Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
polka.use(function securityhook(req, res, next) {
req.authed = false
let doc = {
ip: security.ip(req.headers),
uuid: req.cookies['x-uuid'],
finger: req.cookies['x-finger'],
useragent: req.headers['user-agent'],
bits: req.cookies['x-bits'],
token: req.cookies['x-token'],
} as Security.Doc
// console.log(`doc ->`, doc)
let failed = security.isDoc(doc)
if (failed) return next(boom.preconditionFailed(failed, { hook: 'security' }));
req.doc = doc
if (!req.doc.token) return next();
security.reqDoc(req).then(next).catch(next)
})
let validators = polka.validators[req.match.old]
if (validators) {
let keys = Object.keys(validators)
let i: number, len = keys.length
for (i = 0; i < len; i++) {
let key = keys[i]
let value = req[key]
let schema = schemas[key]
let schemakeys = Object.keys(schema)
let valuekeys = Object.keys(value)
let ii: number, lenn = valuekeys.length
for (ii = 0; ii < lenn; ii++) {
let valuekey = valuekeys[ii]
if (!schemakeys.includes(valuekey)) {
return next(boom.preconditionFailed(`Invalid key '${valuekey}' in request ${key}`, { hook: 'validator' }))
}
}
let validator = validators[key]
let invalids = validator(value)
if (Array.isArray(invalids)) {
let invalid = invalids[0]
Object.assign(invalid, { key, value: value[invalid.field] })
// let string = Object.keys(invalid).map(k => `${k}: ${invalid[k]}`).join(', ').trim()
return next(boom.preconditionFailed(invalid.message, { hook: 'validator' }))
}
}
}
next()
private async phandler(req: PolkaRequest, res: PolkaResponse) {
let keys = Object.keys(this.validators)
let i: number, len = keys.length
for (i = 0; i < len; i++) {
let key = keys[i]
let value = req[key]
let validator = this.validators[key]
if (validator && value == null) throw boom.preconditionRequired(key);
let invalid = validator(value)
if (Array.isArray(invalid)) {
throw boom.preconditionFailed(key, { [key]: value, reason: invalid, url: req.url })
}
}
let response = await this.opts.handler(req, res)
return response
}
} else {
processQ = processQ.then(unfoldReaderResult);
}
processQ
.then(processor(options.processor.queue))
.then(writer(output, reply))
.catch(function (err) {
logger.warn(err);
reply({
statusCode: err.statusCode || 500,
error: err.error || 'Internal Server Error',
message: err.message
}).code(err.statusCode || 500);
});
} else {
reply(boom.preconditionFailed(
'Has input reader: ' + !!reader + ', ' +
'output writer: ' + !!writer + ', ' +
'processor: ' + !!processor));
}
}
}
}
function createScopedRequest (context) {
var tenant = context.data.AUTH0_TENANT;
var jwt = context.data.AUTH0_JWT;
if (!tenant) throw Boom.preconditionFailed('Missing parameter AUTH0_TENANT');
if (!jwt) throw Boom.preconditionFailed('Missing secret AUTH0_JWT');
return Bluebird.promisifyAll(Request.defaults({
baseUrl: 'https://' + tenant + '.auth0.com/api/v2/',
headers: {
'Authorization': 'Bearer ' + jwt,
},
json: true,
}));
}
}, function (error, results) {
if (error) {
if (error.code === 'EENT') {
return reply(Boom.conflict('Key already exists'))
}
if (error.code === 'ENOUSER') {
return reply(Boom.preconditionFailed('Unknown user'))
}
return reply(Boom.wrap(error))
}
reply(error, results.create)
})
},
function readNotAvailable(path, options, cb) {
var Boom = require('boom');
if (typeof options === 'function') {
cb = options;
options = {};
}
cb(Boom.preconditionFailed('Storage is not available in this context'));
}
async function onErrorHandler(error: FastifyError, request: FastifyRequest, reply: FastifyReply, isCatcher = false) {
if (error == null) error = boom.internal('onErrorHandler -> error == null');
if (Array.isArray(error.validation)) {
let validation = error.validation[0]
let param = validation.dataPath.substr(1)
param = param ? `'${param}'` : 'is missing,'
let message = 'Parameter ' + param + ' ' + validation.message
error = boom.preconditionFailed(message, error.validation)
}
if (error instanceof gerrors.GotError) {
let gerror = (error as any) as Http.GotError
error = new boom(gerror.message, {
statusCode: gerror.statusCode,
data: gerror.response.body,
})
error.isGot = true
}
if (!error.isBoom) error = new boom(error);
if (!error.isCaught) {
if (error.data) _.defaults(error.output.payload, { attributes: error.data });
reply.type('application/json')
function registrationAcceptedEmail (ticket, session, user, cb) {
if (!user || !user.mail) {
log.error({user: user, ticket: ticket}, 'user does not have a valid email address')
return cb(Boom.preconditionFailed('user does not have a valid email address'))
}
if (ticket.users.indexOf(user.id) < 0) {
log.error({ticket: ticket, user: user}, 'error sending mail, user not in ticket')
return cb(Boom.notFound())
}
server.methods.email.send(getRegistrationAcceptedEmail(session, user), cb)
}