kmc7468/arkvault
1
0
Fork 0
mirror of https://github.com/kmc7468/arkvault.git synced 2025-12-15 06:18:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

백엔드에서, Request Body 검증 전에 인증을 먼저 거치도록 변경

Browse Source
This commit is contained in:
static
2024-12-30 00:48:21 +09:00
parent 04780d2493
commit d39931c79a
4 changed files with 21 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/routes/api/client/register/+server.ts
View File

@@ -5,19 +5,19 @@ import { registerUserClient } from "$lib/server/services/client";
import type { RequestHandler } from "./$types"; import type { RequestHandler } from "./$types";
export const POST: RequestHandler = async ({ request, cookies, getClientAddress }) => { export const POST: RequestHandler = async ({ request, cookies, getClientAddress }) => {
const { userId, clientId } = authenticate(cookies);
if (clientId) {
error(403, "Forbidden");
}
const zodRes = z const zodRes = z
.object({ .object({
pubKey: z.string().base64().nonempty(), pubKey: z.string().base64().nonempty(),
}) })
.safeParse(await request.json()); .safeParse(await request.json());
if (!zodRes.success) error(400, "Invalid request body"); if (!zodRes.success) error(400, "Invalid request body");
const { userId, clientId } = authenticate(cookies);
if (clientId) {
error(403, "Forbidden");
}
const { pubKey } = zodRes.data; const { pubKey } = zodRes.data;
const challenge = await registerUserClient(userId, getClientAddress(), pubKey.trim()); const challenge = await registerUserClient(userId, getClientAddress(), pubKey.trim());
return json({ challenge }); return json({ challenge });
}; };

12
src/routes/api/client/verify/+server.ts
View File

@@ -5,19 +5,19 @@ import { verifyUserClient } from "$lib/server/services/client";
import type { RequestHandler } from "./$types"; import type { RequestHandler } from "./$types";
export const POST: RequestHandler = async ({ request, cookies, getClientAddress }) => { export const POST: RequestHandler = async ({ request, cookies, getClientAddress }) => {
const { userId, clientId } = authenticate(cookies);
if (clientId) {
error(403, "Forbidden");
}
const zodRes = z const zodRes = z
.object({ .object({
answer: z.string().base64().nonempty(), answer: z.string().base64().nonempty(),
}) })
.safeParse(await request.json()); .safeParse(await request.json());
if (!zodRes.success) error(400, "Invalid request body"); if (!zodRes.success) error(400, "Invalid request body");
const { userId, clientId } = authenticate(cookies);
if (clientId) {
error(403, "Forbidden");
}
const { answer } = zodRes.data; const { answer } = zodRes.data;
await verifyUserClient(userId, getClientAddress(), answer.trim()); await verifyUserClient(userId, getClientAddress(), answer.trim());
return text("Client verified", { headers: { "Content-Type": "text/plain" } }); return text("Client verified", { headers: { "Content-Type": "text/plain" } });
}; };

6
src/routes/api/mek/register/+server.ts
View File

@@ -5,6 +5,8 @@ import { registerNewActiveMek } from "$lib/server/services/mek";
import type { RequestHandler } from "@sveltejs/kit"; import type { RequestHandler } from "@sveltejs/kit";
export const POST: RequestHandler = async ({ request, cookies }) => { export const POST: RequestHandler = async ({ request, cookies }) => {
const { userId, clientId } = await authorize(cookies, "activeClient");
const zodRes = z const zodRes = z
.object({ .object({
meks: z.array( meks: z.array(
@@ -16,9 +18,8 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
}) })
.safeParse(await request.json()); .safeParse(await request.json());
if (!zodRes.success) error(400, "Invalid request body"); if (!zodRes.success) error(400, "Invalid request body");
const { userId, clientId } = await authorize(cookies, "activeClient");
const { meks } = zodRes.data; const { meks } = zodRes.data;
await registerNewActiveMek( await registerNewActiveMek(
userId, userId,
clientId, clientId,
@@ -27,6 +28,5 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
encMek: mek.trim(), encMek: mek.trim(),
})), })),
); );
return text("MEK registered", { headers: { "Content-Type": "text/plain" } }); return text("MEK registered", { headers: { "Content-Type": "text/plain" } });
}; };

13
src/routes/api/mek/register/initial/+server.ts
View File

@@ -5,20 +5,19 @@ import { registerInitialActiveMek } from "$lib/server/services/mek";
import type { RequestHandler } from "@sveltejs/kit"; import type { RequestHandler } from "@sveltejs/kit";
export const POST: RequestHandler = async ({ request, cookies }) => { export const POST: RequestHandler = async ({ request, cookies }) => {
const { userId, clientId } = authenticate(cookies);
if (!clientId) {
error(403, "Forbidden");
}
const zodRes = z const zodRes = z
.object({ .object({
mek: z.string().base64().nonempty(), mek: z.string().base64().nonempty(),
}) })
.safeParse(await request.json()); .safeParse(await request.json());
if (!zodRes.success) error(400, "Invalid request body"); if (!zodRes.success) error(400, "Invalid request body");
const { userId, clientId } = authenticate(cookies);
if (!clientId) {
error(403, "Forbidden");
}
const { mek } = zodRes.data; const { mek } = zodRes.data;
await registerInitialActiveMek(userId, clientId, mek);
await registerInitialActiveMek(userId, clientId, mek);
return text("MEK registered", { headers: { "Content-Type": "text/plain" } }); return text("MEK registered", { headers: { "Content-Type": "text/plain" } });
}; };