versia-pub/server
2
0
Fork 0
mirror of https://github.com/versia-pub/server.git synced 2025-12-06 16:38:19 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(api): 🐛 Make validation on push subscription more lax

Browse source
This commit is contained in:
Jesse Wierzbinski 2025-01-02 03:53:38 +01:00
parent 59cf4e384a
commit ea0afdaf22
No known key found for this signature in database
4 changed files with 15 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
api/api/v1/push/subscription/index.post.ts
View file

@ -2,7 +2,6 @@ import { apiRoute } from "@/api";
import { auth, jsonOrForm } from "@/api"; import { auth, jsonOrForm } from "@/api";
import { createRoute } from "@hono/zod-openapi"; import { createRoute } from "@hono/zod-openapi";
import { PushSubscription } from "@versia/kit/db"; import { PushSubscription } from "@versia/kit/db";
import { ApiError } from "~/classes/errors/api-error";
import { WebPushSubscriptionInput } from "~/classes/schemas/pushsubscription"; import { WebPushSubscriptionInput } from "~/classes/schemas/pushsubscription";
import { RolePermissions } from "~/drizzle/schema"; import { RolePermissions } from "~/drizzle/schema";
@ -54,20 +53,15 @@ export default apiRoute((app) =>
data.alerts["admin.report"] && data.alerts["admin.report"] &&
!user.hasPermission(RolePermissions.ManageReports) !user.hasPermission(RolePermissions.ManageReports)
) { ) {
throw new ApiError( // This shouldn't throw an error in mastodon either
403, data.alerts["admin.report"] = false;
`You do not have the '${RolePermissions.ManageReports}' permission to receive report alerts`,
);
} }
if ( if (
data.alerts["admin.sign_up"] && data.alerts["admin.sign_up"] &&
!user.hasPermission(RolePermissions.ManageAccounts) !user.hasPermission(RolePermissions.ManageAccounts)
) { ) {
throw new ApiError( data.alerts["admin.sign_up"] = false;
403,
`You do not have the '${RolePermissions.ManageAccounts}' permission to receive sign-up alerts`,
);
} }
await PushSubscription.clearAllOfToken(token); await PushSubscription.clearAllOfToken(token);

11
api/api/v1/push/subscription/index.put.ts
View file

@ -61,20 +61,15 @@ export default apiRoute((app) =>
alerts["admin.report"] && alerts["admin.report"] &&
!user.hasPermission(RolePermissions.ManageReports) !user.hasPermission(RolePermissions.ManageReports)
) { ) {
throw new ApiError( // This shouldn't throw an error in mastodon either
403, alerts["admin.report"] = false;
`You do not have the '${RolePermissions.ManageReports}' permission to receive report alerts`,
);
} }
if ( if (
alerts["admin.sign_up"] && alerts["admin.sign_up"] &&
!user.hasPermission(RolePermissions.ManageAccounts) !user.hasPermission(RolePermissions.ManageAccounts)
) { ) {
throw new ApiError( alerts["admin.sign_up"] = false;
403,
`You do not have the '${RolePermissions.ManageAccounts}' permission to receive sign-up alerts`,
);
} }
await ps.update({ await ps.update({

12
api/api/v1/push/subscription/index.test.ts
View file

@ -159,9 +159,11 @@ describe("/api/v1/push/subscriptions", () => {
}), }),
}); });
expect(res.status).toBe(403); expect(res.status).toBe(200);
expect(await res.json()).toMatchObject({ expect(await res.json()).toMatchObject({
error: expect.stringContaining("permission"), alerts: {
"admin.report": false,
},
}); });
}); });
@ -235,9 +237,11 @@ describe("/api/v1/push/subscriptions", () => {
}), }),
}); });
expect(res.status).toBe(403); expect(res.status).toBe(200);
expect(await res.json()).toMatchObject({ expect(await res.json()).toMatchObject({
error: expect.stringContaining("permission"), alerts: {
"admin.report": false,
},
}); });
}); });

2
classes/schemas/pushsubscription.ts
View file

@ -16,7 +16,7 @@ export const WebPushSubscriptionInput = z
example: example:
"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoKCJeHCy69ywHcb3dAR/T8Sud5ljSFHJkuiR6it1ycqAjGTe5F1oZ0ef5QiMX/zdQ+d4jSKiO7RztIz+o/eGuQ==", "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoKCJeHCy69ywHcb3dAR/T8Sud5ljSFHJkuiR6it1ycqAjGTe5F1oZ0ef5QiMX/zdQ+d4jSKiO7RztIz+o/eGuQ==",
}), }),
auth: z.string().base64().length(24).openapi({ auth: z.string().base64().openapi({
description: description:
"Auth secret. Base64 encoded string of 16 bytes of random data.", "Auth secret. Base64 encoded string of 16 bytes of random data.",
example: "u67u09PXZW4ncK9l9mAXkA==", example: "u67u09PXZW4ncK9l9mAXkA==",