lee/puter
1
0
Fork 0
mirror of https://github.com/HeyPuter/puter.git synced 2026-08-25 15:37:12 +00:00
Code Issues Actions 9 Packages Projects Releases Wiki Activity

dev: migrate /rao to actor-capable auth

Browse Source
This commit is contained in:
KernelDeimos
2025-01-03 10:24:46 -05:00
parent cd5866dd6b
commit 06a67a3b22
1 changed files with 25 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/backend/src/routers/rao.js
+25 -13
View File
@@ -21,15 +21,18 @@
"use strict"
const express = require('express');
const router = express.Router();
const auth = require('../middleware/auth.js');
const config = require('../config');
const { is_valid_uuid4, get_app } = require('../helpers');
const { DB_WRITE } = require('../services/database/consts.js');
const configurable_auth = require('../middleware/configurable_auth.js');
const { UserActorType, AppUnderUserActorType } = require('../services/auth/Actor.js');
const APIError = require('../api/APIError.js');
// -----------------------------------------------------------------------//
// POST /rao
// -----------------------------------------------------------------------//
router.post('/rao', auth, express.json(), async (req, res, next)=>{
router.post('/rao', configurable_auth(), express.json(), async (req, res, next)=>{
const { actor } = req;
// check subdomain
if(require('../helpers').subdomain(req) !== 'api')
next();
@@ -38,13 +41,22 @@ router.post('/rao', auth, express.json(), async (req, res, next)=>{
if((config.strict_email_verification_required || req.user.requires_email_confirmation) && !req.user.email_confirmed)
return res.status(400).send({code: 'account_is_not_verified', message: 'Account is not verified'});
// validation
if(!req.body.app_uid || typeof req.body.app_uid !== 'string' && !(req.body.app_uid instanceof String))
return res.status(400).send({code: 'invalid_app_uid', message: 'Invalid app uid'});
// must be a valid uuid
// app uuids start with 'app-', so in order to validate them we remove the prefix first
else if(!is_valid_uuid4(req.body.app_uid.replace('app-','')))
return res.status(400).send({code: 'invalid_app_uid', message: 'Invalid app uid'});
let app_uid;
if ( actor.type instanceof UserActorType ) {
// validation
if(!req.body.app_uid || typeof req.body.app_uid !== 'string' && !(req.body.app_uid instanceof String))
return res.status(400).send({code: 'invalid_app_uid', message: 'Invalid app uid'});
// must be a valid uuid
// app uuids start with 'app-', so in order to validate them we remove the prefix first
else if(!is_valid_uuid4(req.body.app_uid.replace('app-','')))
return res.status(400).send({code: 'invalid_app_uid', message: 'Invalid app uid'});
app_uid = req.body.app_uid;
} else if ( actor.type instanceof AppUnderUserActorType ) {
app_uid = actor.type.app.uid;
} else {
throw APIError.create('forbidden');
}
// get db connection
const db = req.services.get('database').get(DB_WRITE, 'apps');
@@ -52,15 +64,15 @@ router.post('/rao', auth, express.json(), async (req, res, next)=>{
// insert into db
db.write(
`INSERT INTO app_opens (app_uid, user_id, ts) VALUES (?, ?, ?)`,
[req.body.app_uid, req.user.id, Math.floor(new Date().getTime() / 1000)]
[app_uid, req.user.id, Math.floor(new Date().getTime() / 1000)]
)
// get app
const opened_app = await get_app({uid: req.body.app_uid});
const opened_app = await get_app({uid: app_uid});
// send process event `puter.app_open`
process.emit('puter.app_open', {
app_uid: req.body.app_uid,
app_uid: app_uid,
user_id: req.user.id,
app_owner_user_id: opened_app.owner_user_id,
ts: Math.floor(new Date().getTime() / 1000)
@@ -75,7 +87,7 @@ router.post('/rao', auth, express.json(), async (req, res, next)=>{
// If cache is not empty, prepend it with the new app
if(recent_apps && recent_apps.length > 0){
// add the app to the beginning of the array
recent_apps.unshift({app_uid: req.body.app_uid});
recent_apps.unshift({app_uid: app_uid});
// dedupe the array
recent_apps = recent_apps.filter((v,i,a)=>a.findIndex(t=>(t.app_uid === v.app_uid))===i);