versia-pub/server
2
0
Fork 0
mirror of https://github.com/versia-pub/server.git synced 2025-12-06 08:28:19 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(api): 🐛 Make validation on push subscription more lax

Browse source
This commit is contained in:
Jesse Wierzbinski 2025-01-02 03:53:38 +01:00
parent 59cf4e384a
commit ea0afdaf22
No known key found for this signature in database
4 changed files with 15 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
api/api/v1/push/subscription/index.post.ts
View file

@ -2,7 +2,6 @@ import { apiRoute } from "@/api";
import { auth, jsonOrForm } from "@/api";
import { createRoute } from "@hono/zod-openapi";
import { PushSubscription } from "@versia/kit/db";
import { ApiError } from "~/classes/errors/api-error";
import { WebPushSubscriptionInput } from "~/classes/schemas/pushsubscription";
import { RolePermissions } from "~/drizzle/schema";
@ -54,20 +53,15 @@ export default apiRoute((app) =>
data.alerts["admin.report"] &&
!user.hasPermission(RolePermissions.ManageReports)
) {
throw new ApiError(
403,
`You do not have the '${RolePermissions.ManageReports}' permission to receive report alerts`,
);
// This shouldn't throw an error in mastodon either
data.alerts["admin.report"] = false;
}
if (
data.alerts["admin.sign_up"] &&
!user.hasPermission(RolePermissions.ManageAccounts)
) {
throw new ApiError(
403,
`You do not have the '${RolePermissions.ManageAccounts}' permission to receive sign-up alerts`,
);
data.alerts["admin.sign_up"] = false;
}
await PushSubscription.clearAllOfToken(token);

11
api/api/v1/push/subscription/index.put.ts
View file

@ -61,20 +61,15 @@ export default apiRoute((app) =>
alerts["admin.report"] &&
!user.hasPermission(RolePermissions.ManageReports)
) {
throw new ApiError(
403,
`You do not have the '${RolePermissions.ManageReports}' permission to receive report alerts`,
);
// This shouldn't throw an error in mastodon either
alerts["admin.report"] = false;
}
if (
alerts["admin.sign_up"] &&
!user.hasPermission(RolePermissions.ManageAccounts)
) {
throw new ApiError(
403,
`You do not have the '${RolePermissions.ManageAccounts}' permission to receive sign-up alerts`,
);
alerts["admin.sign_up"] = false;
}
await ps.update({

12
api/api/v1/push/subscription/index.test.ts
View file

@ -159,9 +159,11 @@ describe("/api/v1/push/subscriptions", () => {
}),
});
expect(res.status).toBe(403);
expect(res.status).toBe(200);
expect(await res.json()).toMatchObject({
error: expect.stringContaining("permission"),
alerts: {
"admin.report": false,
},
});
});
@ -235,9 +237,11 @@ describe("/api/v1/push/subscriptions", () => {
}),
});
expect(res.status).toBe(403);
expect(res.status).toBe(200);
expect(await res.json()).toMatchObject({
error: expect.stringContaining("permission"),
alerts: {
"admin.report": false,
},
});
});

2
classes/schemas/pushsubscription.ts
View file

@ -16,7 +16,7 @@ export const WebPushSubscriptionInput = z
example:
"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoKCJeHCy69ywHcb3dAR/T8Sud5ljSFHJkuiR6it1ycqAjGTe5F1oZ0ef5QiMX/zdQ+d4jSKiO7RztIz+o/eGuQ==",
}),
auth: z.string().base64().length(24).openapi({
auth: z.string().base64().openapi({
description:
"Auth secret. Base64 encoded string of 16 bytes of random data.",
example: "u67u09PXZW4ncK9l9mAXkA==",