lee/puter
1
0 Fork 0
mirror of https://github.com/HeyPuter/puter.git synced 2026-11-09 23:43:16 +00:00
Code Issues Actions 12 Packages Projects Releases Wiki Activity

fix: update validation for permission endpoints

Browse Source 
Permission endpoints would trigger 500 errors in cases where the request
did not have correct types for values in the request body. This migrates
all of these endpoints to use the new `validate_fields` function, which
is intended to make validation of fields clearer and more consistent.
This commit is contained in:
KernelDeimos authored and Eric Dubé committed 2025-12-02 16:53:48 -05:00
1 parent e5ac7af52d
commit 06d56fd711
4 files changed
+28 -38
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/backend/src/routers/auth/grant-dev-app.js
+7 -9
View File
@@ -20,6 +20,7 @@ const APIError = require('../../api/APIError');
const eggspress = require('../../api/eggspress');
const { UserActorType } = require('../../services/auth/Actor');
const { Context } = require('../../util/context');
const { validate_fields } = require('../../util/validutil');
module.exports = eggspress('/auth/grant-dev-app', {
subdomain: 'api',
@@ -40,15 +41,12 @@ module.exports = eggspress('/auth/grant-dev-app', {
req.body.app_uid = await svc_auth.app_uid_from_origin(req.body.origin);
}
if ( ! req.body.app_uid ) {
throw APIError.create('field_missing', null, { key: 'app_uid' });
}
if ( ! req.body.permission ) {
throw APIError.create('field_missing', null, {
key: 'permission',
});
}
validate_fields({
app_uid: { type: 'string', optional: false },
permission: { type: 'string', optional: false },
extra: { type: 'object', optional: true },
meta: { type: 'object', optional: true },
}, req.body);
await svc_permission.grant_dev_app_permission(actor, req.body.app_uid, req.body.permission, req.body.extra || {}, req.body.meta || {});
src/backend/src/routers/auth/grant-user-app.js
+7 -9
View File
@@ -20,6 +20,7 @@ const APIError = require('../../api/APIError');
const eggspress = require('../../api/eggspress');
const { UserActorType } = require('../../services/auth/Actor');
const { Context } = require('../../util/context');
const { validate_fields } = require('../../util/validutil');
module.exports = eggspress('/auth/grant-user-app', {
subdomain: 'api',
@@ -40,15 +41,12 @@ module.exports = eggspress('/auth/grant-user-app', {
req.body.app_uid = await svc_auth.app_uid_from_origin(req.body.origin);
}
if ( ! req.body.app_uid ) {
throw APIError.create('field_missing', null, { key: 'app_uid' });
}
if ( ! req.body.permission ) {
throw APIError.create('field_missing', null, {
key: 'permission',
});
}
validate_fields({
app_uid: { type: 'string', optional: false },
permission: { type: 'string', optional: false },
extra: { type: 'object', optional: true },
meta: { type: 'object', optional: true },
}, req.body);
await svc_permission.grant_user_app_permission(actor, req.body.app_uid, req.body.permission, req.body.extra || {}, req.body.meta || {});
src/backend/src/routers/auth/grant-user-group.js
+7 -11
View File
@@ -20,6 +20,7 @@ const APIError = require('../../api/APIError');
const eggspress = require('../../api/eggspress');
const { UserActorType } = require('../../services/auth/Actor');
const { Context } = require('../../util/context');
const { validate_fields } = require('../../util/validutil');
module.exports = eggspress('/auth/grant-user-group', {
subdomain: 'api',
@@ -35,17 +36,12 @@ module.exports = eggspress('/auth/grant-user-group', {
throw APIError.create('forbidden');
}
if ( ! req.body.group_uid ) {
throw APIError.create('field_missing', null, {
key: 'group_uid',
});
}
if ( ! req.body.permission ) {
throw APIError.create('field_missing', null, {
key: 'permission',
});
}
validate_fields({
group_uid: { type: 'string', optional: false },
permission: { type: 'string', optional: false },
extra: { type: 'object', optional: true },
meta: { type: 'object', optional: true },
}, req.body);
await svc_permission.grant_user_group_permission(actor, req.body.group_uid, req.body.permission, req.body.extra || {}, req.body.meta || {});
src/backend/src/routers/auth/grant-user-user.js
+7 -9
View File
@@ -20,6 +20,7 @@ const APIError = require('../../api/APIError');
const eggspress = require('../../api/eggspress');
const { UserActorType } = require('../../services/auth/Actor');
const { Context } = require('../../util/context');
const { validate_fields } = require('../../util/validutil');
module.exports = eggspress('/auth/grant-user-user', {
subdomain: 'api',
@@ -35,15 +36,12 @@ module.exports = eggspress('/auth/grant-user-user', {
throw APIError.create('forbidden');
}
if ( ! req.body.target_username ) {
throw APIError.create('field_missing', null, { key: 'target_username' });
}
if ( ! req.body.permission ) {
throw APIError.create('field_missing', null, {
key: 'permission',
});
}
validate_fields({
target_username: { type: 'string', optional: false },
permission: { type: 'string', optional: false },
extra: { type: 'object', optional: true },
meta: { type: 'object', optional: true },
}, req.body);
await svc_permission.grant_user_user_permission(actor, req.body.target_username, req.body.permission, req.body.extra || {}, req.body.meta || {});