Nachklang/API
2
0
Fork 0
Code Issues 2 Pull Requests Packages Projects Releases Wiki Activity

Add claude init file + refactor some security issues

Browse Source
This commit is contained in:
Patrick Müller
2026-05-02 12:22:03 +02:00
parent dc65b49219
commit da85d1487c
8 changed files with 177 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/models/calendar/events/credentials.service.ts
+4 -4
View File
@@ -11,7 +11,7 @@ dotenv.config();
export const checkAdminPrivileges = async (sessionId: string, sessionKey: string, ip: string) => {
if(sessionId) {
let user = await UserService.checkSession(sessionId, sessionKey, ip);
return user.isActive;
return user?.isActive ?? false;
}
return false;
}
@@ -23,7 +23,7 @@ export const checkAdminPrivileges = async (sessionId: string, sessionKey: string
export const checkMemberPrivileges = async (sessionId: string, sessionKey: string, password: string, ip: string) => {
if(sessionId) {
let user = await UserService.checkSession(sessionId, sessionKey, ip);
return user.isActive;
return user?.isActive ?? false;
}
return password == process.env.MEMBER_CREDENTIAL;
@@ -36,7 +36,7 @@ export const checkMemberPrivileges = async (sessionId: string, sessionKey: strin
export const checkChoirPrivileges = async (sessionId: string, sessionKey: string, password: string, ip: string) => {
if(sessionId) {
let user = await UserService.checkSession(sessionId, sessionKey, ip);
return user.isActive;
return user?.isActive ?? false;
}
return password == process.env.CHOIR_CREDENTIAL;
@@ -49,7 +49,7 @@ export const checkChoirPrivileges = async (sessionId: string, sessionKey: string
export const checkManagementPrivileges = async (sessionId: string, sessionKey: string, password: string, ip: string) => {
if(sessionId) {
let user = await UserService.checkSession(sessionId, sessionKey, ip);
return user.isActive;
return user?.isActive ?? false;
}
return password == process.env.MANAGEMENT_CREDENTIAL;
src/models/calendar/events/events.router.ts
+7 -6
View File
@@ -138,7 +138,7 @@ eventsRouter.get('/:calendar/json', async (req: Request, res: Response) => {
let events: Event[];
if(user.isActive) {
if(user?.isActive) {
events = await EventService.getAllEventsAdmin(calendarId);
} else {
events = await EventService.getAllEvents(calendarId);
@@ -147,7 +147,8 @@ eventsRouter.get('/:calendar/json', async (req: Request, res: Response) => {
// Send the events back
res.status(200).send(events);
} catch (e: any) {
console.log('Error handling a request: ' + e.message);
let errorGuid = Guid.create().toString();
logger.error('Error handling a request: ' + e.message, {reference: errorGuid});
res.status(500).send({'message': 'Internal Server Error. Try again later.'});
}
});
@@ -530,7 +531,7 @@ eventsRouter.post('/', async (req: Request, res: Response) => {
let user = await UserService.checkSession(sessionId, sessionKey, ip);
if (!user.isActive) {
if (!user?.isActive) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -708,7 +709,7 @@ eventsRouter.put('/:eventId', async (req: Request, res: Response) => {
let user = await UserService.checkSession(sessionId, sessionKey, ip);
if (!user.isActive) {
if (!user?.isActive) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -889,7 +890,7 @@ eventsRouter.put('/move/:eventId', async (req: Request, res: Response) => {
let user = await UserService.checkSession(sessionId, sessionKey, ip);
if (!user.isActive) {
if (!user?.isActive) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -1022,7 +1023,7 @@ eventsRouter.delete('/:eventId', async (req: Request, res: Response) => {
let user = await UserService.checkSession(sessionId, sessionKey, ip);
if (!user.isActive) {
if (!user?.isActive) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
src/models/calendar/events/events.service.ts
+5 -9
View File
@@ -133,12 +133,13 @@ export const getAllEventsAdmin = async (calendarId: number): Promise<Event[]> =>
export const createEvent = async (event: Event): Promise<number> => {
let conn = await NachklangCalendarDB.getConnection();
try {
await conn.beginTransaction();
let eventUUID = Guid.create().toString();
const eventsQuery = 'INSERT INTO events (calendar_id, uuid, created_by_id) VALUES (?,?,?) RETURNING event_id';
const eventsRes = await conn.execute(eventsQuery, [event.calendarId, eventUUID, event.createdById]);
const versionQuery = 'INSERT INTO event_versions (event_id, name, description, start_datetime, end_datetime, whole_day, repeat_frequency, location, url, status, version_created_by_id) VALUES (?,?,?,?,?,?,?,?,?,?,?);'
const versionRes = await conn.execute(versionQuery, [eventsRes[0].event_id, event.name, event.description, event.startDateTime, event.endDateTime, event.wholeDay, event.repeatFrequency, event.location, event.url, event.status, event.createdById]);
await conn.execute(versionQuery, [eventsRes[0].event_id, event.name, event.description, event.startDateTime, event.endDateTime, event.wholeDay, event.repeatFrequency, event.location, event.url, event.status, event.createdById]);
await conn.commit();
@@ -147,8 +148,6 @@ export const createEvent = async (event: Event): Promise<number> => {
await conn.rollback();
throw err;
} finally {
// Return connection
await conn.commit();
await conn.end();
}
};
@@ -160,6 +159,7 @@ export const createEvent = async (event: Event): Promise<number> => {
export const updateEvent = async (event: Event): Promise<number> => {
let conn = await NachklangCalendarDB.getConnection();
try {
await conn.beginTransaction();
const versionQuery = 'INSERT INTO event_versions (event_id, name, description, start_datetime, end_datetime, whole_day, repeat_frequency, location, url, status, version_created_by_id) VALUES (?,?,?,?,?,?,?,?,?,?,?);'
const versionRes = await conn.execute(versionQuery, [event.eventId, event.name, event.description, event.startDateTime, event.endDateTime, event.wholeDay, event.repeatFrequency, event.location, event.url, event.status, event.createdById]);
@@ -170,8 +170,6 @@ export const updateEvent = async (event: Event): Promise<number> => {
await conn.rollback();
throw err;
} finally {
// Return connection
await conn.commit();
await conn.end();
}
};
@@ -183,6 +181,7 @@ export const updateEvent = async (event: Event): Promise<number> => {
export const deleteEvent = async (event: Event): Promise<boolean> => {
let conn = await NachklangCalendarDB.getConnection();
try {
await conn.beginTransaction();
const versionQuery = 'INSERT INTO event_versions (event_id, status, version_created_by_id) VALUES (?,?,?);'
const versionRes = await conn.execute(versionQuery, [event.eventId, 'DELETED', event.createdById]);
@@ -193,8 +192,6 @@ export const deleteEvent = async (event: Event): Promise<boolean> => {
await conn.rollback();
throw err;
} finally {
// Return connection
await conn.commit();
await conn.end();
}
};
@@ -206,6 +203,7 @@ export const deleteEvent = async (event: Event): Promise<boolean> => {
export const moveEvent = async (event: Event): Promise<boolean> => {
let conn = await NachklangCalendarDB.getConnection();
try {
await conn.beginTransaction();
const eventQuery = 'UPDATE events SET calendar_id = ? WHERE event_id = ?';
const eventRes = await conn.execute(eventQuery, [event.calendarId, event.eventId]);
@@ -216,8 +214,6 @@ export const moveEvent = async (event: Event): Promise<boolean> => {
await conn.rollback();
throw err;
} finally {
// Return connection
await conn.commit();
await conn.end();
}
}