Sharkey/src/server/api/call.ts

89 lines
2.3 KiB
TypeScript
Raw Normal View History

2018-12-25 13:02:37 +02:00
import limiter from './limiter';
2018-08-21 22:53:02 +03:00
import { IUser } from '../../models/user';
import { IApp } from '../../models/app';
2018-07-15 21:43:36 +03:00
import endpoints from './endpoints';
import { ApiError } from './error';
import { apiLogger } from './logger';
const accessDenied = {
message: 'Access denied.',
code: 'ACCESS_DENIED',
id: '56f35758-7dd5-468b-8439-5d6fb8ec9b8e'
};
2019-01-23 12:33:29 +02:00
export default async (endpoint: string, user: IUser, app: IApp, data: any, file?: any) => {
const isSecure = user != null && app == null;
2018-07-15 21:43:36 +03:00
const ep = endpoints.find(e => e.name === endpoint);
if (ep == null) {
throw new ApiError({
message: 'No such endpoint.',
code: 'NO_SUCH_ENDPOINT',
id: 'f8080b67-5f9c-4eb7-8c18-7f1eeae8f709',
httpStatusCode: 404
});
}
2018-07-15 21:25:35 +03:00
if (ep.meta.secure && !isSecure) {
throw new ApiError(accessDenied);
}
2018-07-15 21:25:35 +03:00
if (ep.meta.requireCredential && user == null) {
throw new ApiError({
message: 'Credential required.',
code: 'CREDENTIAL_REQUIRED',
id: '1384574d-a912-4b81-8601-c7b1c4085df1',
httpStatusCode: 401
});
}
2018-07-15 21:25:35 +03:00
if (ep.meta.requireCredential && user.isSuspended) {
throw new ApiError(accessDenied, { reason: 'Your account has been suspended.' });
}
2018-08-20 19:03:58 +03:00
if (ep.meta.requireAdmin && !user.isAdmin) {
throw new ApiError(accessDenied, { reason: 'You are not the admin.' });
2018-08-13 19:05:58 +03:00
}
2018-11-14 21:15:42 +02:00
if (ep.meta.requireModerator && !user.isAdmin && !user.isModerator) {
throw new ApiError(accessDenied, { reason: 'You are not a moderator.' });
2018-11-14 21:15:42 +02:00
}
2018-09-06 00:06:22 +03:00
if (app && ep.meta.kind && !app.permission.some(p => p === ep.meta.kind)) {
throw new ApiError({
message: 'Your app does not have the necessary permissions to use this endpoint.',
code: 'PERMISSION_DENIED',
id: '1370e5b7-d4eb-4566-bb1d-7748ee6a1838',
});
}
2018-07-15 21:25:35 +03:00
if (ep.meta.requireCredential && ep.meta.limit) {
2019-02-22 06:38:12 +02:00
// Rate limit
await limiter(ep, user).catch(e => {
throw new ApiError({
message: 'Rate limit exceeded. Please try again later.',
code: 'RATE_LIMIT_EXCEEDED',
id: 'd5826d14-3982-4d2e-8011-b9e9f02499ef',
httpStatusCode: 429
});
2019-02-22 06:38:12 +02:00
});
}
// API invoking
2019-02-22 06:39:06 +02:00
return await ep.exec(data, user, app, file).catch((e: Error) => {
if (e instanceof ApiError) {
2019-01-23 12:33:29 +02:00
throw e;
} else {
apiLogger.error(e);
throw new ApiError(null, {
e: {
message: e.message,
2019-02-22 06:39:06 +02:00
code: e.name,
stack: e.stack
}
});
2018-10-26 08:38:34 +03:00
}
2019-02-22 06:38:12 +02:00
});
2019-01-23 12:33:29 +02:00
};