code002lover/IPost
1
0
Fork 0
Code Issues 1 Pull Requests 8 Packages Projects Releases Wiki Activity

update api documentation

Browse Source 
add authentication
This commit is contained in:
Mystikfluu
2023-04-21 00:17:05 +02:00
parent 213368d34c
commit 0ea07f9ec8
16 changed files with 2254 additions and 1136 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routes/api/all.js
+62 -68
View File
@@ -10,76 +10,67 @@ export const setup = function (router, con, server) {
router.use("/*", (req, res, next) => {
res.set("Access-Control-Allow-Origin", "*"); //we'll allow it for now
let unsigned;
if (req.body.user === undefined || req.body.pass === undefined) {
if(typeof req.get("ipost-auth-token") === "string") {
try{
req.body.auth = JSON.parse(req.get("ipost-auth-token"))
} catch(err) {
console.log("error parsing header",err)
}
if(typeof req.get("ipost-auth-token") === "string") {
try{
req.body.auth = JSON.parse(req.get("ipost-auth-token"))
} catch(err) {
console.log("error parsing header",err)
}
if(req.body.auth !== undefined && req.originalUrl !== "/redeemauthcode") {
if(typeof req.body.auth === "string") {
try{
req.body.auth = JSON.parse(req.body.auth)
} catch(err) {
console.log("error parsing",err)
}
} else
if(
typeof req.body.auth !== "object" ||
typeof req.body.auth.secret !== "string" ||
typeof req.body.auth.appid !== "number" ||
typeof req.body.auth.auth_token !== "string" ||
req.body.auth.secret.length !== 200 ||
req.body.auth.auth_token.length !== 200 ||
Buffer.from(req.body.auth.secret,"base64").length !== 150
) {
res.status(420).send("invalid authentication object")
return;
} else {
//secret : string(200 chars)
//appid : number
//auth_token: string(200 chars)
let sql = "select User_ID,User_Name,User_Bio,User_Avatar,User_Settings from ipost.auth_tokens inner join ipost.application on auth_token_isfrom_application_id=application_id inner join ipost.users on auth_token_u_id=User_ID where auth_token=? and application_secret=? and application_id=?"
con.query(sql,[SHA256(req.body.auth.auth_token,req.body.auth.appid, HASHES_DB),SHA256(req.body.auth.secret,req.body.auth.appid, HASHES_DB),req.body.auth.appid],(err,result) => {
if(err) throw err;
if(result.length !== 1) {
res.status(420).send("invalid authentication object (or server error?)")
return;
}
res.locals.userid = result[0].User_ID;
res.locals.username = result[0].User_Name;
res.locals.bio = result[0].User_Bio || "";
res.locals.avatar = result[0].User_Avatar || "";
res.locals.settings = result[0].User_Settings || {};
res.locals.isbot = true; //only apps/bots use auth tokens
next()
})
return;
}
} else {
if(!req.cookies.AUTH_COOKIE) {
next()
return
}
unsigned = unsign(req.cookies.AUTH_COOKIE, req, res);
if (!unsigned){
next()
return
}
}
}
else {
unsigned = `${req.body.user} ${SHA256(req.body.pass, req.body.user, HASHES_COOKIE)}`;
res.set("message","user+pass authentication is deprecated as of february 2023, consider switching to auth tokens")
//basically we generate the unsigned cookie
res.locals.isbot = true; //only bots use user+pass
if(req.body.auth !== undefined && req.originalUrl !== "/redeemauthcode") {
if(typeof req.body.auth === "string") {
try{
req.body.auth = JSON.parse(req.body.auth)
} catch(err) {
console.log("error parsing",err)
}
} else
if(
typeof req.body.auth !== "object" ||
typeof req.body.auth.secret !== "string" ||
typeof req.body.auth.appid !== "number" ||
typeof req.body.auth.auth_token !== "string" ||
req.body.auth.secret.length !== 200 ||
req.body.auth.auth_token.length !== 200 ||
Buffer.from(req.body.auth.secret,"base64").length !== 150
) {
res.status(420).send("invalid authentication object")
return;
} else {
//secret : string(200 chars)
//appid : number
//auth_token: string(200 chars)
let sql = "select User_ID,User_Name,User_Bio,User_Avatar,User_Settings from ipost.auth_tokens inner join ipost.application on auth_token_isfrom_application_id=application_id inner join ipost.users on auth_token_u_id=User_ID where auth_token=? and application_secret=? and application_id=?"
con.query(sql,[SHA256(req.body.auth.auth_token,req.body.auth.appid, HASHES_DB),SHA256(req.body.auth.secret,req.body.auth.appid, HASHES_DB),req.body.auth.appid],(err,result) => {
if(err) throw err;
if(result.length !== 1) {
res.status(420).send("invalid authentication object (or server error?)")
return;
}
res.locals.userid = result[0].User_ID;
res.locals.username = result[0].User_Name;
res.locals.bio = result[0].User_Bio || "";
res.locals.avatar = result[0].User_Avatar || "";
res.locals.settings = result[0].User_Settings || {};
res.locals.isbot = true; //only apps/bots use auth tokens
next()
})
return;
}
} else {
if(!req.cookies.AUTH_COOKIE) {
next()
return
}
unsigned = unsign(req.cookies.AUTH_COOKIE, req, res);
if (!unsigned){
next()
return
}
}
let sql = `select User_ID,User_Name,User_Bio,User_Avatar,User_Settings from ipost.users where User_Name=? and User_PW=?;`;
let values = unsigned.split(" ");
@@ -118,6 +109,9 @@ export const setup = function (router, con, server) {
res.status(402);
res.json({ "error": "you cannot access the api without being logged in" });
}
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
};
export default {
routes/api/dms/PersonalMessages.js
+12
View File
@@ -20,6 +20,9 @@ export const setup = function (router, con, server) {
throw err;
res.json(result);
});
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
router.get("/api/dms/conversations", function (req, res) {
res.set("Access-Control-Allow-Origin", "*");
@@ -30,10 +33,16 @@ export const setup = function (router, con, server) {
throw err;
res.json(result);
});
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
router.get("/api/dms/encrypt.js", function (req, res) {
res.set("Access-Control-Allow-Origin", "*");
res.send(web_version());
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
//
router.get("/api/dms/getDM", function (req, res) {
@@ -52,6 +61,9 @@ export const setup = function (router, con, server) {
res.json({ "error": "there is no such dm!" });
}
});
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
};
export default {
routes/api/dms/post.js
+7
View File
@@ -19,6 +19,9 @@ export const setup = function (router, con, server) {
router.get("/api/dms/pid", function (req, res) {
res.set("Access-Control-Allow-Origin", "*");
res.json({ "pid": createPID() });
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
router.post("/api/dms/post", function (req, res) {
if (!req.body.message) {
@@ -89,6 +92,10 @@ export const setup = function (router, con, server) {
console.log(5, `posted new dm by ${res.locals.username} to ${otherperson} : ${xor(encodeURIComponent(res.locals.username), otherperson)}`);
});
//TODO: bring dms up-to-date with normal posts
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
return createPID
};
routes/api/getFileIcon.js
+5 -2
View File
@@ -31,8 +31,8 @@ async function addTextOnImage(text,buf) {
}
export const setup = function (router, con, server) {
router.get("/api/getFileIcon/*",async function(req,res){
let path = req.path.split("/api/getFileIcon/")[1]
router.get("/api/getFileIcon/:icon",async function(req,res){
let path = req.params.icon
if(path.length > 4) {
res.status(410).json({"error":"file ending is too long"})
return;
@@ -41,5 +41,8 @@ export const setup = function (router, con, server) {
res.set("content-type","image/png")
res.send(buf)
})
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
})
}
routes/api/getPosts.js
+9 -4
View File
@@ -1,8 +1,4 @@
export const setup = function (router, con, server) {
router.get("/api/getPosts/*", function (_req, res) {
res.set("Access-Control-Allow-Origin", "");
res.redirect("/api/getPosts");
});
router.get("/api/getPosts", function (req, res) {
res.set("Access-Control-Allow-Origin", "*");
if (req.query.channel !== undefined) {
@@ -21,6 +17,9 @@ export const setup = function (router, con, server) {
res.json(result);
});
}
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
router.get("/api/getPostsLowerThan", function (req, res) {
res.set("Access-Control-Allow-Origin", "*");
@@ -40,6 +39,9 @@ export const setup = function (router, con, server) {
res.json(result);
});
}
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
router.get("/api/getPost", function (req, res) {
res.set("Access-Control-Allow-Origin", "*");
@@ -56,5 +58,8 @@ export const setup = function (router, con, server) {
res.json({ "error": "there is no such post!" });
}
});
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
}
routes/api/post.js
+6
View File
@@ -32,6 +32,9 @@ export const setup = function (router, con, server) {
router.get("/api/pid", function (req, res) {
res.set("Access-Control-Allow-Origin", "*");
res.json({ "pid": createPID() });
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
function validateMessage(message) {
@@ -204,6 +207,9 @@ export const setup = function (router, con, server) {
res.json({"error":"internal server error", "status": 500})
}
}
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
return createPID
};
routes/api/search.js
+4
View File
@@ -34,5 +34,9 @@ export const setup = function (router, con, server) {
else {
res.json({ "error": "invalid type passed along, expected `user` or `post`", "message": "search has been deprecated as of 11/30/2022"});
}
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
}
routes/api/settingshandler.js
+8
View File
@@ -4,6 +4,10 @@ const allowed_settings = {
export const setup = function (router, con, server) {
router.get("/api/settings", function (req, res) {
res.json(res.locals.settings);
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
router.post("/api/settings", function (req, res) {
if (!req.body.setting) {
@@ -45,6 +49,10 @@ export const setup = function (router, con, server) {
}
res.json({ "status": "success" });
});
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
};
export default {
routes/api/userRoutes.js
+19 -1
View File
@@ -47,10 +47,16 @@ export const setup = function (router, con, server) {
res.json({ "success": "updated avatar" });
});
})
});
});
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
router.get("/api/getuser", function (_req, res) {
res.json({ "username": res.locals.username, "bio": res.locals.bio, "avatar": res.locals.avatar, "userid": res.locals.userid });
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
router.get("/api/getalluserinformation", function (req, res) {
res.set("Access-Control-Allow-Origin", ""); //we don't want that here
@@ -73,6 +79,9 @@ export const setup = function (router, con, server) {
res.json({ "error": "you cannot access the api without being logged in" });
}
});
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
router.get("/api/getotheruser", function (req, res) {
res.set("Access-Control-Allow-Origin", "*");
@@ -109,6 +118,9 @@ export const setup = function (router, con, server) {
throw err;
res.json({ "success": "updated bio" });
});
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
router.post("/api/changePW", (req, res) => {
res.set("Access-Control-Allow-Origin", "");
@@ -149,6 +161,9 @@ export const setup = function (router, con, server) {
res.json({ "error": "invalid password" });
}
});
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
router.post("/api/changeUsername", function (req, res) {
res.set("Access-Control-Allow-Origin", "");
@@ -212,5 +227,8 @@ export const setup = function (router, con, server) {
res.json({ "error": "invalid password" });
}
});
/* #swagger.security = [{
"appTokenAuthHeader": []
}] */
});
}