02:00
parent edf5edca9f
commit 1ab1c68d36
No known key found for this signature in database
66 changed files with 383 additions and 279 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

61
api/api/auth/login/index.ts
View file

@ -1,6 +1,6 @@
import { apiRoute, applyConfig, handleZodError } from "@/api";
import { apiRoute, applyConfig } from "@/api";
import { redirect } from "@/response";
import { zValidator } from "@hono/zod-validator";
import { createRoute } from "@hono/zod-openapi";
import { eq, or } from "drizzle-orm";
import { SignJWT } from "jose";
import { z } from "zod";
@ -59,6 +59,34 @@ export const schemas = {
}),
};
const route = createRoute({
method: "post",
path: "/api/auth/login",
summary: "Login",
description: "Login to the application",
request: {
body: {
content: {
"multipart/form-data": {
schema: schemas.form,
},
},
},
query: schemas.query,
},
responses: {
302: {
description: "Redirect to OAuth authorize, or error",
headers: {
"Set-Cookie": {
description: "JWT cookie",
required: false,
},
},
},
},
});
const returnError = (query: object, error: string, description: string) => {
const searchParams = new URLSearchParams();
@ -81,12 +109,7 @@ const returnError = (query: object, error: string, description: string) => {
};
export default apiRoute((app) =>
app.on(
meta.allowedMethods,
meta.route,
zValidator("form", schemas.form, handleZodError),
zValidator("query", schemas.query, handleZodError),
async (context) => {
app.openapi(route, async (context) => {
if (config.oidc.forced) {
return returnError(
context.req.query(),
@ -109,10 +132,7 @@ export default apiRoute((app) =>
if (
!(
user &&
(await Bun.password.verify(
password,
user.data.password || "",
))
(await Bun.password.verify(password, user.data.password || ""))
)
) {
return returnError(
@ -124,12 +144,12 @@ export default apiRoute((app) =>
if (user.data.passwordResetToken) {
return redirect(
`${
config.frontend.routes.password_reset
}?${new URLSearchParams({
`${config.frontend.routes.password_reset}?${new URLSearchParams(
{
token: user.data.passwordResetToken ?? "",
login_reset: "true",
}).toString()}`,
},
).toString()}`,
);
}
@ -172,11 +192,7 @@ export default apiRoute((app) =>
// Add all data that is not undefined except email and password
for (const [key, value] of Object.entries(context.req.query())) {
if (
key !== "email" &&
key !== "password" &&
value !== undefined
) {
if (key !== "email" && key !== "password" && value !== undefined) {
searchParams.append(key, String(value));
}
}
@ -191,6 +207,5 @@ export default apiRoute((app) =>
}`,
},
);
},
),
}),
);

38
api/api/auth/redirect/index.ts
View file

@ -1,5 +1,5 @@
import { apiRoute, applyConfig, handleZodError } from "@/api";
import { zValidator } from "@hono/zod-validator";
import { apiRoute, applyConfig } from "@/api";
import { createRoute } from "@hono/zod-openapi";
import { and, eq } from "drizzle-orm";
import { z } from "zod";
import { db } from "~/drizzle/db";
@ -26,17 +26,29 @@ export const schemas = {
}),
};
const route = createRoute({
method: "get",
path: "/api/auth/redirect",
summary: "OAuth Code flow",
description:
"Redirects to the application, or back to login if the code is invalid",
responses: {
302: {
description:
"Redirects to the application, or back to login if the code is invalid",
},
},
request: {
query: schemas.query,
},
});
/**
* OAuth Code flow
*/
export default apiRoute((app) =>
app.on(
meta.allowedMethods,
meta.route,
zValidator("query", schemas.query, handleZodError),
async (context) => {
const { redirect_uri, client_id, code } =
context.req.valid("query");
app.openapi(route, async (context) => {
const { redirect_uri, client_id, code } = context.req.valid("query");
const redirectToLogin = (error: string) =>
Response.redirect(
@ -50,10 +62,7 @@ export default apiRoute((app) =>
const foundToken = await db
.select()
.from(Tokens)
.leftJoin(
Applications,
eq(Tokens.applicationId, Applications.id),
)
.leftJoin(Applications, eq(Tokens.applicationId, Applications.id))
.where(
and(
eq(Tokens.code, code),
@ -68,6 +77,5 @@ export default apiRoute((app) =>
// Redirect back to application
return Response.redirect(`${redirect_uri}?code=${code}`, 302);
},
),
}),
);

41
api/api/auth/reset/index.ts
View file

@ -1,6 +1,6 @@
import { apiRoute, applyConfig, handleZodError } from "@/api";
import { apiRoute, applyConfig } from "@/api";
import { response } from "@/response";
import { zValidator } from "@hono/zod-validator";
import { createRoute } from "@hono/zod-openapi";
import { eq } from "drizzle-orm";
import { z } from "zod";
import { Users } from "~/drizzle/schema";
@ -26,6 +26,30 @@ export const schemas = {
}),
};
const route = createRoute({
method: "post",
path: "/api/auth/reset",
summary: "Reset password",
description: "Reset password",
responses: {
302: {
description: "Redirect to the password reset page with a message",
},
},
request: {
body: {
content: {
"application/x-www-form-urlencoded": {
schema: schemas.form,
},
"multipart/form-data": {
schema: schemas.form,
},
},
},
},
});
const returnError = (token: string, error: string, description: string) => {
const searchParams = new URLSearchParams();
@ -44,16 +68,10 @@ const returnError = (token: string, error: string, description: string) => {
};
export default apiRoute((app) =>
app.on(
meta.allowedMethods,
meta.route,
zValidator("form", schemas.form, handleZodError),
async (context) => {
app.openapi(route, async (context) => {
const { token, password } = context.req.valid("form");
const user = await User.fromSql(
eq(Users.passwordResetToken, token),
);
const user = await User.fromSql(eq(Users.passwordResetToken, token));
if (!user) {
return returnError(token, "invalid_token", "Invalid token");
@ -67,6 +85,5 @@ export default apiRoute((app) =>
return response(null, 302, {
Location: `${config.frontend.routes.password_reset}?success=true`,
});
},
),
}),
);

56
api/api/v1/accounts/:id/block.ts
View file

@ -1,9 +1,10 @@
import { apiRoute, applyConfig, auth, handleZodError } from "@/api";
import { zValidator } from "@hono/zod-validator";
import { apiRoute, applyConfig, auth } from "@/api";
import { createRoute } from "@hono/zod-openapi";
import { z } from "zod";
import { RolePermissions } from "~/drizzle/schema";
import { Relationship } from "~/packages/database-interface/relationship";
import { User } from "~/packages/database-interface/user";
import { ErrorSchema } from "~/types/api";
export const meta = applyConfig({
allowedMethods: ["POST"],
@ -30,15 +31,47 @@ export const schemas = {
}),
};
const route = createRoute({
method: "post",
path: "/api/v1/accounts/{id}/block",
summary: "Block user",
description: "Block a user",
middleware: [auth(meta.auth, meta.permissions)],
responses: {
200: {
description: "User blocked",
content: {
"application/json": {
schema: Relationship.schema,
},
},
},
401: {
description: "Unauthorized",
content: {
"application/json": {
schema: ErrorSchema,
},
},
},
404: {
description: "User not found",
content: {
"application/json": {
schema: ErrorSchema,
},
},
},
},
request: {
params: schemas.param,
},
});
export default apiRoute((app) =>
app.on(
meta.allowedMethods,
meta.route,
zValidator("param", schemas.param, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
app.openapi(route, async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);
@ -61,7 +94,6 @@ export default apiRoute((app) =>
});
}
return context.json(foundRelationship.toApi());
},
),
return context.json(foundRelationship.toApi(), 200);
}),
);

2
api/api/v1/accounts/:id/follow.ts
View file

@ -50,7 +50,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
const { reblogs, notify, languages } = context.req.valid("json");
if (!user) {

2
api/api/v1/accounts/:id/index.ts
View file

@ -34,7 +34,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
const foundUser = await User.fromId(id);

2
api/api/v1/accounts/:id/mute.ts
View file

@ -48,7 +48,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
// TODO: Add duration support
const { notifications } = context.req.valid("json");

2
api/api/v1/accounts/:id/note.ts
View file

@ -42,7 +42,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
const { comment } = context.req.valid("json");
if (!user) {

2
api/api/v1/accounts/:id/pin.ts
View file

@ -38,7 +38,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/accounts/:id/refetch.ts
View file

@ -34,7 +34,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/accounts/:id/remove_from_followers.ts
View file

@ -38,7 +38,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user: self } = context.req.valid("header");
const { user: self } = context.get("auth");
if (!self) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/accounts/:id/statuses.ts
View file

@ -69,7 +69,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
const otherUser = await User.fromId(id);

2
api/api/v1/accounts/:id/unblock.ts
View file

@ -38,7 +38,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/accounts/:id/unfollow.ts
View file

@ -38,7 +38,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user: self } = context.req.valid("header");
const { user: self } = context.get("auth");
if (!self) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/accounts/:id/unmute.ts
View file

@ -38,7 +38,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user: self } = context.req.valid("header");
const { user: self } = context.get("auth");
if (!self) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/accounts/:id/unpin.ts
View file

@ -38,7 +38,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user: self } = context.req.valid("header");
const { user: self } = context.get("auth");
if (!self) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/accounts/familiar_followers/index.ts
View file

@ -36,7 +36,7 @@ export default apiRoute((app) =>
zValidator("query", schemas.query, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
const { user: self } = context.req.valid("header");
const { user: self } = context.get("auth");
const { id: ids } = context.req.valid("query");
if (!self) {

2
api/api/v1/accounts/lookup/index.ts
View file

@ -46,7 +46,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { acct } = context.req.valid("query");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!acct) {
return context.json({ error: "Invalid acct parameter" }, 400);

2
api/api/v1/accounts/relationships/index.ts
View file

@ -34,7 +34,7 @@ export default apiRoute((app) =>
zValidator("query", schemas.query, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
const { user: self } = context.req.valid("header");
const { user: self } = context.get("auth");
const { id } = context.req.valid("query");
const ids = Array.isArray(id) ? id : [id];

2
api/api/v1/accounts/search/index.ts
View file

@ -76,7 +76,7 @@ export default apiRoute((app) =>
async (context) => {
const { q, limit, offset, resolve, following } =
context.req.valid("query");
const { user: self } = context.req.valid("header");
const { user: self } = context.get("auth");
if (!self && following) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/accounts/update_credentials/index.ts
View file

@ -133,7 +133,7 @@ export default apiRoute((app) =>
zValidator("json", schemas.json, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
const { user } = context.req.valid("header");
const { user } = context.get("auth");
const {
display_name,
username,

2
api/api/v1/accounts/verify_credentials/index.ts
View file

@ -20,7 +20,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
(context) => {
// TODO: Add checks for disabled/unverified accounts
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/apps/verify_credentials/index.ts
View file

@ -23,7 +23,7 @@ export default apiRoute((app) =>
meta.route,
auth(meta.auth, meta.permissions),
async (context) => {
const { user, token } = context.req.valid("header");
const { user, token } = context.get("auth");
if (!token) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/blocks/index.ts
View file

@ -46,7 +46,7 @@ export default apiRoute((app) =>
const { max_id, since_id, min_id, limit } =
context.req.valid("query");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/custom_emojis/index.ts
View file

@ -24,7 +24,7 @@ export default apiRoute((app) =>
meta.route,
auth(meta.auth, meta.permissions),
async (context) => {
const { user } = context.req.valid("header");
const { user } = context.get("auth");
const emojis = await Emoji.manyFromSql(
and(

2
api/api/v1/emojis/:id/index.ts
View file

@ -77,7 +77,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/emojis/index.ts
View file

@ -69,7 +69,7 @@ export default apiRoute((app) =>
async (context) => {
const { shortcode, element, alt, global, category } =
context.req.valid("json");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/favourites/index.ts
View file

@ -45,7 +45,7 @@ export default apiRoute((app) =>
const { max_id, since_id, min_id, limit } =
context.req.valid("query");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/follow_requests/:account_id/authorize.ts
View file

@ -34,7 +34,7 @@ export default apiRoute((app) =>
zValidator("param", schemas.param, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/follow_requests/:account_id/reject.ts
View file

@ -34,7 +34,7 @@ export default apiRoute((app) =>
zValidator("param", schemas.param, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/follow_requests/index.ts
View file

@ -45,7 +45,7 @@ export default apiRoute((app) =>
const { max_id, since_id, min_id, limit } =
context.req.valid("query");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/markers/index.ts
View file

@ -48,7 +48,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { "timeline[]": timelines } = context.req.valid("query");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
const timeline = Array.isArray(timelines) ? timelines : [];

2
api/api/v1/mutes/index.ts
View file

@ -45,7 +45,7 @@ export default apiRoute((app) =>
async (context) => {
const { max_id, since_id, limit, min_id } =
context.req.valid("query");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/notifications/:id/dismiss.ts
View file

@ -36,7 +36,7 @@ export default apiRoute((app) =>
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);
}

2
api/api/v1/notifications/:id/index.ts
View file

@ -35,7 +35,7 @@ export default apiRoute((app) =>
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);
}

2
api/api/v1/notifications/clear/index.ts
View file

@ -25,7 +25,7 @@ export default apiRoute((app) =>
meta.route,
auth(meta.auth, meta.permissions),
async (context) => {
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);
}

2
api/api/v1/notifications/destroy_multiple/index.ts
View file

@ -34,7 +34,7 @@ export default apiRoute((app) =>
zValidator("query", schemas.query, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/notifications/index.ts
View file

@ -102,7 +102,7 @@ export default apiRoute((app) =>
zValidator("query", schemas.query, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);
}

2
api/api/v1/profile/avatar.ts
View file

@ -22,7 +22,7 @@ export default apiRoute((app) =>
meta.route,
auth(meta.auth, meta.permissions),
async (context) => {
const { user: self } = context.req.valid("header");
const { user: self } = context.get("auth");
if (!self) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/profile/header.ts
View file

@ -22,7 +22,7 @@ export default apiRoute((app) =>
meta.route,
auth(meta.auth, meta.permissions),
async (context) => {
const { user: self } = context.req.valid("header");
const { user: self } = context.get("auth");
if (!self) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/roles/:id/index.ts
View file

@ -36,7 +36,7 @@ export default apiRoute((app) =>
zValidator("param", schemas.param, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
const { user } = context.req.valid("header");
const { user } = context.get("auth");
const { id } = context.req.valid("param");
if (!user) {

2
api/api/v1/roles/index.ts
View file

@ -19,7 +19,7 @@ export default apiRoute((app) =>
meta.route,
auth(meta.auth, meta.permissions),
async (context) => {
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/sso/:id/index.ts
View file

@ -41,7 +41,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id: issuerId } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/sso/index.ts
View file

@ -55,7 +55,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const form = context.req.valid("json");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/statuses/:id/context.ts
View file

@ -34,7 +34,7 @@ export default apiRoute((app) =>
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
const foundStatus = await Note.fromId(id, user?.id);

2
api/api/v1/statuses/:id/favourite.ts
View file

@ -36,7 +36,7 @@ export default apiRoute((app) =>
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/statuses/:id/favourited_by.ts
View file

@ -51,7 +51,7 @@ export default apiRoute((app) =>
context.req.valid("query");
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/statuses/:id/index.ts
View file

@ -105,7 +105,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
// TODO: Polls
const {

2
api/api/v1/statuses/:id/pin.ts
View file

@ -40,7 +40,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/statuses/:id/reblog.ts
View file

@ -41,7 +41,7 @@ export default apiRoute((app) =>
async (context) => {
const { id } = context.req.valid("param");
const { visibility } = context.req.valid("json");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/statuses/:id/reblogged_by.ts
View file

@ -44,7 +44,7 @@ export default apiRoute((app) =>
const { id } = context.req.valid("param");
const { max_id, min_id, since_id, limit } =
context.req.valid("query");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/statuses/:id/source.ts
View file

@ -34,7 +34,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/statuses/:id/unfavourite.ts
View file

@ -34,7 +34,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/statuses/:id/unpin.ts
View file

@ -33,7 +33,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/statuses/:id/unreblog.ts
View file

@ -34,7 +34,7 @@ export default apiRoute((app) =>
auth(meta.auth, meta.permissions),
async (context) => {
const { id } = context.req.valid("param");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/statuses/index.ts
View file

@ -108,7 +108,7 @@ export default apiRoute((app) =>
zValidator("json", schemas.json, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
const { user, application } = context.req.valid("header");
const { user, application } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/timelines/home.ts
View file

@ -50,7 +50,7 @@ export default apiRoute((app) =>
const { max_id, since_id, min_id, limit } =
context.req.valid("query");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v1/timelines/public.ts
View file

@ -68,7 +68,7 @@ export default apiRoute((app) =>
only_media,
} = context.req.valid("query");
const { user } = context.req.valid("header");
const { user } = context.get("auth");
const { objects, link } = await Timeline.getNoteTimeline(
and(

2
api/api/v2/filters/:id/index.ts
View file

@ -77,7 +77,7 @@ export default apiRoute((app) =>
zValidator("json", schemas.json, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
const { user } = context.req.valid("header");
const { user } = context.get("auth");
const { id } = context.req.valid("param");
if (!user) {

2
api/api/v2/filters/index.ts
View file

@ -65,7 +65,7 @@ export default apiRoute((app) =>
zValidator("json", schemas.json, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
const { user } = context.req.valid("header");
const { user } = context.get("auth");
if (!user) {
return context.json({ error: "Unauthorized" }, 401);

2
api/api/v2/search/index.ts
View file

@ -57,7 +57,7 @@ export default apiRoute((app) =>
zValidator("query", schemas.query, handleZodError),
auth(meta.auth, meta.permissions),
async (context) => {
const { user: self } = context.req.valid("header");
const { user: self } = context.get("auth");
const { q, type, resolve, following, account_id, limit, offset } =
context.req.valid("query");

4
app.ts
View file

@ -12,12 +12,12 @@ import { boundaryCheck } from "./middlewares/boundary-check";
import { ipBans } from "./middlewares/ip-bans";
import { logger } from "./middlewares/logger";
import { routes } from "./routes";
import type { ApiRouteExports } from "./types/api";
import type { ApiRouteExports, HonoEnv } from "./types/api";
export const appFactory = async () => {
const serverLogger = getLogger("server");
const app = new OpenAPIHono({
const app = new OpenAPIHono<HonoEnv>({
strict: false,
});

18
packages/database-interface/relationship.ts
View file

@ -8,6 +8,7 @@ import {
eq,
inArray,
} from "drizzle-orm";
import { z } from "zod";
import { db } from "~/drizzle/db";
import { Relationships } from "~/drizzle/schema";
import { BaseInterface } from "./base";
@ -25,6 +26,23 @@ export class Relationship extends BaseInterface<
typeof Relationships,
RelationshipWithOpposite
> {
static schema = z.object({
id: z.string(),
blocked_by: z.boolean(),
blocking: z.boolean(),
domain_blocking: z.boolean(),
endorsed: z.boolean(),
followed_by: z.boolean(),
following: z.boolean(),
muting_notifications: z.boolean(),
muting: z.boolean(),
note: z.string().nullable(),
notifying: z.boolean(),
requested_by: z.boolean(),
requested: z.boolean(),
showing_reblogs: z.boolean(),
});
async reload(): Promise<void> {
const reloaded = await Relationship.fromId(this.data.id);

20
types/api.ts
View file

@ -11,8 +11,10 @@ import type {
Unfollow,
User,
} from "@versia/federation/types";
import type { z } from "zod";
import { z } from "zod";
import type { Application } from "~/classes/functions/application";
import type { RolePermissions } from "~/drizzle/schema";
import type { User as DatabaseUser } from "~/packages/database-interface/user";
export type HttpVerb = "GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "OPTIONS";
export interface ApiRouteMetadata {
@ -43,13 +45,27 @@ export interface ApiRouteMetadata {
};
}
export const ErrorSchema = z.object({
error: z.string(),
});
export type HonoEnv = {
Variables: {
auth: {
user: DatabaseUser | null;
token: string | null;
application: Application | null;
};
};
};
export interface ApiRouteExports {
meta: ApiRouteMetadata;
schemas?: {
query?: z.AnyZodObject;
body?: z.AnyZodObject;
};
default: (app: OpenAPIHono) => RouterRoute;
default: (app: OpenAPIHono<HonoEnv>) => RouterRoute;
}
export type KnownEntity =

33
utils/api.ts
View file

@ -1,6 +1,5 @@
import type { Context } from "@hono/hono";
import { createMiddleware } from "@hono/hono/factory";
import { validator } from "@hono/hono/validator";
import type { OpenAPIHono } from "@hono/zod-openapi";
import { getLogger } from "@logtape/logtape";
import { extractParams, verifySolution } from "altcha-lib";
@ -29,7 +28,7 @@ import { db } from "~/drizzle/db";
import { Challenges } from "~/drizzle/schema";
import { config } from "~/packages/config-manager/index";
import type { User } from "~/packages/database-interface/user";
import type { ApiRouteMetadata, HttpVerb } from "~/types/api";
import type { ApiRouteMetadata, HonoEnv, HttpVerb } from "~/types/api";
export const applyConfig = (routeMeta: ApiRouteMetadata) => {
const newMeta = routeMeta;
@ -45,13 +44,7 @@ export const applyConfig = (routeMeta: ApiRouteMetadata) => {
return newMeta;
};
export const apiRoute = (
fn: (
app: OpenAPIHono /* <{
Bindings: {};
}> */,
) => void,
) => fn;
export const apiRoute = (fn: (app: OpenAPIHono<HonoEnv>) => void) => fn;
export const idValidator = createRegExp(
anyOf(digit, charIn("ABCDEF")).times(8),
@ -151,12 +144,6 @@ export const handleZodError = (
}
};
const getAuth = async (value: Record<string, string>) => {
return value.authorization
? await getFromHeader(value.authorization)
: null;
};
const checkPermissions = (
auth: AuthData | null,
permissionData: ApiRouteMetadata["permissions"],
@ -300,8 +287,10 @@ export const auth = (
permissionData?: ApiRouteMetadata["permissions"],
challengeData?: ApiRouteMetadata["challenge"],
) =>
validator("header", async (value, context) => {
const auth = await getAuth(value);
createMiddleware<HonoEnv>(async (context, next) => {
const header = context.req.header("Authorization");
const auth = header ? await getFromHeader(header) : null;
// Only exists for type casting, as otherwise weird errors happen with Hono
const fakeResponse = context.json({});
@ -328,13 +317,21 @@ export const auth = (
}
}
return checkRouteNeedsAuth(auth, authData, context) as
const authCheck = checkRouteNeedsAuth(auth, authData, context) as
| typeof fakeResponse
| {
user: User | null;
token: string | null;
application: Application | null;
};
if (authCheck instanceof Response) {
return authCheck;
}
context.set("auth", authCheck);
await next();
});
// Helper function to parse form data

3
utils/server.ts
View file

@ -1,7 +1,8 @@
import type { OpenAPIHono } from "@hono/zod-openapi";
import type { Config } from "~/packages/config-manager/config.type";
import type { HonoEnv } from "~/types/api";
export const createServer = (config: Config, app: OpenAPIHono) =>
export const createServer = (config: Config, app: OpenAPIHono<HonoEnv>) =>
Bun.serve({
port: config.http.bind_port,
reusePort: true,