mirror of
https://github.com/HeyPuter/puter.git
synced 2026-08-24 15:07:17 +00:00
Daniel Salazar
79d4201f12
- declare rate + concurrency limits on every route and driver that lacked one - add acquireConcurrent for websocket connections and the DAV mount - bucket AI models by identity key only; keep resold duplicates of any vendor - skip recently-failed provider routes; cap the fallback chain at 3 attempts - let full-access access tokens bind a worker to an app their own user owns - cache resolved subscriptions so tiered limits don't add a round trip
97 lines
2.9 KiB
TypeScript
97 lines
2.9 KiB
TypeScript
import type { Request, Response } from 'express';
|
|
import { Context } from '@heyputer/backend/src/core';
|
|
import { HttpError } from '@heyputer/backend/src/core/http';
|
|
import { extension } from '@heyputer/backend/src/extensions';
|
|
import { getAppIconUrl } from '@heyputer/backend/src/util/appIcon.js';
|
|
|
|
const clients = extension.import('client');
|
|
|
|
const ALLOWED_ORDER_BY = [
|
|
'id',
|
|
'name',
|
|
'uid',
|
|
'title',
|
|
'installed_at',
|
|
] as const;
|
|
const ORDER_BY_FIELD_MAP: Record<string, string> = {
|
|
id: 'apps.id',
|
|
name: 'apps.name',
|
|
uid: 'apps.uid',
|
|
title: 'apps.title',
|
|
installed_at: 'installed_at',
|
|
};
|
|
|
|
export const handleInstalledApps = async (
|
|
req: Request,
|
|
res: Response,
|
|
): Promise<void> => {
|
|
const actor = Context.get('actor');
|
|
if (!actor?.user?.id) throw new HttpError(401, 'Authentication required');
|
|
|
|
const orderBy = String(req.query.orderBy ?? 'installed_at');
|
|
if (!(ALLOWED_ORDER_BY as readonly string[]).includes(orderBy)) {
|
|
throw new HttpError(
|
|
400,
|
|
`Invalid orderBy. Allowed: ${ALLOWED_ORDER_BY.join(', ')}`,
|
|
);
|
|
}
|
|
|
|
const page = Math.max(Number(req.query.page) || 1, 1);
|
|
const limit = Math.min(Math.max(Number(req.query.limit) || 100, 1), 100);
|
|
const offset = (page - 1) * limit;
|
|
const orderByField = ORDER_BY_FIELD_MAP[orderBy];
|
|
const sortDirection = req.query.desc ? 'DESC' : 'ASC';
|
|
|
|
const installedApps = (await clients.db.read(
|
|
`SELECT
|
|
apps.name,
|
|
apps.uid,
|
|
apps.title,
|
|
apps.description,
|
|
apps.icon,
|
|
apps.index_url,
|
|
apps.owner_user_id,
|
|
MIN(perm.dt) AS installed_at
|
|
FROM apps
|
|
LEFT JOIN user_to_app_permissions AS perm ON apps.id = perm.app_id
|
|
WHERE perm.user_id = ?
|
|
GROUP BY apps.id, apps.name, apps.uid, apps.title, apps.description
|
|
ORDER BY ${orderByField} ${sortDirection}
|
|
LIMIT ?
|
|
OFFSET ?`,
|
|
[actor.user.id, limit, offset],
|
|
)) as Array<Record<string, unknown>>;
|
|
|
|
const apiBaseUrl = extension.config.api_base_url as string | undefined;
|
|
res.json(
|
|
installedApps.map((app) => {
|
|
// An app with no owner_user_id (null/empty) isn't owned by a Puter
|
|
// user — it's an "external" app. Derive a flag and don't leak the
|
|
// raw owner id to the client.
|
|
const { owner_user_id, ...rest } = app;
|
|
const external = owner_user_id == null || owner_user_id === '';
|
|
return {
|
|
...rest,
|
|
iconUrl: getAppIconUrl(app, { apiBaseUrl }),
|
|
external,
|
|
};
|
|
}),
|
|
);
|
|
};
|
|
|
|
extension.get(
|
|
'/installedApps',
|
|
{
|
|
subdomain: 'api',
|
|
requireUserActor: true,
|
|
allowFullAccessToken: true,
|
|
rateLimit: {
|
|
scope: 'installed-apps',
|
|
limit: 120,
|
|
window: 60_000,
|
|
key: 'user',
|
|
},
|
|
},
|
|
handleInstalledApps,
|
|
);
|