HoovesSocial/hippofish
2
0
Fork 0
Code Issues 3 Pull requests 1 Projects Releases Packages Wiki Activity Actions

chore (backend): make sure to use the same timestamp for id and createdAt

Browse source
This commit is contained in:
naskya 2024-07-28 11:20:49 +09:00
parent 38728f6a89
commit ea48a77dac
No known key found for this signature in database
GPG key ID: 712D413B3A9FED5C
1 changed files with 17 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
packages/backend/src/server/api/mastodon/helpers/auth.ts
View file

@ -1,8 +1,11 @@
import type OAuth from "@/server/api/mastodon/entities/oauth/oauth.js"; import type OAuth from "@/server/api/mastodon/entities/oauth/oauth.js";
import { generateSecureRandomString } from "backend-rs"; import {
fetchMeta,
getTimestamp,
generateSecureRandomString,
genIdAt,
} from "backend-rs";
import { Apps, AccessTokens } from "@/models/index.js"; import { Apps, AccessTokens } from "@/models/index.js";
import { genId } from "backend-rs";
import { fetchMeta, getTimestamp } from "backend-rs";
import type { MastoContext } from "@/server/api/mastodon/index.js"; import type { MastoContext } from "@/server/api/mastodon/index.js";
import { MastoApiError } from "@/server/api/mastodon/middleware/catch-errors.js"; import { MastoApiError } from "@/server/api/mastodon/middleware/catch-errors.js";
import { difference, toSingleLast, unique } from "@/prelude/array.js"; import { difference, toSingleLast, unique } from "@/prelude/array.js";
@ -44,12 +47,13 @@ export class AuthHelpers {
permission: scopes, permission: scopes,
}); });
} catch { } catch {
const id = genId(); const createdAt = new Date();
const id = genIdAt(createdAt);
app = await Apps.insert({ app = await Apps.insert({
id, id,
secret: generateSecureRandomString(32), secret: generateSecureRandomString(32),
createdAt: new Date(), createdAt,
name: client_name, name: client_name,
description: website, description: website,
permission: scopes, permission: scopes,
@ -100,14 +104,16 @@ export class AuthHelpers {
if (!callbackUrls.some((url) => url.startsWith(body.redirect_uri))) if (!callbackUrls.some((url) => url.startsWith(body.redirect_uri)))
throw new MastoApiError(400, "Redirect URI not in list"); throw new MastoApiError(400, "Redirect URI not in list");
const secret = generateSecureRandomString(32); const secret = generateSecureRandomString(32);
const createdAt = new Date();
const id = genIdAt(createdAt);
const token = await AccessTokens.insert({ const token = await AccessTokens.insert({
id: genId(), id,
token: secret, token: secret,
hash: secret, hash: secret,
appId: app.id, appId: app.id,
userId: user.id, userId: user.id,
permission: scopes, permission: scopes,
createdAt: new Date(), createdAt,
fetched: false, fetched: false,
}).then((x) => AccessTokens.findOneByOrFail(x.identifiers[0])); }).then((x) => AccessTokens.findOneByOrFail(x.identifiers[0]));
@ -175,16 +181,17 @@ export class AuthHelpers {
if (!app || body.client_secret !== app.secret) throw invalidClientError; if (!app || body.client_secret !== app.secret) throw invalidClientError;
if (difference(scopes, app.permission).length > 0) if (difference(scopes, app.permission).length > 0)
throw invalidScopeError; throw invalidScopeError;
const createdAt = new Date();
const id = genIdAt(createdAt);
const secret = generateSecureRandomString(32); const secret = generateSecureRandomString(32);
const token = await AccessTokens.insert({ const token = await AccessTokens.insert({
id: genId(), id,
token: secret, token: secret,
hash: secret, hash: secret,
appId: app.id, appId: app.id,
userId: null, userId: null,
permission: scopes, permission: scopes,
createdAt: new Date(), createdAt,
fetched: false, fetched: false,
}).then((x) => AccessTokens.findOneByOrFail(x.identifiers[0])); }).then((x) => AccessTokens.findOneByOrFail(x.identifiers[0]));